intrade.bar partner program privacy notice

intrade.bar partner program privacy notice

This notice explains how Future plus LLC, registration number 2562 LLC 2022, Suite 305, Griffith Corporate Centre, Beachmont, Kingstown, St. Vincent and the Grenadines (the "Company", "we", "us"), processes personal data in connection with the intrade.bar partner program (the "Program") and the partner platform at partner.intrade.bar (the "Platform").

For any question about this notice or your personal data, write to partners@intrade.bar.

1. Who this notice covers

1.1. This notice covers:

• partners and applicants to the Program, and the people who work in a partner account (the "team members");
• visitors who click a partner link or arrive on intrade.bar, to the extent that the Program tracks where they came from;
• clients of intrade.bar, to the extent that their data is used to attribute them to a partner, to calculate commission and to detect fraud in the Program.

1.2. The general processing of clients' data by intrade.bar is described in the intrade.bar privacy policy. This notice adds what is specific to the Program.

2. Roles: who is responsible for the data

2.1. The Company is the controller of the personal data of partners and team members, and of clients and visitors as described in this notice.

2.2. Each partner is a separate, independent controller of the personal data of its own website visitors, audience, subscribers and traffic, including any data it collects with its own tools or receives on its own postback server. The Company is not responsible for the partner's processing. If you are a visitor of a partner's site or channel, please read that partner's privacy information.

2.3. The partner agreement sets out the partner's duties when it handles data received from the Company.

3. Data about partners and team members

3.1. We process the following data:

• Application data: e-mail address, name, whether the applicant is a person or a company, country, messenger contact, traffic sources, target countries, expected monthly volume, website or channel addresses and any comment given in the application form.
• Account and login data: team members' names and e-mail addresses, roles and rights, password (stored only as a one-way hash), two-factor authentication secret, login times, IP addresses and browser identifiers, and the account's audit log.
• Acceptance records: which version of each legal document was accepted, by whom, when, from which IP address and browser, and in which language.
• Payout data: the partner's USDT wallet addresses with their network (TRC20, ERC20, BEP20 or Solana) and their change history, payout requests, their status and blockchain transaction references.
• Verification data: whether identity verification was required and its result. Identity documents and images are collected and held by our verification provider, Shufti Pro (section 8).
• Program data: links, promo codes, statistics, statements, commission and adjustments, and any review of the account.
• Technical data: postback endpoint settings and delivery logs, Partner API tokens (stored only as one-way hashes) and the API request log.
• Communications: e-mails and messages you send us, and suggestions you submit through the "Suggest an idea" form, stored with your account and the time.

3.2. We use this data to:

• review applications and run the partner agreement, including attribution, commission, statements and payouts (performance of the contract);
• keep accounts secure, including two-factor authentication, wallet-change protections and notices of security-relevant changes (performance of the contract and our legitimate interest in security);
• prevent, detect and investigate fraud and breaches of the Program rules (our legitimate interest);
• verify identity and eligibility, including sanctions checks, when required under the partner agreement (legal obligation and legitimate interest);
• keep evidence of acceptance of the legal terms and an audit trail of actions (legitimate interest and legal claims);
• send service e-mails about the account, payouts, changes to the terms and security (performance of the contract);
• improve the Platform using your suggestions (legitimate interest).

4. Data about visitors and clients

4.1. When someone clicks a partner link, the tracker records the click: IP address, browser identifier (user agent), country, device type, the parameters of the link (such as sub-IDs and UTM tags), the referring site and the landing page. The same tracker also records where visitors come from when they arrive without a partner link (UTM tags, referring site, landing page), so that the Company can measure all of its traffic sources.

4.2. When a visitor registers as a client, we record which partner, link or promo code the client is attributed to, and later the client's deposits, withdrawals and trading results needed to calculate commission. If a client moves to another partner, we record the move and its confirmation.

4.3. To detect self-referral, linked accounts and other fraud, we compare IP addresses, devices, wallets and payment details of partners and clients. These values reach the Platform only as keyed hashes (one-way codes computed with a secret key, from which the original value cannot be read). We do not use canvas or other script-based browser fingerprinting.

4.4. We use this data to attribute clients to partners, to calculate and verify commission, to report to partners in a pseudonymous form (section 6) and to prevent fraud. The legal basis is our legitimate interest in running the Program fairly and preventing fraud, and the performance of our contracts with partners. Where the law of the visitor's country requires consent to set the tracking identifiers described in section 5, the legal basis for them is that consent.

5. Cookies and similar identifiers

5.1. The Program uses the following first-party cookies:

• pclk: stores the last partner click so that a later registration can be attributed to the right partner; kept for 30 days; overwritten by a newer partner click; secure, not readable by scripts.
• ptrk: stores the first source of a visit without a partner link (UTM tags, referring site, landing page) so that the Company can measure its own traffic sources; kept for 30 days.
• ib_did: a random device identifier used only to detect fraud, such as several accounts on one device; kept for 2 years; set on intrade.bar and on the partner cabinet; secure, not readable by scripts. It reaches the Platform only as a keyed hash.

