Privacy Notice for Partners & Applicants

Effective: 29 July 2026

1. Controller

The controller responsible for processing personal data in connection with the Stardust Affiliate and Ambassador Programs is:

Stardust Acrylics
Owner: Tamara Dogan
Margaretendamm 12
6923 Lauterach
Austria

Email: office@stardustacrylics.com
Website: stardustacrylics.com

Hereinafter referred to as “Stardust”, “we” or “us”.

This Privacy Notice explains how personal data is processed in connection with applications, participation and administration of the Stardust Affiliate and Ambassador Programs.

2. Who does this Privacy Notice apply to?

This Privacy Notice applies in particular to:

  • individuals applying for or registering with the Stardust Affiliate Program;
  • individuals applying for the Stardust Ambassador Program;
  • approved and active affiliates;
  • accepted and active ambassadors;
  • former affiliates and ambassadors;
  • individuals communicating with us about a potential partnership;
  • visitors to the partner portal;
  • individuals whose order is technically attributed to an affiliate link or discount code.

Our general Privacy Policy also applies to orders placed through the Stardust online shop.

3. What personal data do we process?

Depending on the application, program participation and technical use, we may process the following categories of data:

Identity and contact data

  • first and last name;
  • company name or business designation;
  • date of birth or confirmation of legal age;
  • address and country;
  • telephone number;
  • email address.

Business, billing and payment data

  • business or company status;
  • VAT identification number and tax information, where required;
  • billing address;
  • bank details, PayPal address or other payout data;
  • invoices, statements and payout records;
  • information relating to small-business taxation;
  • commission and payout information.

Application, profile and social-media data

  • website and linked social-media profiles;
  • usernames and profile names;
  • country, audience, reach and platforms;
  • experience in the nail, beauty or content-creation sector;
  • content focus and previous brand collaborations;
  • application responses and voluntarily submitted information;
  • publicly visible content from the profiles you provide;
  • internal notes, review and admission decision.

Partner, contract and collaboration data

  • affiliate or ambassador status;
  • partner ID, personal affiliate link and discount code;
  • individual commission and customer-discount terms;
  • participation terms, Ambassador Agreement and individual schedules;
  • agreed content deliverables, deadlines and publication evidence;
  • links to published content;
  • approvals and agreed usage or reposting rights;
  • product packages, delivery address and shipment status;
  • communications with Stardust;
  • participation, contract and termination status.

Tracking, order and commission data

  • clicks and referred traffic;
  • attributed orders;
  • order number, order value and order status;
  • commission amount and status;
  • cancellations, returns and refunds;
  • payout status;
  • use of a partner link or discount code.

Technical data

  • IP address;
  • browser type and version;
  • operating system and device information;
  • date and time of access;
  • login and usage data;
  • pages accessed and referrer URL;
  • cookie and session identifiers;
  • approximate location information;
  • data used for troubleshooting, security and abuse prevention.

4. Where do we obtain the data?

We obtain personal data in particular:

  • directly from you through application, registration or contact forms;
  • from information in your partner account;
  • from your communications with us;
  • from the social-media profiles you link and make publicly available;
  • through our Shopify online shop;
  • through GoAffPro;
  • through the technical use of partner links and discount codes;
  • from payment providers, banks or shipping providers where required for administration.

Please do not submit personal data relating to other individuals unless you are authorised to do so.

5. Purposes and legal bases of processing

Applications and admission to the Affiliate or Ambassador Program

We process application, contact and profile data to:

  • receive your application or registration;
  • review your information and linked profiles;
  • assess your suitability and brand fit;
  • decide whether to accept your application;
  • ask follow-up questions and prepare a potential collaboration.

The legal basis is Article 6(1)(b) GDPR where processing is necessary in order to take steps prior to entering into a contract.

Where we review additional publicly available information, the legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the careful selection of suitable, authentic and brand-compatible partners and the prevention of abuse and conflicts of interest.

Administration of the Affiliate or Ambassador collaboration

Following acceptance, we process data in particular for:

  • setting up and managing the partner account;
  • providing personal links and discount codes;
  • attributing referred orders;
  • calculating, reviewing and paying commissions;
  • managing individual terms, agreements and schedules;
  • planning and documenting agreed content deliverables;
  • shipping agreed product packages;
  • managing agreed usage and reposting rights;
  • communicating about the partner program;
  • processing cancellations, returns and refunds.

The legal basis is Article 6(1)(b) GDPR.

Accounting and legal obligations

We process billing, payment and tax data for proper accounting, compliance with tax obligations, record retention and responding to official requests.

The legal basis is Article 6(1)(c) GDPR.

Fraud prevention, program security and legal enforcement

We may process personal data to:

  • detect self-orders, manipulation and abusive discount-code use;
  • review suspicious clicks, orders or payouts;
  • protect accounts and systems;
  • investigate breaches of participation terms or agreements;
  • establish, exercise or defend legal claims.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is protecting our business, systems and partner programs from abuse, fraud and financial damage.

Voluntary marketing communications

We send newsletters and other non-essential promotional messages only where consent has been provided. The legal basis is Article 6(1)(a) GDPR. Consent may be withdrawn at any time with effect for the future.

Contractual, billing, security and program-related communications are not affected.

6. Affiliate tracking and cookies

We use GoAffPro affiliate-marketing software for the technical attribution of clicks and orders.

When a person visits our shop through a partner link, cookies or similar technologies may be used to:

  • identify the referring partner;
  • assign a session;
  • store the attribution period;
  • attribute a later order to the partner;
  • calculate the resulting commission.

GoAffPro identifies the cookies ref, gfp_v_id and gfp_v_expires. The attribution period configured by us is generally 30 days.

