Privacy Policy

1Who We Are

AFFLY LTD ("Affly", "we", "us", "our") is a company registered in Scotland under company number SC885179, with its registered office at 8 Poplar Street, Mayfield, Dalkeith, Scotland, EH22 5LW.

We operate the Affly platform (affly.co.uk and app.affly.co.uk) - a three-sided verified lead marketplace connecting performance marketers (Affiliates), businesses (Businesses), and end consumers (Consumers).

For the purposes of UK data protection law, including the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018 ("DPA 2018"), Affly is the data controller in respect of personal data we collect about website visitors, Affiliates, and Businesses. In respect of Consumer lead data, we act as data controller for verification purposes, before sharing that data exclusively with the relevant Business (who then becomes an independent data controller for that data).

Data Protection Officer: Affly is not required to appoint a statutory Data Protection Officer (DPO) under Article 37 UK GDPR, as our core activities do not involve large-scale systematic monitoring of data subjects or large-scale processing of special category data. We have nevertheless designated a privacy contact point: all data protection enquiries, data subject rights requests, and privacy-related correspondence should be sent to [email protected]. This mailbox is monitored by the senior member of the Affly team responsible for privacy compliance.

If you have any questions about this Privacy Policy or how we handle your data, please contact us at: [email protected] or by post to our registered address above.

2Data We Collect

The personal data we collect depends on how you interact with the Platform. The categories below set out what we collect and why.

2.1 Website Visitors

When you visit affly.co.uk or any of our web pages, we automatically collect:

• IP address (anonymised where possible for analytics purposes);
• Browser type, version, and operating system;
• Pages visited, referral URL, and navigation path;
• Time and date of visit, session duration;
• Anonymised demographic and interest data (via Google Analytics 4, where consent is given);
• Cookie identifiers and related data (see our Cookie Policy).

2.2 Affiliates

When you register and use the Platform as an Affiliate, we collect:

• Full name and date of birth;
• Email address (used for OTP authentication - we do not store passwords);
• Bank account details and/or payout method details (processed via Whop);
• KYC documents: government-issued photo ID (e.g. passport, driving licence) and proof of bank account ownership;
• Traffic source information and promotional materials used;
• Lead generation data: tracking link IDs, lead volumes, approval rates, earnings;
• IP address and device information used to access your account;
• Communications you send to Affly.

2.3 Businesses

When you register and use the Platform as a Business, we collect:

• Company name, company registration number, and registered address;
• Contact person's name, email address, and telephone number;
• Billing information (processed and stored by Whop; Affly does not store raw card data);
• Campaign data: niche, CPL settings, targeting parameters, daily budgets;
• Lead reports: approved leads delivered, spend data, dispute history;
• IP address and device information used to access your account;
• Communications you send to Affly.

2.4 Consumers / Leads

Source of Consumer data (Article 14 UK GDPR): Affly does not collect Consumer data directly from members of the public via our own website. Instead, Consumer data reaches Affly through the following flow: an Affiliate (a registered performance marketer) promotes a Business's campaign through their own marketing channels (paid ads, SEO, social media, email, etc.). When a member of the public clicks the Affiliate's unique tracking link and submits an enquiry via the lead form, the data is captured and routed through Affly's verification system. If the lead is verified, it is delivered to the Business who launched the campaign. The Affiliate does not see the Consumer's data after submission; the Business receives the data only once the lead is verified.

When a Consumer submits an enquiry via a lead form on the Platform, we collect:

• Full name;
• UK mobile phone number (used for OTP verification);
• Email address;
• Service of interest (e.g. roofing, boiler, dental, personal injury);
• Any additional fields specified by the relevant Business campaign (e.g. postcode, property type);
• IP address at time of submission;
• OTP verification status and timestamp;
• Intent confirmation response and timestamp;
• Device and browser information (for fraud detection purposes);
• Submission timestamp.

3Legal Basis for Processing

Under UK GDPR, we are required to have a valid legal basis for each type of personal data processing we carry out. The table below sets out the legal bases we rely on:

Where we rely on legitimate interests as our legal basis, we have carried out a balancing test to ensure our interests do not override your fundamental rights and freedoms. You can request a copy of our legitimate interests assessment by contacting us at [email protected].

4How We Use Your Data

We use the personal data we collect for the following purposes:

4.1 Affiliate Payouts and Account Management

We use Affiliate data to verify identity, process payout requests, maintain earnings records, and communicate about campaign performance, account changes, and compliance matters.

4.2 Business Billing and Campaign Delivery

We use Business data to charge for Approved Leads, maintain credit wallet balances, deliver lead data to the relevant Business dashboard, issue invoices, and communicate about campaign performance and billing.