5.2. The partner cabinet also uses the session cookies needed to keep you logged in.

5.3. You can delete or block cookies in your browser. If you block them, clicks may not be attributed and some security checks may ask you to confirm your identity again.

6. What partners can see about clients

6.1. Partners see their clients only through a pseudonymous identifier that is different for each partner. With it they can see the client's country, dates, amounts, statuses and device, operating system and landing-page context, and the commission accrued on that client.

6.2. Partners never receive a client's name, e-mail address, phone number, IP address or intrade.bar account number from the Company, whether in the cabinet, through postbacks or through the Partner API.

6.3. Partners may use this data only to measure and optimise their own traffic and may not sell it or pass it on.

7. Automated checks

7.1. The Platform automatically checks activity for signs of fraud. A strong signal may automatically put a partner's payouts on hold until a review. The final decision to void commission, to ban a partner or to clear a case is always taken by a member of our staff.

7.2. You can ask for a review of a decision that affects you by writing to partners@intrade.bar.

8. Who we share data with

8.1. We share personal data only with service providers that process it for us under contract, with authorities where the law requires it, and with a successor of our business if the business is transferred. Our service providers are:

• Cloudflare: content delivery and protection of the website against attacks; it handles visitors' and users' network traffic.
• Mailgun: sending service e-mails to partners and team members.
• Shufti Pro: identity verification of partners when verification is required.
• Telegram: internal alerts to our staff about Platform events, such as a wallet change or a payout that needs attention; these alerts contain a partner account number, a payout request number or an amount, not a person's name or contact details.
• Hosting provider: the servers that run the Platform are provided by Hetzner Online GmbH (Germany) and located in Finland, in the European Union.

8.2. We do not sell personal data.

9. International transfers

9.1. Some of our service providers may process data outside the country where you are, including outside the European Economic Area. Where the law requires it, we use appropriate safeguards for such transfers. These are the standard contractual clauses approved by the European Commission or another safeguard recognised by the applicable law.

10. How long we keep data

10.1. We keep personal data only as long as we need it for the purposes in this notice, including to settle commission, to meet legal obligations and to defend legal claims. The following periods apply:

• postback delivery attempts: 30 days;
• postback delivery records: 180 days;
• Partner API request log: 90 days;
• acceptance records of legal documents: while the account exists and 6 years after it is closed;
• partner account, statements and payout records: 6 years after the account is closed;
• click and attribution records: while the client is attributed to the partner and 6 years after that;
• fraud-detection hashes and case records: 5 years after the case is closed or the data was last used;
• identity verification data held by Shufti Pro: as set out in our contract with Shufti Pro; we keep only the verification result, for the same period as the partner account;
• applications that were declined: 2 years.

11. Security

11.1. We protect personal data with technical and organisational measures appropriate to the risk. Among other things, every person working in a partner account and every staff member uses two-factor authentication; passwords are stored only as one-way hashes; two-factor secrets, postback signing secrets and session data are stored encrypted; device, IP and payment identifiers used for fraud checks are stored as keyed hashes; and access by our staff is limited by role and recorded in an audit log.

11.2. No system is completely secure. If a personal data breach is likely to put your rights at high risk, we will inform you as the applicable law requires.

12. Your rights

12.1. Depending on the law that applies to you, you may have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data corrected;
• have your personal data deleted or anonymised, where we no longer have a reason to keep it;
• restrict or object to processing based on our legitimate interests;
• receive the data you gave us in a portable format;
• withdraw a consent you gave, without affecting earlier processing;
• complain to a data-protection supervisory authority.

12.2. To exercise these rights, write to partners@intrade.bar. If you are a partner or team member, please write from the e-mail address registered in your account. We may need to confirm your identity before we act on a request. We will answer within one month; for complex or numerous requests we may extend this by up to two further months and will tell you so.

12.3. Deletion means that we remove or anonymise your name, contact details and other personal details. We keep the records we must or legitimately need to keep, such as registration, attribution of clients, verification results, statements, payouts and antifraud records, for the periods in section 10, for example to pay commission already accrued, to keep records required by law or to investigate fraud. Deleting a partner account does not allow the same person to join the Program again as a new partner.

12.4. If you are a client or visitor and your request concerns a partner's own processing, please contact that partner directly; the Company does not control it.

13. Age

13.1. The Program is only for persons aged 18 or over. We do not knowingly accept applications from younger persons. If we learn that a partner was under 18 when applying, we close the account even if the person has since turned 18 (partner agreement, section 3.5).

14. Changes to this notice

14.1. We may update this notice. We publish each new version in the partner cabinet with a change log and tell partners by e-mail before a significant change takes effect.

15. Contact

15.1. Questions, requests and complaints about personal data: partners@intrade.bar.

15.2. Postal address: Future plus LLC, Suite 305, Griffith Corporate Centre, Beachmont, Kingstown, St. Vincent and the Grenadines.