Privacy Policy

Last updated: July 2026

This policy explains what personal data Recopal collects, why we collect it, and the rights you have over it. It applies to Members (people who request referrals) and Partners (people who list referral programmes and fulfil requests) alike.

1. Who we are

Recopal operates the referral platform described in these pages and is the data controller for the personal data processed through it. Our full legal and contact details are set out in our Legal Notice.

2. Data we collect

We collect only what we need to run the platform:

  • Account data — your email address and, if you provide it, your name.
  • Partner data — the companies, referral programmes and referral details you choose to list.
  • Activity data — the requests you make or receive, and the invoices generated for them.
  • Technical data — standard server logs such as IP address and browser type, kept for security and diagnostics.

3. How we use your data

  • Match Members with eligible Partners in the same region.
  • Send you service notifications and transactional emails.
  • Issue invoices and process the fixed platform fee through our payment provider.
  • Detect and prevent fraud and enforce our platform rules.
  • Meet our legal and accounting obligations.

4. Legal bases for processing

Where data protection law requires a legal basis, we rely on:

  • Performance of a contract — to provide the platform and complete referrals you take part in.
  • Legitimate interests — to secure the platform, prevent fraud and improve the service.
  • Legal obligation — to keep invoicing and accounting records.
  • Consent — for any optional marketing communications, which you can withdraw at any time.

5. Protecting a Partner's identity

A Partner's personal details — name, contact information and referral codes — are never shown publicly. Members see only aggregated information about a company, such as the reward range. A Partner's details are disclosed solely to the individual Member who has been matched to them through the platform.

6. Sharing your data

We do not sell your personal data. We share it only with the service providers needed to operate the platform — for example our payment provider (Stripe) and our email delivery provider — each of which is contractually bound to protect it and to process it solely on our instructions. We may also disclose data where we are legally required to do so.

7. International transfers

Some of our providers may process data outside your country of residence. Where that happens, we rely on appropriate safeguards — such as the European Commission's standard contractual clauses — to ensure your data remains protected.

8. Data retention

We keep account data for as long as your account is active. Invoice and transaction records are retained for the period required by applicable accounting and tax law (typically several years). When you close your account, we delete or anonymise your personal data except where we are legally required to keep it.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or port your personal data, to object to certain processing, and to withdraw consent for marketing at any time. You also have the right to lodge a complaint with your local data protection authority. To exercise any of these rights, contact us using the details below.

10. Cookies

We use essential session cookies to keep you signed in and to hold short-lived state such as referral tokens. Our Cookie Policy explains each cookie in full.

11. Contact

For any privacy-related question or to exercise your rights, please get in touch.