eNomad Affiliate Program – Privacy Notice

Version: 12 November 2026

eNomad · Frankfurter Str. 98c · 65428 Rüsselsheim am Main · Germany
Email: help@enomad.io · Legal Notice

1. Controller and scope

This Affiliate Program Privacy Notice describes how eNomad handles personal information relating to Affiliate applicants, approved partners and persons whose visits or purchases are processed for referral attribution. For activities under eNomad's control, contact: eNomad, Frankfurter Str. 98c, 65428 Rüsselsheim am Main, Germany, help@enomad.io; legal operator details: Legal Notice. This notice supplements the general eNomad Privacy Policy governing visitors and customers. Independent service providers may act as separate controllers for certain activities; their notices also apply.

2. Categories of personal data

• Application information: name, business name, address or country, email, contact details, websites and social media channels, application status and communications.
• Account information: Affiliate identifier, approved links, promotional codes, account settings, login or support records to the extent provided to us.
• Referral and order information: referral identifiers, referral time, referral or campaign source, limited order references, eligible product/transaction amounts, discount and refund status, commissions and adjustments.
• Technical information: IP address, browser/device details, cookies or similar identifiers if collected by the platform and permitted by law.
• Payment information: payout account data, tax or invoicing details, payment records and identity verification information where lawfully necessary.

3. Purposes and lawful grounds

We process personal data to receive and review applications, establish and perform Affiliate contracts, provide program access, attribute permitted referrals, verify orders, calculate and settle commissions, respond to inquiries, secure accounts, prevent fraud and comply with legal duties. Where the GDPR applies, the legal bases are Article 6(1)(b) GDPR for contracts with individuals or requested pre-contractual measures; Article 6(1)(c) for statutory duties; Article 6(1)(f) for proportionate security, fraud-prevention and business-contact interests; and Article 6(1)(a) for processing based on consent. For business representatives, business-contact processing may rest on legitimate interests depending on the circumstances. Applicable electronic-communications consent requirements are evaluated separately.

4. Affiliate links, tracking and cookies

Our affiliate referral system uses GoAffPro to associate referred website activity and qualifying transactions with approved partners. A referral may include link parameters, session or cookie identifiers, timestamps and order attribution information. The intended pilot referral attribution period is seven days, subject to confirmation of actual platform settings and browser behavior. The exact storage duration of technical identifiers may differ from the attribution window and must be verified in the active configuration. Non-essential cookies and comparable tracking requiring consent under applicable law must not be activated before the required valid consent. If tracking is declined, withdrawn or technically unavailable, referral attribution may not work. Information on available privacy choices is provided through the applicable store consent interface.

5. Recipients and GoAffPro

GoAffPro supplies the Affiliate Portal and related tracking, account and commission-management technology. Personal data relevant to the program may be shared with GoAffPro as technically necessary. Depending on the actual activity and contracts, GoAffPro may process data as a service provider and/or under its own responsibility. Please also read GoAffPro's privacy information. Other recipients where necessary may include Shopify, payment service providers, professional accounting or legal advisers, and public authorities when legally required. We do not provide Affiliates with unrestricted access to customer payment details or unrelated customer records.

6. Transfers outside the EEA

eNomad is established in Germany. GoAffPro identifies itself as an India-based provider and reports infrastructure and processing that can involve countries outside the European Economic Area, including locations in the United States and Asia. Where personal data are transferred internationally, transfers must comply with applicable GDPR requirements, including an adequacy decision or appropriate safeguards where required. Information on the safeguards applicable to a particular transfer may be requested from us. We do not represent that a specific data-processing or transfer agreement has been concluded unless confirmed.

7. Retention and deletion

Data are retained for as long as necessary for application review, active participation, referral and commission verification, payments, fraud prevention, disputes and applicable legal accounting/tax retention requirements. Retention periods vary by data category and any statutory obligation. Data no longer needed are deleted or anonymized where legally permissible. Service providers maintain records in accordance with their applicable contracts and legal requirements.

8. Affiliate responsibility for independent promotion

Affiliates independently control personal data collected on their own websites, mailing lists, social media channels and marketing platforms. They must provide appropriate notices, obtain any necessary marketing and tracking consent, and implement suitable security measures. These responsibilities are separate from eNomad's processing of Affiliate account and commission information.

9. Security

We use reasonable technical and organizational safeguards, including access restrictions and provider security controls, to protect personal data. Nevertheless, no online system can guarantee absolute security. Affiliates should protect their login credentials and report suspected account compromise promptly.

10. Rights under data-protection law

Depending on applicable law, you may request access, rectification, erasure, restriction, portability, or object to certain processing. Where processing is based on consent, you may withdraw that consent with effect for the future. You can exercise your rights by writing to help@enomad.io. You also have a right to complain to a competent supervisory authority, including the competent data-protection authority in Hesse, Germany.

11. Required information and automated processing

Basic identity and contact information are necessary to assess an Affiliate application; further information may be necessary to set up payment. Without essential information, participation or payment may not be possible. Technical systems may automate provisional commission calculations and risk checks; material disputed commission decisions can be referred for human review. We do not intend to subject applicants to solely automated decisions with legal or similarly significant effects.

12. Changes and contact

We may update this notice to reflect verified changes to processing, service providers or law. The current version is published here. Privacy questions, requests and complaints: help@enomad.io. For ordinary customers, see the eNomad general Privacy Policy.