How Bucksbooth collects, uses, shares and protects personal data - written for a global audience and aligned with the EU GDPR, UK GDPR, and other applicable data protection laws.
Bucksbooth ("Bucksbooth", "we", "us", "our") operates a performance marketing network that connects data owners and affiliates ("Affiliates") with advertisers ("Advertisers"), together with the associated technology platforms: Trackbooth (performance tracking), Subsbooth (list and consent management) and Sendbooth (email and SMS delivery) (together, the "Services").
This Privacy Policy applies to personal data we process when you:
We operate globally. Where the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), the UK GDPR, or similar laws apply, this policy is intended to satisfy the transparency requirements of those laws (including GDPR Articles 13 and 14).
Data protection law distinguishes between a "controller" (who determines the purposes and means of processing) and a "processor" (who processes on a controller's instructions). Bucksbooth acts in both capacities:
We do not intentionally collect special categories of personal data (e.g. health, religion, political opinions) and ask that you do not submit them to us.
Where GDPR or UK GDPR applies, we rely on the following legal bases:
| Purpose | Examples | Legal basis |
|---|---|---|
| Providing the Services | Account creation, campaign management, event tracking, payout calculation and payment | Performance of a contract (Art. 6(1)(b)) |
| Vetting & approval | Reviewing applications, verifying identity, assessing traffic quality | Contract (pre-contractual steps) and legitimate interests (Art. 6(1)(f)) in maintaining a trustworthy network |
| Compliance & anti-fraud | Suppression-list scrubbing, consent audits, fraud detection, complaint handling | Legal obligation (Art. 6(1)(c)) and legitimate interests in preventing abuse |
| Legal & tax obligations | Tax reporting, accounting records, responding to lawful requests from authorities | Legal obligation (Art. 6(1)(c)) |
| Our own marketing | Newsletters and product updates to business contacts | Consent (Art. 6(1)(a)) or legitimate interests, with opt-out always available |
| Security & service improvement | Monitoring, debugging, analytics, infrastructure protection | Legitimate interests (Art. 6(1)(f)) |
| Establishing or defending legal claims | Disputes, enforcement of our terms | Legitimate interests (Art. 6(1)(f)) |
Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms; you may object as described in Section 9. Consumer marketing consent (for the campaigns themselves) is obtained and evidenced by the relevant Affiliate/controller, in accordance with our platform terms.
Our websites and Services use cookies, pixels and similar technologies to:
Where required by law (including the ePrivacy rules in the EU/UK), non-essential cookies are set only with your consent, which you can withdraw at any time through our cookie banner or browser settings. Blocking cookies may limit some features.
We share personal data only as described below, and never sell consumer personal data for money:
Because we operate a global network, personal data may be transferred to and processed in countries other than your own, including the United States. Where we transfer personal data originating in the European Economic Area, the United Kingdom or Switzerland to countries not deemed to provide an adequate level of protection, we rely on appropriate safeguards, including:
You may request a copy of the relevant safeguards by contacting [email protected].
We keep personal data only as long as necessary for the purposes described in this policy, then delete or irreversibly anonymize it. Indicative periods:
If you are in the EEA, UK, Switzerland, or another jurisdiction granting similar rights, you may, subject to legal conditions and exemptions:
Marketing opt-out: every email delivered through Sendbooth contains a working unsubscribe link, and SMS recipients can reply STOP. Opt-outs are honored well within legal deadlines and propagated across our network suppression lists so you are not contacted again through us.
Email [email protected] with the subject "Data Rights Request", telling us which right you wish to exercise and the email address/phone number concerned. We may need to verify your identity before acting. We respond within one month (extendable by two further months for complex requests, with notice), free of charge except where requests are manifestly unfounded or excessive.
Where we act as a processor for an Affiliate or Advertiser, we will forward your request to the relevant controller without undue delay and assist them in responding.
We use automated systems (including fraud-scoring in Trackbooth) to flag suspicious traffic and events. These flags trigger human review before any decision producing legal or similarly significant effects - such as account termination or payment forfeiture - is made. We do not carry out automated decision-making within the meaning of GDPR Article 22 without appropriate safeguards, and you may request human intervention regarding any such decision.
We apply technical and organizational measures appropriate to the risk, including encryption in transit and at rest, role-based access controls, network segregation, logging and monitoring, vendor due diligence, staff confidentiality obligations, and incident response procedures. Suppression lists are technologically fingerprinted and access-restricted. No system is perfectly secure; if a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority and, where required, affected individuals, in line with GDPR Articles 33–34 and other applicable laws.
Our Services are strictly for business users aged 18+ and our network prohibits campaigns directed at children. We do not knowingly collect personal data from anyone under 16 (or the higher age applicable in your jurisdiction). If you believe a child's data has reached us, contact [email protected] and we will delete it.
If you are a resident of California or another US state with a comprehensive privacy law, you may have rights to know, access, correct, delete, and obtain a portable copy of your personal information, to opt out of "sale" or "sharing" of personal information and of targeted advertising, and to non-discrimination for exercising your rights. We do not sell personal information for money. To the extent network attribution activity constitutes "sharing" under the CPRA, you may opt out via [email protected] with the subject "Do Not Sell or Share". Authorized agents may submit requests with proof of authority.
We honor applicable rights under other regimes, including Canada's PIPEDA and CASL (express/implied consent and unsubscribe rules for commercial electronic messages), Brazil's LGPD, Australia's Privacy Act and Spam Act, and similar laws. Where local law grants you rights beyond those listed here, we will honor them as required.
We may update this Privacy Policy from time to time. The "Last updated" date at the top shows the current version. For material changes, we will provide prominent notice (for example, on the platform login page or by email) before the changes take effect. Continued use of the Services after the effective date constitutes acknowledgment of the updated policy.
Privacy team / Data Protection contact: [email protected]
Compliance: [email protected]
Postal: Bucksbooth - Privacy Office, [registered company address].
EEA/UK individuals: where required by GDPR Article 27 / UK GDPR, details of our EU and UK representatives are available on request. You always retain the right to complain to the supervisory authority in your country of residence, place of work, or where the alleged infringement occurred.