Privacy notice

Last updated: 28 October 2026

This privacy notice applies to visitors to and members of cashbackie.uk. We explain what personal data we process, why, on what lawful basis, who we share it with, how long we keep it and what rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who is responsible?

The controller for the personal data collected through cashbackie.uk and our service is:

Cashbackie V.O.F., a general partnership under Dutch law (vennootschap onder firma)
Heije Schaperloane 13, 9269 PL Veenwouden, the Netherlands
Netherlands Chamber of Commerce (KvK), number 42105678
Phone: +31 6 51 57 95 80
Email for questions about your data: privacy@cashbackie.nl

We have not appointed a data protection officer. If you have questions about your data, write to us at the address above. Our other details are on the company information page and the contact page.

Our service is only for people aged 18 and over.

2. What data do we process?

When you create an account:

Name
Email address
Password (only stored as a hash, never readable by us). If you sign in with Google or Facebook, we receive your name and email address from them, and you don't have a password with us.
Optional: phone number. We don't use it for marketing calls.
If you have agreed to analytics: where you came from when you became a member, that is the page that sent you to us, the campaign details in the link (for example utm_source) and the first page you visited on our site.
If you came through another member's link: which member that was.

When you request a payout:

Sort code and account number (stored encrypted)
Account holder name

When you use the site:

Click data (which shop, when, through which link)
IP address and user agent: for clicks and in our visitor statistics only as a hash. They are only stored in readable form in your session, until it expires, and after a failed login attempt, for security.
The country from which you log in and click through. We work it out from your IP address using the public lists of the internet registries, without passing your IP address to anyone else; we only store the country. We use it to detect abuse.
A code (subID) that we pass to the affiliate network with each click: a fixed number for your account and a number for the click, without your name and without your email address
Visitor statistics on our server: which page, what you searched for, which site or campaign you came from, your country and the type of your device, browser and operating system, with a code that changes every day instead of your IP address. These statistics are not linked to your account.

What you send or save yourself: messages and claims with their attachments, your conversations with Cas, the shops you follow and, if you switch them on, push notifications.

What we receive from third parties: see section 3.

You can't create an account without a name and email address, and we can't pay anything into your bank account without your sort code and account number. All other details are optional.

3. Data we don't receive directly from you

From the affiliate networks (such as Awin): the transaction ID, the order amount and the status of the transaction (pending, approved, declined) when you buy something after clicking one of our links. We link it to your account through the subID.
From Google or Facebook, if you sign in with them: your name and email address.
From another member, if you came through their invitation link: the link itself shows us which member invited you.

None of this data comes from publicly available sources.

4. Why, and on what lawful basis?

Purpose	Lawful basis
Creating and managing your account	Contract (Article 6(1)(b) UK GDPR)
Recording and paying out cashback	Contract
Handling messages and claims, including translation for our team	Contract
Answering questions through our assistant Cas	Legitimate interests; for questions about your own account, contract
Working out the referral reward for the member who invited you and the payment of a promoter	Legitimate interests (Article 6(1)(f) UK GDPR)
Preventing fraud and keeping things secure	Legitimate interests
A security email when you log in from a new device	Legitimate interests
Visitor statistics on our server, without access to your device	Legitimate interests
Google Analytics, Cloudflare Web Analytics and Metricool, and storing where your sign-up came from	Consent (Article 6(1)(a) UK GDPR and regulation 6 of the Privacy and Electronic Communications Regulations, PECR), through "Analytics" in the cookie banner
Google Ads, the Meta Pixel and the Awin MasterTag	Consent, through "Marketing" in the cookie banner
The weekly newsletter and emails about new offers at your favourite shops	Consent (opt-in)
A reminder a few days after you sign up if you haven't clicked through to a shop yet, further reminders if you haven't been active for a while, and an email when an offer starts at a shop you follow	Legitimate interests; you can object at any time by writing to us, and the inactivity reminders and the offer emails also contain an unsubscribe link
Meeting our accounting and tax obligations	Legal obligation (Article 6(1)(c) UK GDPR)

Where we rely on our legitimate interests, these are: protecting your account and our service against fraud and abuse, rewarding members who recommend the service, understanding in aggregate how the site is used so that we can improve it, helping you use the service you signed up for, and keeping you up to date about your account and the shops you follow. You can object to this processing (see section 12), and to marketing emails at any time without giving a reason.

