Privacy Policy

Version 2026-11-02

Last updated: 2 November 2026

1. Data Controller

Knoxlink, established in Houten, the Netherlands, and registered with the Dutch Chamber of Commerce under number 90900626 (hereinafter: “Knoxlink”), is the controller responsible for the processing of personal data described in this Privacy Policy.

Knoxlink processes personal data in accordance with the General Data Protection Regulation (GDPR).

2. Personal Data We Process – Creators

We may process the following personal data:

• Name
• Email address
• Date of birth
• Country of establishment
• Address details where required for payouts
• Bank account details where required for payouts
• A reference to necessary identity/payment checks before the first payout; do not submit identity documents through public profile fields
• IP address
• Usage and analytics data
• Data relating to revenue, transaction references, corrections, receipts and payouts
• Private audience countries, content type, channels, estimated reach and commercial-review evidence references
• Policy versions, acceptance times and proportional security/audit records

3. Personal Data We Process – Users

We may process the following personal data:

• Email address
• Account data relating to account and platform use
• Date of birth where provided
• Country for geographic targeting
• IP address
• Usage and analytics data

4. Purposes and Legal Bases

We process personal data on the following bases:

• Performance of a contract, including account management, payouts, subscriptions and support
• Legal obligations, including tax retention requirements, KYC and sanctions legislation
• Legitimate interests, including fraud prevention, security and optimisation
• Consent for non-essential cookies where required

5. Cookies and Tracking

Knoxlink uses necessary session/security cookies and preference choices for account access and safety. Public operational page totals do not need a persistent analytics identifier.

Optional Knoxlink visit and interaction analytics, a 30-day analytics identifier and 30-day stored campaign parameters are enabled only after the visitor allows analytics. The cookie choice is stored for six months. Use Cookie settings to decline or withdraw permission; this removes the optional browser identifier and stored campaign parameters. Account functions and individual affiliate click attribution work without optional analytics.

When a visitor chooses an affiliate link, Knoxlink records a random click reference, the referring creator, campaign, partner and time. This reference is passed to the partner for attribution. Conversion reports use the original reference, a transaction identifier, reporting date, status, currency and amounts. Knoxlink does not need player names or player account credentials for creator attribution. External partner websites apply their own privacy/cookie information; partner-specific recipients and any required consent must be reviewed before promotion.

This release does not load Google Analytics by default. Any future analytics/advertising integration requires an updated recipient/cookie list and any required consent before loading.

6. Retention Periods

• Account data: for as long as the account remains active.
• Financial data: 7 years in accordance with tax retention requirements.
• Optional raw analytics: up to 14 months; shorter retention applies where adequate.
• Operational page totals and security/login logs: normally 90 days.
• Failed-attempt rate-limit entries: removed after expiry.
• Financial attribution, acceptance and correction records: retained only to meet contract, tax, accounting and substantiated dispute requirements.

Retention jobs require scheduled operation by the hosting owner; contact Knoxlink for the actual retention position or an erasure request.

Data may be retained for longer where required by law or necessary for dispute resolution or fraud prevention.

7. Transfers Outside the EEA

Personal data may be processed outside the European Economic Area.

Before enabling a partner or processor outside the EEA, Knoxlink must verify the actual recipients, processing roles, countries and applicable transfer mechanism, such as an adequacy decision or appropriate contractual safeguards. Foreign incorporation alone does not establish a lawful transfer basis.

8. Data Subject Rights

Data subjects have the right to:

• Access
• Rectification
• Erasure
• Restriction of processing
• Data portability
• Object to processing
• Withdraw consent

A complaint may also be submitted to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

9. Security

Knoxlink takes appropriate technical and organisational measures, including:

• Restricted access to application data and documented hosting/processor review
• SSL/TLS encryption
• Access restrictions
• Fraud monitoring

No system can guarantee complete security.

10. Minors

The Platform is not intended for persons under the age of 18 acting as Creators.

If personal data relating to minors has been collected unlawfully, it will be deleted as soon as possible.

11. Changes

Knoxlink reserves the right to amend this Privacy Policy.

The current version is available through the Platform. Knoxlink records relevant version acknowledgements. Contact the Knoxlink owner using the published Platform contact details for privacy requests. Complaint and statutory rights remain available.