Where consent is required for tracking, storage or access only takes place after consent has been provided through our cookie-consent tool. Consent can be withdrawn at any time through the cookie settings.

Without consent, or where cookies are deleted or blocked, automatic attribution through the partner link may not occur. A discount code deliberately entered by the customer may still be used to attribute an order.

7. Use of GoAffPro

For the technical operation of the partner program, we use:

GoAffPro
16, Sector 20, Part 1, HUDA
Sirsa, Haryana 125055
India

GoAffPro supports in particular:

  • partner registration and login;
  • management of partner accounts;
  • creation and attribution of links and discount codes;
  • recording clicks and orders;
  • calculating and displaying commissions;
  • partner dashboards and notifications;
  • fraud and abuse prevention;
  • technical analysis and troubleshooting.

According to GoAffPro, data centres are located in Germany, the United States and Singapore. GoAffPro processes data in accordance with its agreements with us and, where applicable, additionally under its own data-protection responsibility.

8. Use of Shopify and application forms

Our website, partner and ambassador application pages and the contact forms used on them are provided through Shopify. Applications and form submissions may therefore be processed through Shopify’s technical infrastructure and forwarded to the business email address configured by us.

In connection with the technical provision of these services, Shopify may process contact, form, device, browser, log and security data.

9. Other recipients of personal data

Where necessary, personal data may be disclosed to the following categories of recipients:

  • GoAffPro;
  • Shopify and related technical service providers;
  • hosting, IT, email and security providers;
  • banks, PayPal and other payment providers;
  • accounting, bookkeeping and tax advisers;
  • legal advisers;
  • shipping and logistics providers for product packages;
  • authorities and courts where legally required;
  • other providers supporting the operation of the partner programs.

Service providers receive only the data required for the relevant task.

10. Transfers outside the European Economic Area

The use of GoAffPro, Shopify and other technical providers may involve processing of or access to personal data outside the European Union or European Economic Area.

This may in particular involve processing or access in India, the United States of America or Singapore.

Where no adequacy decision of the European Commission applies, transfers take place only in accordance with Articles 44 et seq. GDPR, for example on the basis of EU Standard Contractual Clauses and supplementary technical and organisational safeguards.

11. Retention periods

We retain personal data only for as long as required for the relevant purpose.

Rejected or withdrawn applications

Data relating to rejected or withdrawn applications will generally be deleted no later than six months after the application process has ended, unless a longer period has been agreed, legal obligations apply, or the data is required to establish or defend claims.

Active affiliates and ambassadors

Data relating to active partners is processed for the duration of their participation or contractual relationship.

Following termination of the collaboration

Following termination, data is deleted or anonymised once it is no longer required. This does not apply to invoices, payout records, commission statements, tax-relevant documents, contractual documents or data required to establish or defend claims. Such data is retained in accordance with applicable statutory retention and limitation periods.

Technical data

Technical log, error and security data is retained only for as long as required for secure operation, troubleshooting, abuse prevention or the investigation of specific security incidents.

12. Requirement to provide data

Certain personal data is required in order to:

  • review an application or registration;
  • set up a partner account;
  • administer an Affiliate or Ambassador Agreement;
  • calculate and pay commissions;
  • ship product packages;
  • comply with accounting and tax obligations.

Without the required information, we may be unable to fully review an application or permit participation. Voluntary information is identified as such in the relevant form or is apparent from the context.

13. Automated decision-making

As a rule, we do not make solely automated decisions within the meaning of Article 22 GDPR that produce legal effects concerning you or similarly significantly affect you.

Acceptance or rejection of an Affiliate or Ambassador application is generally based on a personal review. Automated technical checks may be used to identify suspicious clicks, orders, discount-code use or patterns of abuse. A final suspension or rejection is reviewed by us.

14. Data security

We implement appropriate technical and organisational measures to protect personal data, in particular against unauthorised access, loss, alteration, destruction and unauthorised disclosure.

According to GoAffPro, data is encrypted in transit and at rest and protected by access controls. Despite appropriate safeguards, completely risk-free transmission of data over the internet cannot be guaranteed.

15. Your data-protection rights

Subject to the applicable legal requirements, you have the following rights in particular:

  • access to the personal data processed by us;
  • rectification of inaccurate or incomplete data;
  • erasure of personal data;
  • restriction of processing;
  • data portability;
  • objection to processing based on legitimate interests;
  • withdrawal of consent with effect for the future;
  • the right to lodge a complaint with a data-protection supervisory authority.

To exercise your rights, contact us at office@stardustacrylics.com. Where there are reasonable doubts regarding identity, we may request appropriate proof of identity.

16. Objection to processing

Where we process personal data on the basis of Article 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation.

We will then no longer process the relevant data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is required for the establishment, exercise or defence of legal claims.

You may object to direct marketing at any time without providing reasons.

17. Right to lodge a complaint

You have the right to lodge a complaint with a data-protection supervisory authority.

Austrian Data Protection Authority
Barichgasse 40–42
1030 Vienna
Austria
Email: dsb@dsb.gv.at
Phone: +43 1 52 152-0

You may also contact the competent supervisory authority at your habitual residence or place of work.

18. Minors

The Stardust Affiliate and Ambassador Programs are intended exclusively for individuals who are at least 18 years old and have full legal capacity. We do not knowingly accept minors.

19. Changes to this Privacy Notice

We may amend this Privacy Notice where legal requirements, our partner programs, service providers, technical functions or processing activities change.

The current version will be published on our website or in the partner portal. Active partners may additionally be informed of material changes by email or through the dashboard.