Privacy Policy
Last updated: September 2026
This policy explains what personal data Recopal collects, why we collect it, and the rights you have over it. It applies to Members (people who request referrals) and Partners (people who list referral programmes and fulfil requests) alike.
1. Who we are
Recopal is operated by Greensand Technologies Limited, registered in England and Wales under company number 17449914, which is the data controller for the personal data processed through the platform.
- Registered address: see our Legal Notice
- Data protection contact: support@recopal.co.uk
We have not appointed a Data Protection Officer, as we are not required to do so. Privacy questions go to the address above. Our full entity details are set out in our Legal Notice.
2. Data we collect
We collect only what we need to run the platform:
- Account data — your email address and, if you provide it, your name.
- Partner data — the companies, referral programmes and referral details you choose to list.
- Activity data — the requests you make or receive, and the invoices generated for them.
- Technical data — standard server logs such as IP address and browser type, kept for security and diagnostics.
- Usage data — key actions you take on the platform (for example signing in, opening a company's page, creating, accepting or completing a request, submitting a referral programme, paying an invoice), together with your country and whether you are a Partner, recorded against an internal account number — never your email address or name. Only if you accept analytics cookies, we also record which pages you visit, what you click and anonymised session recordings in which everything you type into forms, and your referral details, are masked.
3. How we use your data
- Match Members with eligible Partners in the same region.
- Send you service notifications and transactional emails.
- Issue invoices and process the fixed platform fee through our payment provider.
- Detect and prevent fraud and enforce our platform rules.
- Understand how the platform is used — where people get stuck or drop off — so we can improve it.
- Meet our legal and accounting obligations.
4. Legal bases for processing
Where data protection law requires a legal basis, we rely on:
- Performance of a contract — to provide the platform and complete referrals you take part in.
- Legitimate interests — to secure the platform, prevent fraud and improve the service, including measuring key platform actions (usage data) of signed-in users.
- Legal obligation — to keep invoicing and accounting records.
- Consent — for analytics cookies, page and click tracking and session recordings, and for any optional marketing communications. You can withdraw consent at any time through "Cookie settings" in the site footer.
5. Protecting a Partner's identity
A Partner's personal details — name, contact information and referral codes — are never shown publicly. Members see only aggregated information about a company, such as the reward range. A Partner's details are disclosed solely to the individual Member who has been matched to them through the platform.
6. Sharing your data
We do not sell your personal data, and we do not use it for advertising or profiling beyond the referral matching described in section 3.
Within the platform, a Partner's referral details are disclosed to the single Member matched to them for a specific request, and that Member's name is disclosed to the Partner so the referral can be completed. Nothing else is shared between users.
Outside the platform, we share data only with the processors needed to run it, each bound by a written processing agreement to act solely on our instructions:
| Processor | Purpose | Data involved |
|---|---|---|
| Stripe Payments Europe, Ltd. and Stripe, Inc. | Taking payment of the platform fee | Name, email, invoice reference and amount |
| Sendinblue SAS, trading as Brevo (France — data hosted in the EU) | Delivering sign-in codes and transactional email | Email address, message content, delivery status; anonymous open and click totals (see below) |
| Bunny.net (BunnyWay d.o.o.) | Storing referral-programme evidence screenshots uploaded by Partners | The uploaded file and anything visible in it |
| PostHog, Inc. (EU Cloud — data hosted in Frankfurt, Germany) | Product analytics: measuring how the platform is used | Internal account number, usage data, browser and device type, approximate location derived from IP address; with your consent also pages visited, clicks and masked session recordings |
| Our hosting provider | Running the application and its database | All platform data, at rest and in transit |
Email open and click measurement. Our emails contain a small image, and their links pass through Brevo's servers before reaching Recopal. Brevo uses these to count how many emails are opened and how many links are clicked, in anonymous, aggregate form only: when your email program loads the image or you follow a link, Brevo briefly receives your IP address and device information, but it does not record the open or click against you or your email address. We use these totals only to check that our emails are delivered and working, based on our legitimate interests. You can prevent the image from loading by turning off automatic image loading in your email program.
We may also disclose data where we are legally required to do so, or to establish, exercise or defend legal claims.
7. International transfers
Some of our providers may process data outside your country of residence. Where that happens, we rely on appropriate safeguards — such as the European Commission's standard contractual clauses — to ensure your data remains protected.
8. Data retention
| Data | Kept for |
|---|---|
| Account data (email, name, preferences) | While your account is open, then deleted or anonymised within 30 days of closure |
| Referral requests and their status history | 6 years from completion, to evidence the transaction the invoice relates to |
| Invoices and payment records | 6 years from the end of the accounting period, as required by UK tax law (and up to 10 years where German commercial and tax law applies) |
| Partner evidence screenshots | Until the referral programme is deleted, or 12 months after it is deactivated |
| Server and security logs | 90 days |
| Analytics usage data | 12 months |
| Session recordings (only with your consent) | 30 days |
Where we are legally required to keep a record, we retain only that record and delete the rest.
9. Your rights
Under the UK GDPR and the EU GDPR you have the right to:
- access the personal data we hold about you, and receive a copy of it;
- correct data that is inaccurate or incomplete;
- erase your data where we no longer have a lawful reason to keep it;
- restrict processing while a dispute about accuracy or legitimate interests is resolved;
- port the data you gave us to another provider in a machine-readable format;
- object to processing we base on legitimate interests, including at any time;
- withdraw consent for analytics or marketing, without affecting processing carried out before you withdrew it.
To exercise any of these, email support@recopal.co.uk. We will respond within one month, and will tell you if we need to extend that (we may extend by up to two further months for complex requests). Exercising your rights is free unless a request is manifestly unfounded or excessive.
Automated decision-making. Assigning a Partner to a request is automated: we pick from eligible Partners in your region using a weighted random draw, and reassign automatically if an assigned Partner does not respond within their window. It has no legal or similarly significant effect on you, and it never uses profiling of your personal characteristics. You can ask a human to review any assignment by contacting us.
Complaints. If you are unhappy with how we handle your data, tell us first — we would rather fix it. You can also complain to the UK Information Commissioner's Office (ico.org.uk, helpline 0303 123 1113), or, if you live in the EU, to the supervisory authority in your country of residence.
10. Cookies
We use essential session cookies to keep you signed in and to hold short-lived state such as referral tokens. Analytics cookies are set only if you accept them in our cookie banner; you can change your choice at any time through "Cookie settings" in the site footer. Our Cookie Policy explains each cookie in full.
11. Contact
For any privacy-related question or to exercise your rights, please get in touch.