Legal & privacy

Last updated 11 September 2026

Controller: Startup Solutions BV, Kortrijk, Belgium — company no. BE 0XXX.XXX.XXX — info@affiliatemarketingprograms.net

Privacy policy

How Affilobase collects and uses personal data, under the GDPR and the Belgian Data Protection Act.

1. Who is responsible

Startup Solutions BV, Kortrijk, Belgium, company number BE 0XXX.XXX.XXX, operates Affilobase and is the controller for the personal data described here. Questions and requests go to info@affiliatemarketingprograms.net; we answer within 30 days.

We have not appointed a Data Protection Officer — our processing does not meet the criteria in Article 37 GDPR. The mailbox above is monitored by the people who can actually act on a request.

2. What we collect

• Visiting the site. Page requests, referrer, approximate location derived from your IP address, browser and device type. Your IP address is truncated before it is stored.
• Creating an account. Email address, password hash, and the watchlist, comparisons and match profile you build. An account is optional — the directory works without one.
• Submitting a program. Program details, your name, work email, company and role, plus whatever you write in the description field.
• Subscribing to email. Email address, confirmation timestamp, and which mails you open — measured in aggregate, not per person.
• Contacting us. The message you send and the address you send it from.

We do not collect special categories of data, we do not buy personal data from third parties, and we do not build advertising profiles.

3. Why, and on what legal basis

• Running the directory and your account — necessary to perform the agreement with you (Art. 6(1)(b)).
• Reviewing and publishing submitted programs — performance of the agreement with the submitting party, and our legitimate interest in a verified directory (Art. 6(1)(b) and (f)).
• Watchlist alerts and the monthly newsletter — your consent, withdrawable in one click in every mail (Art. 6(1)(a)).
• Security, abuse prevention and aggregate statistics — our legitimate interest in a working, non-abused service (Art. 6(1)(f)).
• Bookkeeping and legal obligations — compliance with Belgian law (Art. 6(1)(c)).

4. Affiliate links and click data

When you open a program's website from Affilobase, the link may carry a tracking parameter that identifies us — not you — as the referrer. The advertiser or network then sets its own cookie under its own privacy policy, which we do not control and cannot read. We log that a click happened on a listing; we do not tie outbound clicks to your account.

5. Who else sees your data

We use a small number of processors, each under a data processing agreement: hosting and CDN, transactional and newsletter email, error monitoring, and privacy-friendly analytics. They act only on our instructions. We do not sell personal data and we do not share it with advertisers.

6. Transfers outside the EEA

Our hosting and primary storage sit inside the EU. Where a processor operates outside the EEA, the transfer runs on the European Commission's Standard Contractual Clauses, plus an adequacy decision where one exists. A current list of processors and their locations is available on request.

7. How long we keep it

• Account data: for as long as the account exists, then 30 days in backup.
• Submissions: 5 years after the listing goes live or is refused — a listing's provenance has to stay auditable.
• Newsletter data: until you unsubscribe, plus a suppression record so we do not mail you again.
• Server and security logs: 90 days.
• Invoices and accounting records: 7 years, as Belgian law requires.

8. Your rights

You can request access, correction, erasure, restriction or portability, and you can object to processing based on legitimate interest. Consent can be withdrawn at any time without affecting what happened before. Mail info@affiliatemarketingprograms.net — we may ask one question to confirm it is your account before we act.

Not happy with the outcome? You can lodge a complaint with the Belgian Data Protection Authority, Drukpersstraat 35, 1000 Brussels, gegevensbeschermingsautoriteit.be, or with the authority in your own country.

9. Security

Traffic runs over TLS, passwords are stored hashed and salted, access to production data is limited to the people who need it, and backups are encrypted. No system is perfect: if a breach is likely to put your rights at risk, we will tell you and the authority within 72 hours.

10. Changes to this policy

Material changes are announced on this page and, for account holders, by email at least 14 days before they take effect. The date at the top of the page is always the date of the version you are reading.