Data processing agreement

Last updated 3 November 2026. This agreement under Art. 28 GDPR is part of the terms between you (the merchant, “controller”) and Loistava Holding UG (haftungsbeschränkt) (“processor”). It applies automatically when you use Referralmeter; no signature is needed. If you need a countersigned copy, write to privacy@referralmeter.com.

1. Subject, duration and purpose

The processor provides affiliate tracking, commission calculation, a hosted affiliate portal, payout batch preparation and, on the Growth plan, creator research and outreach drafting. Processing lasts as long as the merchant uses Referralmeter and ends with deletion as set out in section 8.

2. Data and data subjects

• Affiliates: identity and contact data, referral codes, website and promotion plan, payout method and details, tax forms, login IP hash.
• Visitors and customers referred by affiliates: click data (landing page, referrer host, country, salted IP hash), customer email and IDs, payment, refund and dispute amounts and dates.
• Creators researched by the Recruiting Agent: publicly available names, channel URLs, audience descriptions, public business contact details and evidence links.

No special categories of personal data (Art. 9 GDPR) are processed.

3. Instructions

The processor processes personal data only on the controller's documented instructions, which are these terms and the controller's settings and actions in Referralmeter. If the processor believes an instruction breaks data protection law, it tells the controller.

4. Confidentiality and security

Everyone with access to the data is bound to confidentiality. The processor maintains these technical and organisational measures:

• Hosting on servers in Germany (Hetzner); all traffic encrypted with TLS.
• Payout details, tax forms, provider webhook secrets and API keys encrypted at rest with AES-256-GCM; API keys stored only as hashes.
• Strict tenant isolation: every query is scoped to the program of the signed-in user or API key.
• Signature verification on every billing webhook; rate limits on public endpoints; IP addresses stored only as salted hashes.
• An audit log of changes made by people, API keys, agents and the system; regular backups; access limited to the people who run the service.

5. Sub-processors

The controller authorizes these sub-processors: Hetzner Online (hosting, Germany), Cloudflare (CDN and network protection), Resend (email delivery), and OpenAI (Recruiting Agent research and drafting, which receives no affiliate or customer personal data). Stripe and PostHog are used only for the processor's own billing and website analytics. The processor informs the controller by email at least 30 days before adding or replacing a sub-processor; the controller may object, and if no solution is found, may terminate. Each sub-processor is bound by data protection obligations equivalent to these, and transfers outside the EU rely on the EU-U.S. Data Privacy Framework or Standard Contractual Clauses.

6. Assistance

The processor helps the controller answer data subject requests (access, correction, deletion, export), and with security, breach notification and data protection impact assessments as far as the processor's information allows. Requests the processor receives directly are passed on to the controller.

7. Personal data breaches

The processor notifies the controller without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting the controller's data, with the information the controller needs to meet its own obligations.

8. Deletion and return

The controller can delete programs at any time and can ask for an export of its data before it does. When the controller deletes a program or its account, the processor deletes the personal data in it within 30 days, including from backups as they rotate, unless law requires longer storage.

9. Audits

The processor makes available the information needed to demonstrate compliance with Art. 28 GDPR and allows for audits by the controller or an auditor it appoints, with reasonable notice, at the controller's cost and no more than once a year unless there is a concrete reason.