Who this policy covers
This policy applies to everyone who uses our website (referralcandy.com), our referral pages (refr.cc) or the ReferralCandy service. In this policy:
- Merchants are the businesses that run a referral, affiliate or loyalty program with ReferralCandy, and the staff who use their ReferralCandy account. Our Data Processing Addendum calls merchants “Customers”.
- Shoppers are people who buy from a merchant, share a merchant’s referral link (advocates) or receive one (referred friends).
- Visitors are people who visit our website.
Our role depends on whose data it is
- Data about merchants and visitors. We decide how this data is used. Under the GDPR we are the controller. This policy explains how we use it.
- Data about shoppers. We process this data for the merchant and only on the merchant’s instructions. Under the GDPR we are the merchant’s processor. Under Singapore’s PDPA we are a data intermediary. Under US state privacy laws we are a service provider or processor. Our Data Processing Addendum sets out the terms.
If you are a shopper, please also read the privacy policy of the merchant whose referral program you use. The merchant decides how your data is used in its program.
Privacy laws we support
ReferralCandy supports merchants that need to comply with these privacy laws:
- GDPR: the EU General Data Protection Regulation, for the EU and the European Economic Area (EEA).
- UK GDPR and the UK Data Protection Act 2018.
- Swiss Federal Act on Data Protection (FADP).
- CCPA: the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CPRA).
- VCDPA: the Virginia Consumer Data Protection Act, and other US state privacy laws with similar rules.
- PDPA: Singapore’s Personal Data Protection Act 2012.
How we help merchants comply
- A Data Processing Addendum (DPA) for every merchant. Our DPA forms part of our Terms of Service, so it covers every merchant. It includes the EU Standard Contractual Clauses and the UK International Data Transfer Addendum. If you need a signed copy, email compliance@referralcandy.com.
- We follow the merchant’s instructions. We process shopper data only to provide, secure, support and improve ReferralCandy for the merchant, as the DPA allows.
- We do not sell or share personal data. This applies to shopper, merchant and visitor data. See We do not sell or share personal data.
- Shopify privacy requests are handled automatically.
- When a Shopify shopper asks a merchant to delete their data, Shopify tells us. We then delete or anonymise that shopper’s data.
- When a shopper asks for a copy of their data, Shopify tells us. Our compliance team then sends the merchant the data we hold about that shopper.
- When a merchant uninstalls ReferralCandy, Shopify asks us to delete the store’s data, and we do.
- Privacy requests on other platforms. Merchants on other platforms can delete shopper data in the ReferralCandy dashboard. If something can’t be deleted there, email compliance@referralcandy.com and we will help.
- Consent tools. Merchants can turn on a cookie consent banner for the ReferralCandy widget. Merchants on Shopify can choose to send referral emails only to shoppers who agreed to get marketing emails from the store.
- Security incidents. If a security incident affects shopper data, we tell the merchant without undue delay. We give the merchant the information it needs to meet its own legal duties.
- Notice before we add a subprocessor. We tell merchants at least 30 days before a new subprocessor starts processing shopper data, as set out in the DPA.
- Safe international transfers. We protect data that leaves the EEA, the UK or Switzerland with Standard Contractual Clauses and the other safeguards described in Where we store data.
- A Data Protection Officer. Our Data Protection Officer oversees how we protect personal data. See How to contact us.
Data we collect
Data you give us
- Account and contact details: your name, email address, phone number, company and store details. We collect these when you sign up, book a demo, join a webinar or contact us.
- Billing details: your plan and payment history. Stripe processes card payments for us. We don’t store card numbers.
- Support messages: what you send us by live chat, email or phone.
Data from a merchant’s store
When a merchant connects their store (for example on Shopify, BigCommerce or WooCommerce), we receive data through that platform’s API. This data includes:
- store details;
- orders and the shoppers who placed them, such as name, email address and order details;
- whether a shopper agreed to get marketing emails, where the platform provides it; and
- tracking data used to link an order to a referral.
Data from shoppers in a referral program
- name and email address;
- referral links, shares, clicks, coupon codes, rewards and referral status; and
- for cash or gift card rewards, the details needed to send the reward, such as a PayPal email address.
Data collected automatically
- Log data: IP address, browser and device details, operating system, time zone, approximate location and login details.
- Usage data: clicks, pages visited, actions taken and errors seen on our website, in the dashboard and in referral widgets.
- Cookies and similar technologies. See Cookies and tracking.
