Privacy Policy

This Privacy Policy explains how ConvertLane Ltd (“ConvertLane”, “we”, “us”, “our”) processes personal data when you visit http://convertlane.co.uk, apply to join our performance affiliate network, or operate as an approved advertiser or publisher.

We are committed to processing personal data lawfully, fairly, and transparently in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and applicable international privacy laws.

1. Who is responsible for your data?

Data controller: ConvertLane Ltd, registered in England & Wales.

Contact: contact@convertlane.co.uk for privacy and data subject requests.

Where we process end-user conversion data on behalf of an advertiser, the advertiser is typically the data controller for that data and we act as a data processor under a separate data processing agreement where required.

2. Personal data we collect

Depending on how you interact with us, we may collect the following categories of personal data:

2.1 Website visitors and enquiries

• Contact details (name, email, company, message content) when you use our contact or application forms.
• Technical data: IP address, browser type, device identifiers, referring URL, and server logs.
• Cookie and analytics data as described in Section 8.

2.2 Partner applications (advertisers and publishers)

• Business identity: legal entity name, registered address, company number, VAT number, website URLs.
• Contact persons: names, job titles, business email addresses, and telephone numbers.
• Due diligence: ownership and control information, traffic or product descriptions, bank account details for payouts or billing, and documents you provide for KYC/KYB review.
• Sanctions and PEP screening results generated from information you supply.

2.3 Approved network partners

• Account management records, correspondence, and operational notes.
• Performance data: clicks, impressions, conversions, sub-IDs, referrer URLs, IP addresses, user agents, and timestamps via our tracking and reporting systems.
• Financial records: invoices, remittance advice, payment confirmations, and tax documentation.
• Fraud and compliance investigation records where relevant.

2.4 Data we do not intentionally collect

Our services are directed at businesses. We do not knowingly collect personal data from children under 18. If you believe we have received such data, contact us and we will delete it promptly.

3. How we use personal data

Purpose	Typical lawful basis
Reviewing and onboarding partner applications	Contract; legitimate interests (fraud prevention, network integrity)
Operating offers, tracking, reporting, and cap management	Contract; legitimate interests
Processing publisher payouts and advertiser billing	Contract; legal obligation (tax and accounting)
Compliance, sanctions screening, and fraud investigation	Legal obligation; legitimate interests; contract
Responding to support requests and disputes	Contract; legitimate interests
Improving our website and security	Legitimate interests; consent (non-essential cookies where required)
Marketing to existing business contacts about ConvertLane services	Legitimate interests; consent where required by law

4. Who we share data with

We share personal data only where necessary and under appropriate safeguards:

• Advertisers and publishers — as required to operate programmes (for example, conversion validation, quality review, or payment reconciliation).
• Tracking and infrastructure providers — hosting, CDN, email, and affiliate tracking platforms that process data on our instructions.
• Payment processors — to execute publisher payouts and receive advertiser funds.
• Professional advisers — lawyers, accountants, and auditors bound by confidentiality.
• Regulators and law enforcement — where required by law or to protect our legal rights.

We do not sell personal data.

5. International transfers

We primarily use UK and EEA-based service providers. Where personal data is transferred outside the UK or EEA, we implement appropriate safeguards such as the UK International Data Transfer Agreement, UK Addendum to EU Standard Contractual Clauses, or an adequacy decision, and we assess transfer risk before onboarding processors.

6. Retention

We retain personal data only for as long as necessary for the purposes described above, including:

Data category	Typical retention
Approved partner records, agreements, and financial data	7 years after the relationship ends
Performance and tracking statistics	7 years (archived annually)
Rejected applications (including ID documents)	2 years, then deleted or anonymised
General business email	3 years unless a longer period is required for disputes or legal hold
Website server logs	90 days unless required for security investigation

7. Security

We apply administrative, technical, and organisational measures appropriate to the risk, including access controls, encryption in transit, least-privilege access for staff, and secure storage of due diligence documents. No method of transmission over the internet is completely secure; we cannot guarantee absolute security.

8. Cookies and similar technologies

Our website may use essential cookies required for security and basic functionality. Where we use analytics or marketing cookies that require consent under UK law, we will request your consent via a cookie banner or equivalent mechanism.

Partner tracking links may set or read cookies and similar identifiers on end users’ devices as part of performance measurement. Publishers and advertisers are responsible for their own consent and disclosure obligations toward end users in their operating jurisdictions.

9. Your rights

Under UK GDPR, you may have the following rights (subject to conditions and exemptions):

• Right of access to your personal data
• Right to rectification of inaccurate data
• Right to erasure (“right to be forgotten”)
• Right to restrict processing
• Right to data portability
• Right to object to processing based on legitimate interests
• Right to withdraw consent where processing is consent-based

To exercise your rights, email contact@convertlane.co.uk. We respond within one month unless an extension is permitted. We may need to verify your identity before disclosing information.

You may lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk. We encourage you to contact us first so we can try to resolve your concern.

10. Automated decision-making

We do not make solely automated decisions about partner approval that produce legal or similarly significant effects without human review. Compliance and fraud decisions involve trained staff or contractors.

11. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page will change when we do. Material changes affecting existing partners will be communicated by email or through the partner reporting area where appropriate.

12. Related documents

• Terms of Service
• Affiliate (Publisher) Agreement
• Advertiser Agreement