Data processing agreement

This agreement is between Software Automated Ltd (company number 17024080, registered in England and Wales, registered office 20 Wenlock Road, London, N1 7GU, England), which runs ViralPayouts (“we”), and each brand that runs a program on ViralPayouts (“you”). It forms part of the terms of service and applies from the moment you create a brand account. There is nothing to sign; if your company needs a signed copy, email max@viralpayouts.com and we will countersign this text.

It applies to personal data protected by the UK GDPR and the Data Protection Act 2018, the EU GDPR, and similar laws elsewhere, such as the California Consumer Privacy Act. Where those laws use different words, “controller” and “processor” mean the matching roles (for example “business” and “service provider” under the CCPA).

Where we act as an independent controller, our privacy policy applies instead of this agreement. Where you receive partners' details from us, you use them only to run your program and to meet your own legal duties, and you are responsible for that use.

We process the data in the first two rows above only on your documented instructions. Your instructions are these terms, the settings of your programs, and what you do in the console and through our API. We will not use that data for anything else, including our own marketing, and we will not sell it or combine it with other brands' data except to detect fraud against the network (for example, the same buyer and partner appearing as each other in more than one program).

If we think an instruction breaks data protection law, we will tell you and need not follow it. If the law requires us to process the data in another way, we will tell you first unless the law forbids it.

• You have a lawful basis for sending us your customers' details, and you tell your customers about it in your own privacy notice. Send only what we need: a buyer's email is optional and is used only for the self-referral check.
• If you place our tracking snippet or a first-party cookie on your own site, you are responsible for any cookie consent your law requires there (for example under the UK Privacy and Electronic Communications Regulations or the EU ePrivacy Directive).
• You keep your console accounts, API keys and signing secrets safe, and give team access only to people who need it.

Only people who need the data to run, support or secure ViralPayouts can reach it, and each of them is bound by a duty of confidentiality.

You authorise us to use the sub-processors listed on Sub-processors. Each one is bound by a written contract with data protection obligations at least as strong as this agreement, and we remain responsible to you for what they do.

We will email your account owners at least 30 days before adding or replacing a sub-processor. If you object on reasonable data protection grounds, tell us within that time; we will try to find a solution, and if we cannot, you may close your account without any charge beyond fees and partner payouts already earned.

We keep the technical and organisational measures in Annex 2 in place, and we may improve them as long as we never lower the overall protection. The current state of our security is on the Security page.

If we become aware of a breach of security that affects personal data we process for you, we will tell your account owners without undue delay and in any case within 48 hours of becoming aware of it. We will say what happened, what data and how many people are affected as far as we know, what we have done about it, and who to contact; and we will keep you updated as we learn more, so you can meet your own duty to notify a regulator within 72 hours.

• If one of your customers asks us to exercise their rights over data we process for you, we will pass the request to you and not answer it ourselves unless you ask us to.
• We will help you answer such requests, carry out a data protection impact assessment, or consult a regulator, as far as that relates to our processing and is reasonable.

Some sub-processors are in the United States. Where data we process for you leaves the UK or the EEA, the transfer is covered by an adequacy decision (such as the UK Extension to the EU-US Data Privacy Framework for certified providers) or by the EU Standard Contractual Clauses (module 3, processor to processor) with the UK International Data Transfer Addendum. Those clauses are incorporated into this agreement where they are needed.

We will give you the information you reasonably need to show that we meet this agreement. If that is not enough, you may audit our compliance, on 30 days' written notice, no more than once a year (or at any time after a breach), at your own cost, during working hours, by an auditor bound by confidentiality, and without access to other brands' data.

When your brand account is closed (email us from an owner's address to close it), we delete your customers' details and the click data we process for you within 90 days, except where the law requires us to keep records. Sales, commissions, invoices and payouts stay in our ledger for as long as tax and accounting law requires, with buyers kept only as a keyed hash and a masked email. Before it is closed you can download your full ledger, payouts and tax data as CSV files from the console.

The liability terms in the terms of service apply to this agreement, except where data protection law does not allow liability to be limited. If this agreement and the terms of service differ about personal data, this agreement applies; if the Standard Contractual Clauses apply and differ from this agreement, the clauses apply.

• Encryption in transit (HTTPS only on the live site) and encryption at rest by our hosting and database providers. Partners' tax numbers are additionally encrypted with AES-256-GCM.
• Network addresses and buyers' emails are stored only as keyed hashes; passwords only as scrypt hashes.
• Signed, httpOnly session cookies; two-step sign-in for brand users; roles (owner, manager, viewer) within each brand, and strict separation between brands.
• Signature checks on every incoming webhook and sales event; rate limits on sign-in, events and links.
• An audit log of console actions, including every download of tax files.
• Separate test networks, so new code is tested away from live data.
• Database backups kept by our database provider, so data can be restored after a failure.