Data from other sources
We may receive personal data from:
- partners we run joint marketing with;
- services a merchant connects to ReferralCandy; and
- social media accounts you choose to connect to ReferralCandy.
Sensitive data
ReferralCandy is not designed for sensitive data, such as health data, biometric data or government ID numbers. Merchants should not send us this kind of data.
How we use data
We use personal data only when we have a legal reason to do so. The table shows each use and its legal basis under the GDPR.
| Purpose | What this includes | Legal basis |
|---|---|---|
| Run the referral program | Logging merchants in, saving settings, tracking referrals and orders, sending referral emails, issuing rewards and coupon codes, processing payments, and hosting referral pages. | Contract; legitimate interests |
| Prevent fraud and keep ReferralCandy secure | Detecting fake or self-referrals, protecting accounts, monitoring systems and investigating incidents. | Legitimate interests; legal obligation |
| Support | Answering questions by live chat, email or phone, and telling merchants about changes to the service or how their program is doing. | Contract |
| Improve ReferralCandy | Understanding how ReferralCandy is used, testing features, collecting feedback and analysing data. | Legitimate interests |
| AI features | When a merchant uses an AI feature, such as the AI referral expert, we send the information that request needs to our AI provider. We don’t send personal data to it in bulk. | Contract; legitimate interests |
| Marketing to merchants | Emails about product updates, new features and content. You can unsubscribe at any time. | Legitimate interests; consent where the law requires it |
| Legal and compliance | Meeting legal, tax and accounting duties, and establishing, exercising or defending legal claims. | Legal obligation; legitimate interests |
We do not sell or share personal data
We do not sell personal data. We do not share personal data for cross-context behavioural advertising. This applies to everyone: merchants, shoppers and visitors.
If ReferralCandy is merged with or acquired by another company, personal data may pass to the new owner so they can keep providing the service. This policy will still apply to that data.
Automated decisions and profiling
We use limited automated analysis, for example to spot referral fraud and to choose what to show a merchant in their dashboard. We don’t make automated decisions that have legal or similarly significant effects on anyone.
Who we share data with
- Subprocessors and service providers that help us run ReferralCandy. They are listed in Subprocessors and service providers.
- The merchant. Shopper data in a referral program is shared with the merchant who runs it.
- Services a merchant connects. If a merchant connects another service, such as an email platform, we send that service the data the merchant asks us to send.
- Authorities, when the law requires it. If we get a legally binding request, we check it is valid and disclose only what the law requires. Where the law allows, we tell the merchant first. We don’t hand over data voluntarily.
- A new owner, if ReferralCandy is merged or acquired (see above).
Subprocessors and service providers
This list shows the third parties we use and what data each one gets. “Customer Personal Data” means the shopper data and other personal data that we process for merchants, as defined in our DPA.
1. ReferralCandy subprocessors
These providers may process Customer Personal Data for us to provide the ReferralCandy service.
| Provider | Purpose | Data processed |
|---|---|---|
| Amazon Web Services (AWS) | Hosting, compute, databases, storage, content delivery, logging, queues, analytics infrastructure and production email delivery | Customer Personal Data stored or processed through the ReferralCandy service, including customer, advocate, referral, order, campaign and related service data |
| OpenAI | AI-powered ReferralCandy features and operational assistance | Information sent to or retrieved by an AI feature. This may include Customer Personal Data where the merchant’s request needs it, for example when a merchant uses the AI referral expert. Personal data is not sent in bulk. |
| IPinfo | Geographic and network-level traffic analysis | IP addresses and related network and location information |
| Twilio SendGrid | Backup email delivery | Email addresses and email content, only when the backup service is used instead of AWS. It only applies to merchants who don’t send emails through their own email platform (such as Klaviyo, Omnisend, Mailchimp or Brevo). Our main email delivery runs on AWS. |
2. Reward providers a merchant turns on
These providers process Customer Personal Data only when a merchant uses the matching reward or payout feature.
| Provider | Purpose | Data processed |
|---|---|---|
| PayPal | Sending cash rewards or payouts | Reward recipient details, including email address, payout amount, currency and transaction details |
| Tremendous | Sending digital rewards and gift cards | Reward recipient details, including name, email address, reward amount, currency and fulfilment details |
If a merchant connects its own Tremendous account, Tremendous is a provider chosen by the merchant, not a subprocessor we appoint. We send it data on the merchant’s instructions.