4.3 Lead Verification and Matching

We use Consumer data to verify submissions (via OTP and scoring), detect fraudulent or duplicate submissions, match the lead to the correct Business campaign, and deliver the Approved Lead to the Business.

4.4 Fraud Prevention and Platform Security

We analyse data from all User types to detect patterns of fraud, abuse, or policy violation. This includes IP analysis, velocity checks, device fingerprinting, and cross-referencing with known fraud indicators. This processing protects all legitimate Users of the Platform.

4.5 Analytics and Platform Improvement

We use aggregated and, where applicable, anonymised data to understand how the Platform is used, identify areas for improvement, and inform product development decisions. We use Google Analytics 4 for this purpose where you have consented to analytics cookies.

4.6 Communications

Transactional messages. We send service-related messages (e.g. payout confirmations, account alerts, lead delivery notifications, security notices, billing notifications) as part of our contractual relationship with you. These are necessary for the operation of your account and cannot be opted out of without closing your account.

Marketing messages - soft opt-in basis. We may also send marketing messages to registered Users - including service updates, new feature announcements, campaign opportunities, and relevant industry information. We rely on the "soft opt-in" exception under Regulation 22(3) of the Privacy and Electronic Communications Regulations 2003 (PECR), as you are an existing customer or registered user of a similar service to the one being marketed. We comply with this exception as follows:

• You were given the opportunity to opt out of marketing communications at the point your contact details were first collected;
• Every marketing email includes a clear and free unsubscribe link in the footer, allowing you to opt out at any time with a single click;
• Every marketing email also links to your email preferences, allowing you to selectively opt out of certain categories of message;
• Once you unsubscribe, your preference is recorded immediately and we will not send you further marketing messages of the type you opted out of.

Our marketing communications comply with the Information Commissioner's Office Direct Marketing Code of Practice and the requirements of PECR. You can also opt out by emailing [email protected] at any time.

4.7 Legal and Regulatory Compliance

We may use and retain data as required to comply with legal obligations, respond to regulatory enquiries, and cooperate with law enforcement requests made in accordance with applicable law.

4.8 Automated Decision-Making and Profiling

Affly operates two automated systems that involve decision-making and profiling within the meaning of Articles 4(4) and 22 of the UK GDPR. We disclose these here so you understand how they work, what their effect is, and what rights you have in respect of them.

(a) Automated lead verification and scoring

When a Consumer submits a lead form, our system automatically assesses the submission against a set of criteria (valid UK mobile number, OTP verification, intent confirmation, completeness of fields) and assigns a Verification Score out of 9 points. The full scoring logic is set out in our Terms of Service (Section 9). Leads scoring 6 or above are classified as Approved Leads and delivered to the relevant Business; leads scoring below 6 are rejected and not delivered.

This is a fully automated process. The decision is made by software without human intervention as part of the standard lead flow.

• Effect on the Consumer: If a Consumer's submission scores below 6, they will not be connected to a Business in respect of that enquiry. The Consumer is free to enquire again or contact a Business directly.
• Effect on the Affiliate: The Affiliate is only paid for Approved Leads (score ≥6). A rejected lead generates no earnings.
• Effect on the Business: The Business is only charged for Approved Leads. Rejected leads incur no cost.

(b) Automated affiliate behaviour scoring and fraud detection

We continuously analyse Affiliate submission patterns and behaviour on the Platform using automated systems to detect potential fraud, abuse, or attempts to game the verification system. This profiling looks at signals including (without limitation): IP addresses, device fingerprints, submission velocity, lead approval rates, duplicate submission patterns, and cross-account correlations.

Where an Affiliate's behaviour pattern indicates potential fraud or breach of our Terms of Service, their account may be automatically flagged for review. Flagged accounts may have payouts withheld pending investigation, be suspended temporarily, or in serious cases be terminated permanently with forfeiture of pending earnings.

Significance for Affiliates: A flag, suspension, or termination has a significant effect on the Affiliate, as it affects their ability to earn income on the Platform. We therefore treat this as automated decision-making with significant effects within the meaning of Article 22 UK GDPR.

(c) Your rights in respect of automated decisions

Under Article 22 UK GDPR, where we make decisions about you solely by automated means that produce legal effects or similarly significantly affect you, you have the right to:

• Request human review of the decision by a member of the Affly team;
• Express your point of view and provide additional information you consider relevant;
• Contest the decision and request that it be reconsidered.

To exercise these rights, contact us at [email protected] with a description of the decision you wish to contest and any information you would like us to consider. We will acknowledge your request within 5 business days and provide a substantive response within 1 calendar month. A senior member of our team (not the original automated system) will review your case.