Translation of support messages. Our team works in Dutch. If you write to support in English, we translate your message into Dutch with a language model from Anthropic, and our reply into English. Anthropic only processes the texts on our behalf and doesn't use them to train its models.

Our assistant Cas. At the bottom right of the page you'll find Cas, a chat assistant that answers questions about Cashbackie and the shops. Cas works with a language model from Anthropic. We keep what you type and Cas's answers for 90 days, together with the country of the site and a hash of your IP address; if you are logged in, also the account the conversation belongs to. We use the conversations to answer your question and to improve Cas. If you ask Cas to create a support request, the conversation is attached to it and the retention period for support requests applies.

If you are logged in and ask Cas about your own cashback, Cas looks up your balance, your latest transactions and your payouts and sends them to Anthropic to write the answer. Anthropic only processes the conversations on our behalf and doesn't use them to train its models. Don't type passwords, bank details or other sensitive information into the chat.

When you open the chat, your browser keeps the conversation in session storage so that it stays when you move to another page; when you close the tab, it is gone. This is strictly necessary for the chat you open yourself.

5. Affiliate networks and joint responsibility

To record cashback, we work with affiliate networks such as Awin. When you go to a shop through one of our links, we exchange a small amount of data with the network:

a code for your account and the click (subID), without your name or email address
the shop and the time of the click
for a purchase: the order amount and the transaction ID

In some situations the affiliate network and we are joint controllers within the meaning of Article 26 UK GDPR. The network explains its own processing in its own privacy notice, and you can exercise your rights with it as well as with us. You can get the essence of our arrangement on how responsibility is shared by writing to privacy@cashbackie.nl.

6. Analytics and marketing

On cashbackie.uk no tool from Google, Meta, Awin, Cloudflare or Metricool is loaded before you have made your choice in the cookie banner, and until then your browser doesn't send them any requests for analytics or advertising. Only the shop logos are loaded from the servers of the affiliate networks (section 7). You decide by purpose:

Analytics: Google Analytics measures how the site is used. Cloudflare Web Analytics and the website statistics of Metricool count visits without cookies; they do read details such as the screen size from your browser, so on cashbackie.uk we only load them with your consent. With the same consent we remember for 30 days which site or campaign brought you to us, and store this in your account if you become a member, so that we know which channels work.
Marketing: Google Ads and the Meta Pixel (Facebook and Instagram) measure what our adverts bring in and make it possible to show you Cashbackie adverts on other sites (remarketing). The Awin MasterTag measures what our links to partner shops bring in; which functions it uses is set by Awin through its plug-ins.

If you have agreed to marketing and then create an account, we send Google a hash (SHA-256) of your email address. Google matches it against the email addresses of Google accounts to measure whether an advert led to a sign-up. Google and Meta also process this data for their own purposes, under their own privacy policies.

For collecting and sending data through the Meta Pixel, Meta Platforms Ireland and we are joint controllers. The arrangement for this is in Meta's Controller Addendum. Meta alone is responsible for everything it does with the data afterwards.

Your choice applies for six months; after that we ask again. You can change it or withdraw your consent at any time, as easily as you gave it, through Cookie settings at the bottom of every page. Which cookies there are and how long they last is set out in the cookie policy.

7. Who receives your data?

We use service providers (processors) that only process data on our behalf and on our instructions:

Railway: hosting of the site and the database
Resend: sending emails
Sentry: detecting technical errors
Anthropic: our assistant Cas and the translation of messages to support, which works in Dutch
Cloudflare: visitor statistics without cookies, on cashbackie.uk only with your consent
Metricool (Metricool Software S.L., Spain): visitor statistics without cookies, on cashbackie.uk only with your consent
our bank (bunq) and its payment partner for payments in pounds: carrying out payouts

Your browser also loads the shop logos from the servers of the affiliate networks; those servers technically receive your IP address, like any server your browser contacts. If you switch on push notifications, they go through the notification service of your browser's maker (for example Google, Mozilla, Apple or Microsoft).

As controllers or joint controllers in their own right, the following also receive data: the affiliate networks (section 5) and Google, Meta and Awin if you have given your consent (section 6).

We don't sell your data, and we don't pass your name, email address or bank details to shops. The exception is a claim: we then share the details of your claim with the affiliate network and the shop (see the claim conditions). If you came through another member's link, that member sees your name and whether the reward for your sign-up has been given yet; if it is a promoter, they only see totals per month.