3. Integrations a merchant chooses
Merchants can connect ReferralCandy to other platforms. Depending on what a merchant turns on, we send Customer Personal Data to that platform on the merchant’s instructions. Examples:
- Ecommerce platforms: Shopify, BigCommerce, WooCommerce, Squarespace, Commerce7 and Recharge.
- Email and customer engagement: Klaviyo, Mailchimp, Omnisend, Brevo and Customer.io.
- Support: Gorgias.
- Advertising and analytics services, webhooks and other destinations that the merchant sets up.
These are not subprocessors we appoint. The merchant chooses or controls each service and is responsible for its relationship with that provider.
4. Services for our own business
We also use these services to run our own business: merchant accounts, billing, product analytics, support and marketing to merchants. They are not meant to receive Customer Personal Data, so they are not subprocessors of Customer Personal Data. They may process personal data about merchants, merchant staff and website visitors.
| Provider | Use |
|---|---|
| Customer.io | Messages to merchants and merchant staff. Our own Customer.io account is not used to message shoppers. (This is separate from the Customer.io integration a merchant can turn on.) |
| Stripe | Merchant subscription and billing payments. Stripe is not used for payments made by a merchant’s shoppers. |
| Google Analytics and Google Tag Manager | Product and usage analytics, including how merchant users use ReferralCandy. |
| Twilio Segment | Product and account analytics. Segment passes data on to our other tools, such as Customer.io and the Meta and Google advertising platforms. |
| FullStory | Product analytics and session analysis in the merchant-facing ReferralCandy app. |
| Intercom | Merchant support, account messages and customer success. |
Changes to this list
We review our providers regularly and remove ones we no longer need. We no longer use Freshdesk or the related Freshworks tools. When we add a subprocessor that will process Customer Personal Data, we give merchants at least 30 days’ notice, as set out in our DPA. Questions about our subprocessors: compliance@referralcandy.com.
Where we store data
- Singapore. Anafore is based in Singapore. We store data mainly in Singapore, on Amazon Web Services (AWS region ap-southeast-1).
- United States. Some processing happens in the United States, including email delivery, content delivery, logging, monitoring and support. Names and email addresses may be kept for a short time in US email delivery logs.
- EU and UK. Some requests pass through AWS servers in the EU or UK for speed. The data is still stored in Singapore.
- Other countries. Some subprocessors may process data in other countries, depending on the service and the integrations a merchant turns on.
How we protect international transfers
When personal data leaves the EEA, the UK or Switzerland for a country without an adequacy decision, we protect it with:
- the EU Standard Contractual Clauses (2021), the UK International Data Transfer Addendum and Swiss-specific adjustments, all included in our DPA;
- data protection terms with our subprocessors;
- a transfer impact assessment of our transfers to Singapore and the United States; and
- extra technical measures, such as encryption, strict access controls and data minimisation.
Merchants can ask for our Transfer Impact Assessment Summary by emailing compliance@referralcandy.com.
How long we keep data
- While a merchant uses ReferralCandy: we keep the merchant’s account data and the shopper data in its program. Merchants can delete shopper data at any time.
- After a merchant stops using ReferralCandy: we delete the data from our live systems. If you want a copy of your data returned, email compliance@referralcandy.com at least 30 days before your subscription ends.
- Backups: copies of deleted data may stay in our backups for up to 30 days, until those backups are deleted. We don’t restore accounts from backups.
- Records we must keep: we keep a limited set of records where we need them for legal, tax, accounting, security, fraud prevention or dispute reasons.
- Social media messages: we aim to delete direct messages once we have answered them.
How we protect data
We use technical and organisational measures to protect personal data against unauthorised access, loss and misuse. They include:
- encryption in transit (TLS 1.2 or higher) and at rest, with keys managed in AWS Key Management Service;
- least-privilege access, multi-factor authentication for administrative access, and quarterly access reviews;
- network segmentation, logging, monitoring and alerts;
- dependency and container vulnerability scanning, and annual penetration testing by independent third parties;
- backups and disaster recovery;
- an incident response process, including notifying merchants; and
- confidentiality duties and data protection training for our staff.
Our DPA lists these measures in full. Merchants can ask for our full Security Summary by emailing compliance@referralcandy.com. No method of sending data over the internet is completely secure, so we can’t guarantee the security of data while it is being sent to us.
Data Security Vulnerability Acknowledgment SLA
We confirm receipt of a reported security vulnerability within a time set by its severity:
- critical: 1 business day;
- high: 2 business days;
- medium: 5 business days; and
- low: 10 business days.