Note: Affiliates may also raise account-related disputes through the standard escalation process set out in our Terms of Service. Businesses may dispute lead approval decisions within 14 days as set out in Section 10 of our Terms of Service.

5Sharing Your Data

We do not sell your personal data to any third party under any circumstances. We share data only in the limited circumstances described below:

5.1 Service Providers (Data Processors)

We share personal data with the following categories of service provider who process data on our behalf under binding data processing agreements:

• Whop - payment processing for Business credit top-ups and Affiliate payout transfers. Whop processes billing and payout data on our behalf and is PCI-DSS compliant. Whop's privacy policy: whop.com/legal/privacy-policy.
• Google (Analytics) - where you have consented to analytics cookies, Google Analytics 4 receives anonymised data about your use of the Platform. Google's privacy policy: policies.google.com/privacy.
• Meta / Facebook (Marketing Pixel) - where you have consented to marketing cookies, Meta may receive data about your interaction with our site for advertising purposes. Meta's privacy policy: facebook.com/privacy/policy.
• TikTok (Marketing Pixel) - where you have consented to marketing cookies, TikTok may receive data about your interaction with our site. TikTok's privacy policy: tiktok.com/legal/privacy-policy.
• Twilio Inc. - delivers OTP (one-time passcode) SMS messages used to verify Consumer mobile numbers during the lead submission process. Only the mobile number and OTP code are shared with Twilio. Twilio's privacy notice: twilio.com/legal/privacy.
• ClickSend Pty Ltd - delivers transactional SMS notifications (e.g. account alerts, payout confirmations) to Affiliates and Businesses where applicable. Only the mobile number and message content are shared with ClickSend. ClickSend's privacy policy: clicksend.com/legal/privacy.
• Sumsub (Sum and Substance Ltd) - regulated third-party identity verification provider used to perform Know Your Customer (KYC) checks on Affiliates before payouts can be processed. Identity documents (passport, driving licence) and verification results are processed by Sumsub under a binding data processing agreement. Sumsub's privacy policy: sumsub.com/privacy-notice.

5.2 Businesses (Lead Delivery)

Upon approval of a Consumer's lead, we share that Consumer's contact and enquiry data with the specific Business running the relevant campaign. See Section 6 for full details of how this works and the Business's responsibilities.

5.3 Legal and Regulatory Authorities

We may disclose personal data to law enforcement agencies, regulators (including the ICO), or courts where we are required to do so by law, court order, or where we reasonably believe disclosure is necessary to prevent crime or protect the vital interests of any person.

5.4 Business Transfers

In the event of a merger, acquisition, or sale of Affly's business or assets, personal data held by Affly may be transferred to the acquiring entity as part of that transaction. We will notify affected Users in advance of such a transfer where practicable and legally permissible.

5.5 No Third-Party Data Sales

Affly does not sell, rent, or trade personal data with any third party for their own marketing or commercial purposes. Any sharing of data is solely for the operational purposes described in this Policy.

6Lead Data & Businesses

This section explains the specific data flows that occur when a Consumer submits a lead form, as this is central to how the Affly Platform works.

6.1 What Happens When a Lead Is Submitted

When a Consumer submits their details via a lead form operated on an Affiliate's promotional asset:

1. Affly receives the Consumer's data and immediately begins the verification process (OTP, scoring, fraud detection);
2. If the lead achieves a Verification Score of 6 or above (an "Approved Lead"), the Consumer's details are automatically delivered to the Business running the relevant campaign;
3. The lead data shared with the Business includes: the Consumer's name, phone number, email address, service interest, any additional campaign-specific fields, submission timestamp, and verification status;
4. The lead is exclusive - it is shared with one Business only.

6.2 Business Responsibilities as Data Controller

Upon receipt of an Approved Lead, the Business becomes an independent data controller in respect of the Consumer's personal data. Affly is not responsible for how the Business uses that data after delivery. Businesses are required by our Terms of Service to:

• Process Consumer data in accordance with the UK GDPR and PECR;
• Use the data solely to follow up on the specific service enquiry;
• Not sell, share, or transfer the Consumer's data to any third party;
• Retain the data only as long as necessary;
• Respond appropriately to any data subject rights requests from the Consumer.

6.3 Consumer Data Subject Rights Against Businesses

If a Consumer wishes to exercise data subject rights (such as the right to erasure) in respect of data held by a Business that received their lead, they should contact that Business directly. If a Consumer is unable to identify or contact the Business, they may contact Affly at [email protected] and we will use reasonable efforts to assist.