We may also be legally required to hand over data to an authority that asks for it.

8. Transfers outside the United Kingdom

We are based in the Netherlands. The United Kingdom recognises the countries of the European Economic Area as providing adequate protection, so we can receive and store your data there. Railway, Resend, Sentry, Anthropic and Cloudflare are companies in the United States, and Google and Meta may also process data in the United States, as may your browser's notification service if you switch on push notifications. These transfers rely on the safeguards of UK data protection law: the UK Extension to the EU-US Data Privacy Framework for companies that take part in it, or otherwise the International Data Transfer Addendum to the European Commission's standard contractual clauses. You can get a copy of these safeguards, or be told where they are available, by writing to privacy@cashbackie.nl.

9. How long do we keep your data?

Account data: for as long as your account exists. If you delete it, or we close it after 12 months of inactivity (see the terms and conditions), your name, email address, phone number, bank details, sign-up source data and messages are deleted. Transactions and clicks are kept under a number, without your name and email address. Before a closure for inactivity, you receive reminders by email.
Financial data (transactions, payouts): 7 years, because of our business's accounting and tax obligations.
Click data: for as long as needed to handle the transactions and for our accounts.
Visitor statistics: no longer than 400 days (about 13 months).
Conversations with Cas: 90 days, unless they belong to a support request.
Countries you log in from: until one year after we last saw the country, and never longer than your account.
Attachments to messages and claims: deleted six months after the message or claim is closed.
Your choice in the cookie banner: six months, after which we ask again.
Consent to marketing emails: until you unsubscribe.

10. Security

We take appropriate technical and organisational measures:

Bank details are stored encrypted
IP addresses of clicks and visits are stored as an HMAC hash, not in readable form
Connections use HTTPS
Passwords are hashed with bcrypt

11. Automated decisions

We don't do profiling. Only one decision is fully automated: closing an account after 12 months in a row without a login, without a click through to a shop via Cashbackie and without a new transaction, as described in the terms and conditions. This decision has significant effects: the remaining balance lapses and your identifying details are deleted (section 9). Beforehand you receive three reminders by email, and logging in is enough to prevent it. If you disagree with such a closure, you can write to us at privacy@cashbackie.nl to give your point of view; a person in our team will then look at your case again.

A decision to block an account for fraud is always made by a person in our team. A decision to decline a transaction is made by the shop or the affiliate network, not by us.

12. Your rights

You have the right:

of access to your data (Article 15 UK GDPR). You can download a large part of it yourself, in your dashboard under Profile, "Download my data (JSON)"; you can ask for a full overview at privacy@cashbackie.nl
to have your data rectified or completed (Article 16 UK GDPR)
to have your data erased (Article 17 UK GDPR): you can delete your account in your dashboard under Profile (not while a payout is in progress); your name and contact details are then deleted straight away, and the financial transactions are kept because of our accounting obligations
to have processing restricted (Article 18 UK GDPR)
to receive your data in a commonly used file format (data portability, Article 20 UK GDPR)
to object to processing based on our legitimate interests on grounds relating to your particular situation, and to object to marketing emails at any time without giving a reason (Article 21 UK GDPR)
to withdraw your consent to cookies and marketing emails at any time, for the future (Article 7(3) UK GDPR)
for an automated decision, to ask for a person in our team to step in, to give your point of view and to challenge the decision (Article 22(3) UK GDPR, section 11)
to complain to the Information Commissioner's Office (section 13)

Send your request to privacy@cashbackie.nl. It is free. We reply within one month. For complex or numerous requests, this period can be extended by two months; if so, we will tell you within the first month. If we have reasonable doubts about your identity, we may ask for more information. Withdrawing consent applies to the future, not to what happened before.

13. Complaining to the Information Commissioner's Office

If you think we are not respecting your rights, you can complain to the Information Commissioner's Office (ICO), the UK's data protection regulator (ico.org.uk, helpline 0303 123 1113). Please contact us first if you can: we will look for a solution with you.

14. Cookies

Which cookies and similar technologies we use, which don't need consent and which do, is set out in the cookie policy.

15. Changes

We may change this privacy notice, for example when our service changes. The date of the last change is at the top of the page. If a change needs your consent, we will ask you again.

16. Contact

Questions about how we protect your data: privacy@cashbackie.nl