Affiliate privacy notice.

This notice explains how Kovalabs handles your personal data when you apply to, or take part in, the Kovalabs Referral Partner Programme. The controller is Floww Group Limited, registered in England and Wales (company number 15986643), registered office 66 Paul Street, London, EC2A 4NE, trading as Kovalabs. It covers the extra processing we do because you are a partner; how we handle your data as a customer is covered by our Privacy Policy, and cookies by our Cookie Policy.

What we collect about you

• Identity and contact data: your name, email address and your Kovalabs customer-account identifier, plus the application details you give us: the channel or site you will promote through (and its link or handle), the size of your audience, and a short description of how you plan to promote.
• Account and contract data: your application status, the timestamp and version of the partner terms you accepted, and our correspondence with you, including compliance and monitoring records.
• Payout data: the bank or payment-account details you give us so we can pay commission, and your payout history.
• Tax data: your VAT-registration status (we presume partners are not VAT-registered unless you tell us otherwise) and related records we need to keep for HMRC.
• Referral and performance data: your referral code, link and discount code; the clicks and orders attributed to you; and the commission, hold, clawback and balance records on your ledger. Click counts are anonymous tallies of link visits; they contain no visitor identity.
• Verification data: before paying you we may verify your identity and screen against the UK sanctions list; where a third-party check is used we receive the result, not the underlying documents.

Providing identity, payout and tax data is a contractual requirement of being paid under the programme (and partly a statutory one). If you do not provide it, we cannot admit you or pay commission.

Why we use it, and our lawful bases

• To assess your application, run your account, attribute orders, calculate commission and pay you: performance of our contract with you (UK GDPR Article 6(1)(b)).
• If you request or hold a custom deal, we process the information you submit and the agreed deal terms to assess, administer and pay that arrangement: performance of our contract with you (UK GDPR Article 6(1)(b)).
• To keep tax and self-billing records and meet financial-sanctions obligations: compliance with a legal obligation (Article 6(1)(c)).
• To prevent and investigate fraud, self-referral and prohibited-claim breaches, monitor compliance (partner promotion is treated as our own regulated advertising), and establish or defend legal claims including clawback: our legitimate interests (Article 6(1)(f)). You can object at any time (see your rights below).

Decisions about applications, suspensions and clawbacks are made by a person. We do not use automated decision-making, including profiling, that produces legal or similarly significant effects about you.

Who we share it with

Only where necessary: the provider we use to pay your commission; our accountant and HMRC for tax and self-billing records; our hosting, database and software providers acting as processors under written terms; our professional advisers; and authorities or courts where we are legally required or permitted. We aim to keep your data in the UK or EEA. Where a provider processes it outside the UK, we rely on the UK adequacy regulations or the UK International Data Transfer Addendum to the EU standard contractual clauses; you can ask for a copy of these safeguards by emailing privacy@kovalabs.co.uk. We never sell your personal data and never share it for third-party marketing.

How long we keep it

• Tax, commission-ledger and self-billing records: 6 years after the end of the financial year they relate to (HMRC requirement).
• Account, identity, contact and payout data: for the life of your participation, then alongside the ledger for up to 6 more years (the limitation period for contract claims).
• Declined or closed applications: 12 months.

Your rights

You have the UK GDPR rights of access, rectification, erasure, restriction, objection and data portability, subject to the exemptions in the law (for example we must keep tax records even if you ask for erasure). To exercise them, email privacy@kovalabs.co.uk and we will respond within one month. You can also complain to the Information Commissioner's Office at ico.org.uk, though we would appreciate the chance to help first.

Customer data: the name, and nothing else

The only item of a referred customer's personal data you ever receive is their name, shown on your per-order ledger once you have accepted the current partner terms, so you can recognise the orders your referrals generated. Strict conditions apply: the name is for that verification purpose only; you must not contact the customer, must not use the name for marketing or list-building, must keep it confidential, and must delete any record of it if we ask or when you leave the programme. Customers are told about this in our Privacy Policy and can object, in which case we replace their name with a pseudonymous label on your ledger.

Beyond the name, your ledger shows, per referred order, only the date, an order reference, a bare unit count, the order value after discount, the rate applied, your commission and its status. You are never given contact details or addresses, and never - under any circumstances - which products or compounds were bought. You must not attempt to identify, contact or track referred customers; if you capture customer data through your own tools you do so entirely outside the programme and are solely responsible for it.

If you refer other partners to the programme, your dashboard also shows each recruited partner's name, status, joining date, override window and the override commission you earned from their activity, always as aggregates: never their own rates, their customers or their per-order detail. Keep that roster confidential. Equally, if you joined through another partner's link, that partner sees the same aggregate roster entry about you.

The attribution cookie and click counts

When someone clicks your referral link we may set theaffiliate_ref,affiliate_ref_at and (where your link includes a sub-source tag)affiliate_ref_src cookies on their device (not yours) so a qualifying order within 90 days can be credited to you and your traffic measured by channel. These are consent-gated marketing cookies on the visitor's side, disclosed in the Cookie Policy. You never receive the cookie value or any visitor identifier. We also count clicks on your link server-side as an anonymous tally (no cookie, no visitor identity) so your dashboard can show traffic and conversion. You must never interfere with the consent banner or run your own tracking on Kovalabs visitors.

Separately, when your link carries your active discount code, a visitor who clicks it can receive a basket containing that linked promotion, so the discount they requested can be applied and a qualifying order can be credited to you. Before advertising-storage consent, the basket does not store a referral link, click time, sub-source or visitor-level click record. Where your link carries no active discount, no basket is created at the click. Applying your linked promotion may create the recurring customer association described in the Programme terms, so later qualifying orders can also earn recurring commission. The device stores only the strictly necessary basket cookie; persistent link attribution remains consent-gated and is described in the Cookie Policy.

Changes and contact

We may update this notice as the programme evolves; material changes will be notified to you by email or through your partner dashboard. Questions about this notice or your data: privacy@kovalabs.co.uk. The programme terms themselves are at /affiliate-terms.