6.4 Affly's Retention of Lead Data

Affly retains lead data (including Consumer details) for a period of 2 years from the date of submission for the purposes of fraud investigation, dispute resolution, and regulatory compliance. After this period, the data is securely deleted.

7Data Retention

We retain personal data only for as long as is necessary for the purposes for which it was collected, or as required by law. Our standard retention periods are set out below:

Where we are required by law to retain data for longer than the periods above, we will retain it for the legally required period. When data is no longer required, it is securely deleted or anonymised.

8Your Rights Under UK GDPR

As a data subject, you have the following rights under UK GDPR. These rights are not absolute - they are subject to certain exemptions and limitations under applicable law - but we will respond to all valid requests promptly and in accordance with our legal obligations.

To exercise any of your rights, please contact us at [email protected]. We may need to verify your identity before processing your request. We will respond within 1 month of receiving a valid request (this can be extended to 3 months in complex cases, with notification to you).

9Cookies

Affly uses cookies and similar tracking technologies on its website. These include strictly necessary cookies (required for the site to function), analytics cookies (to understand how the site is used), and marketing cookies (to measure the effectiveness of advertising).

For full details of the cookies we use, their purposes, and how to manage your preferences, please see our Cookie Policy.

You can manage your cookie preferences at any time using our consent tool. Click "Cookie preferences" in the footer of any page, or visit our Cookie Policy page.

10Security

Affly takes the security of your personal data seriously and implements appropriate technical and organisational measures to protect it against accidental loss, unauthorised access, disclosure, alteration, or destruction. Our security measures include:

• Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS (HTTPS). Our website enforces HTTPS across all pages.
• Encryption at rest: Sensitive data (including KYC documents and financial records) is encrypted at rest using industry-standard encryption.
• Access controls: Access to personal data within Affly is restricted to employees and systems that require it to perform their functions. All internal access is logged and monitored.
• Authentication security: We use one-time passcode (OTP) authentication via email. We do not store passwords in any form.
• Payment security: We do not store raw payment card data. All card processing is handled by Whop, which is PCI-DSS Level 1 compliant.
• Third-party security: We require all third-party service providers who process personal data on our behalf to maintain appropriate security standards and to notify us of any security incidents.

10.1 Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours of becoming aware of the breach, as required by UK GDPR Article 33. Where the breach is likely to result in a high risk to you, we will also notify you directly without undue delay, as required by Article 34.

While we take all reasonable precautions, no data transmission or storage system is 100% secure. If you believe your account has been compromised or you have identified a security vulnerability, please contact us immediately at [email protected].

11International Transfers

Affly is a UK company and we process personal data primarily within the United Kingdom and the European Economic Area (EEA). We will not transfer your personal data to countries outside the UK/EEA without ensuring adequate protections are in place.

Some of our third-party service providers (including Whop) may process data in countries outside the UK. Where such transfers occur, we ensure they are covered by:

• An adequacy decision by the UK Government confirming that the destination country provides adequate data protection;
• The use of UK International Data Transfer Agreements (IDTAs) or EU Standard Contractual Clauses (SCCs) as adopted for UK transfers; or
• Other transfer mechanisms recognised under UK GDPR.

Whop is headquartered in the United States and operates under Standard Contractual Clauses approved by the UK ICO. We use Whop's services where necessary for payment processing and minimise cross-border data flows where possible.

If you would like further information about the specific safeguards in place for any international transfer, please contact us at [email protected].

12Children

The Platform is intended for adults aged 18 and over. We do not knowingly collect personal data from individuals under the age of 18. If you are under 18, please do not use the Platform or submit any personal data to us.

If we become aware that we have collected personal data from a person under the age of 18 without verified parental consent, we will take steps to delete that data as soon as possible. If you believe we may have inadvertently collected data from a person under 18, please contact us immediately at [email protected].

13Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices, the law, or our business. When we make material changes, we will:

• Update the "Last updated" date at the top of this page;
• Notify registered Users by email at the address associated with their account; and/or
• Display a prominent notice on the Platform.

We encourage you to review this Privacy Policy periodically. Your continued use of the Platform after changes take effect constitutes your acknowledgement of the updated Policy. If any changes require your fresh consent (e.g. new processing activities), we will seek that consent separately.

Previous versions of this Privacy Policy can be requested by emailing [email protected].

14Contact Us

If you have any questions about this Privacy Policy, how we handle your personal data, or wish to exercise any of your data subject rights, please contact us:

• Email: [email protected]
• Post: AFFLY LTD, 8 Poplar Street, Mayfield, Dalkeith, Scotland, EH22 5LW
• Company number: SC885179 (registered in Scotland)

We will acknowledge all data subject requests within 5 business days and provide a full response within 1 calendar month.