Our Vulnerability Reporting Program explains how we rate severity, and our full response and fix timelines. To report a vulnerability, email security@anafore.com.
Your privacy rights
Depending on where you live, you may have these rights over your personal data:
- Access: get a copy of the personal data we hold about you.
- Correction: fix data that is wrong. Merchants can change most account details in the ReferralCandy dashboard.
- Deletion: ask us to delete your data when we no longer need it.
- Portability: get your data in a machine-readable format (CSV) to take to another service.
- Restriction and objection: ask us to limit or stop some processing, including profiling and direct marketing.
- Withdraw consent: where we rely on your consent, you can withdraw it at any time.
- Complain: to a data protection authority (see below).
Extra rights for US residents
If you live in California, Virginia or another US state with a privacy law, you also have these rights:
- Know what personal data we collect, use and disclose, and get a copy of it.
- Delete and correct your personal data.
- Opt out of the sale of personal data, “sharing” for cross-context behavioural advertising, and targeted advertising. We do not sell or share personal data. To ask us to stop using your data in our advertising tools, email us.
- Equal treatment: we won’t treat you differently for using your rights.
- Appeal if we turn down your request (see below).
We don’t collect sensitive personal data for the purpose of inferring characteristics about you.
How to make a request
- Email compliance@referralcandy.com and tell us what you want us to do.
- We will check your identity before we act. We may ask for information to do this.
- We will reply within one month. For US state privacy requests, we will reply within 45 days. If a request is complex, we may need more time. If so, we will tell you.
You can ask someone (an authorised agent) to make a request for you. We will ask for proof that you gave them permission.
If you are a shopper: the merchant controls your data in its referral program. You can contact the merchant directly. If you contact us, we will pass your request to the merchant and help them respond.
Appeals
If we turn down your request, you can appeal. Email compliance@referralcandy.com with “Appeal” in the subject line. We will reply within 60 days and explain our decision. If we turn down your appeal, you can contact your state attorney general.
Complaints
Please contact us first so we can try to fix the problem. You can also complain to a data protection authority. For example:
- in the EU or EEA, the authority in the country where you live or work;
- in the UK, the Information Commissioner’s Office (ICO); or
- in Singapore, the Personal Data Protection Commission (PDPC).
Your privacy choices
- Don’t give us personal data. You can choose not to give us personal data. You can still browse our website, but we can’t run a referral program for you.
- Turn off cookies. You can block or delete cookies in your browser settings. Some features may not work without them.
- Unsubscribe from emails. Merchants and shoppers can unsubscribe from ReferralCandy emails using the link in each email, or by emailing support@referralcandy.com.
Cookies and tracking
We and our service providers use cookies when you use ReferralCandy.
- Session cookies are deleted when you leave.
- Persistent cookies stay on your device so we can recognise you when you come back.
- Referral cookies are set on referral pages and widgets. They link a friend’s order to the advocate who referred them, so the right person gets the reward.
Read our full Retailer Cookie Policy.
On a merchant’s referral pages and widgets, the merchant decides the cookie policy. Our cookie policy does not cover those pages. Merchants can turn on a cookie consent banner for the ReferralCandy widget.
Do Not Track and Global Privacy Control
We don’t currently respond to Do Not Track (DNT) or Global Privacy Control (GPC) browser signals. To opt out of our advertising tools, email compliance@referralcandy.com.
Children
ReferralCandy is not meant for anyone under 16. We don’t knowingly collect data about children under 16. If you think we have, email compliance@referralcandy.com and we will delete it.
Social media
We have accounts on Facebook, Instagram and X (formerly Twitter). Each platform handles your data under its own privacy policy:
We don’t export data about our followers from these platforms. If you message us on social media, we aim to delete the message once we have answered it.
Changes to this policy
We may update this policy. When we do, we will change the “Effective” date at the top of this page. If we make material changes, we will post a notice on this page and, where the law requires it, tell you directly.
How to contact us
Anafore Pte. Ltd. (operating as ReferralCandy), a company registered in Singapore, UEN 200903073C.
- Privacy requests and questions: compliance@referralcandy.com
- Data Protection Officer: Glenn Sunkel,
- Security: security@anafore.com
- General support: support@referralcandy.com
Are you a merchant who needs a DPA?
Read our Data Processing Addendum. It already applies to every merchant. For a signed copy, email compliance@referralcandy.com.