Last updated: 2026-08-20
1. Who the controller is
The controller of your personal data is [·] (company name), registered at [·], entered in [·] under number [·], tax ID [·].
For anything concerning personal data write to partner@chinago.pl. We answer within one month at the latest.
We have not appointed a data protection officer [·]. If that obligation applies, their contact details will go here.
2. What we collect
We collect only what the partner programme cannot run without.
- Application: first name or handle, email address, links to your channels, approximate reach, description of past collaborations.
- Account: a login we generate for you (format CG-XXXX), password stored as an irreversible hash (we never see your password), a contact email address, role in the system, sign-in history.
- Settlement: full name, address, bank account number, tax ID if you invoice as a business. We ask for these only before the first payout.
- Sales: clicks on your link, conversions, order value, commission accrued, partner tier.
- Technical data: a hash of your IP address, device type, browser, country, the page the click came from.
- Correspondence: emails, threads in the panel, tickets on our Discord.
3. What we do not collect
We never store a raw IP address. Before it reaches the database it goes through SHA-256 with a secret salt. That lets us tell that two clicks came from the same device, but the address cannot be reconstructed from the record.
We do not collect health data, opinions, affiliations or any other special-category data. We do not buy data from brokers.
We have no access to your social media accounts. We only see what you tell us in the application.
4. Legal bases
Bases under Article 6(1) GDPR, split by purpose:
- Point (b) (contract): running your account, calculating commission, payouts, contact about the collaboration.
- Point (c) (legal obligation): issuing and retaining accounting records, tax duties.
- Point (f) (legitimate interest): platform security, detecting abuse and artificial traffic, aggregate statistics, pursuing claims.
- Point (a) (consent): non-essential cookies and marketing messages. You can withdraw consent at any time; it does not affect what we did before.
5. How long we keep data
| Data | Period |
|---|---|
| Partner account and profile | for the duration of the collaboration, then 3 years (limitation of claims) |
| Accounting records and settlements | 5 years from the end of the tax year in which the obligation arose |
| Click and conversion records | 24 months from the event |
| Correspondence and tickets | 2 years from the last message |
| Rejected applications | 6 months, so we do not review the same case twice |
| Security and audit logs | 12 months |
6. Who we share data with
We do not sell data. We share it only with providers we need to run the platform, and always under a processing agreement.
- Application and database hosting: [·].
- Transactional email delivery: [·].
- File and asset storage: [·].
- Accounting office: [·].
- Discord: if you contact us through our server, your messages are also covered by Discord's privacy policy.
- Public authorities, where they have a legal basis.
7. Transfers outside the European Economic Area
Some of our providers may process data outside the EEA [·]. In that case we rely on a European Commission adequacy decision or on standard contractual clauses. We provide a copy of the safeguards on request.
8. Your rights
To exercise any of these, write to partner@chinago.pl.
- Access to your data and a copy of what we hold.
- Rectification, if something is wrong.
- Erasure, unless an accounting obligation or an open settlement stops us.
- Restriction of processing.
- Portability to another controller in a machine-readable format.
- Objection to processing based on legitimate interest.
- Withdrawal of consent at any time.
- A complaint to the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, Poland.
9. Minors
The programme is aimed at creators from the age of 15, so we treat this separately and seriously.
If you are under 16, processing your data in information society services requires consent from a parent or legal guardian (Article 8 GDPR together with Polish law). We will ask for that consent before opening your account.
If you are under 18, a parent or legal guardian must confirm any commission payout. We will tell you exactly which documents we need before the first settlement.
The detailed procedure for minors [·], to be settled with a lawyer before the programme opens.
10. Automated decisions
Your partner tier is calculated automatically from sales results and traffic quality. That is the only automation affecting your commission rate.
It is not a decision based solely on automated processing within the meaning of Article 22 GDPR, because you can always ask for human review. Just write to us. We always explain a promotion or a drop.
11. Security
- Passwords are stored only as argon2id hashes.
- All traffic runs over HTTPS.
- Access to partner data is limited to the employee who actually needs it.
- Every data change in the admin panel leaves an audit log entry.
- IP addresses reach the database only as a salted hash.
12. Changes to this policy
If we change how we process data, we update this document and put a new date at the top. We announce material changes by email or a notice in the panel before they take effect.