Cyprus Bucketlist

Affiliate Privacy Notice

Version v1 — 2026-09-15

Affiliate Privacy Notice

Version 1 — 15 September 2026. The English version is definitive; any translation is for reference only.

This notice explains how we process the personal data of our affiliates (individuals and businesses who promote the Site and earn commission under the Affiliate Agreement). The Privacy Policy published on the Site is customer-facing and separate; operators are covered by a separate Supplier Privacy Notice.

1. Who we are (the controller)

The controller responsible for your personal data is DEMCYN LTD, a private company registered in Cyprus under company number HE 491561, registered office Vavyla 3, Block A, Flat/Office 204, Pera Chorio Nisou, 2572 Nicosia, Cyprus ("we", "us", "Cyprus Bucketlist"). We operate the website at cyprusbucketlist.com (the "Site"). We have not appointed a Data Protection Officer, as the conditions under Article 37 GDPR do not apply to us. For any question about this notice or to exercise your rights, contact support@cyprusbucketlist.com.

2. Who this notice is for

This notice applies to affiliates and their designated contacts — individuals and businesses who promote the Site and earn commission under the Affiliate Agreement. Where you are a company, data protection law applies to your individual contacts and representatives (a natural person), not to the company as a legal entity; where your contact person is not you (for example a member of staff), we process that person's data in our legitimate interest in dealing with you (Article 6(1)(f)). For all purposes connected with the Site, you and we are independent controllers of the personal data each of us holds; neither Party is the other's processor.

3. The personal data we process, and where it comes from

Most of the data comes from you when you apply, are invited, or use your dashboard. Some is generated by us or your device, or copied from your supplier account if you are also a supplier (see §4). We process:

  • Account and identity data — your name and email address (held through our authentication provider), the business name and business type (where applicable), and the destination or area you operate in.
  • Legal and tax identity — your legal or registered name, registered address, VAT number, and tax identification number (TIC, or equivalent in your jurisdiction), where you provide them.
  • Banking and payout data — IBAN, account holder name, and bank name, used to pay you.
  • Application data — how you plan to promote, expected volume, and any free-text notes you submit.
  • Agreement acceptance records — the version you accepted, a content hash, the date and time, your name, and the IP address and browser used, kept as evidence that you accepted the Agreement and (for VAT-registered affiliates) the self-billing arrangement.
  • Commission and payout records — your commission terms, the bookings attributed to you, settlement amounts, payout history, self-billed invoices and proofs of payment, and any set-offs, clawbacks or credit notes.
  • Performance and trust-and-safety data — your referral codes and click counts, referral-velocity signals, records of code suspensions and any complaints we receive about a referral code, and an internal audit log of administrative actions and of changes to your payout details on your account, used to prevent and investigate fraud and abuse.
  • Introduction (introducer) data — where another affiliate introduced you to the Programme, the identity of your introducer, the introduction code used, and the date the introduction was recorded; where you introduce other affiliates, the affiliates you introduced and the introducer commission you earn on their activity.
  • Communications — emails we send you and notes from support interactions.
  • Consented analytics attribution data — if you accept the Site's Analytics category when you apply, we record the consent status and opaque consent, Google Analytics browser and session identifiers. We use them to measure the application, qualification and first-conversion milestones without sending your name, contact details, application text, tax details or banking details to Google.

We do not carry out biometric or government-ID identity verification of affiliates, and we do not process special categories of personal data about you.

4. Data we generate or obtain from other sources (Article 14)

Some data is not provided by you directly. Under Article 14 GDPR we tell you the categories and sources:

  • Commission, payout and performance records, and audit logs — generated by us from your activity, and from bookings made on the Site, as you operate in the Programme.
  • Your supplier record — if you are also a supplier (operator) on the Site and apply to the Programme, we copy your legal identity and banking details (legal or registered name, registered address, tax identification number, IBAN, account holder name, and bank name) from your supplier account into your affiliate account, so that you do not have to provide the same information twice. You can review and correct these details at any time (§11).
  • IP address and browser in the acceptance records — generated by your device when you register or accept the Agreement.
  • Introduction records and introducer commission figures — generated by us when an introduction is recorded and as introducer commission accrues on an introduced affiliate's attributed bookings.
  • Analytics lifecycle events — generated by us when a self-service application is submitted, approved and first results in payable referral activity, but only where the application journey carried a valid Analytics consent record.

We use this data to perform the contract, comply with our tax and accounting obligations, and prevent fraud and abuse (§6).

5. Is providing your data required?

Providing the data marked as needed in §3 (in particular your name, email, business name where applicable, registered address, VAT number where applicable, and IBAN) is a contractual requirement under the Affiliate Agreement. If you do not provide it, we cannot set up your account, verify you for tax and payment purposes, attribute commission, or pay you. Free-text notes are optional. Trust-and-safety data is generated by us and is necessary to operate the Programme safely.

6. Why we process your data, and our legal bases

  • Set up and manage your account, operate the programme, and communicate about it — performance of the contract (Article 6(1)(b)); legitimate interests (Article 6(1)(f)) for a staff contact.
  • Calculate and pay commission; issue self-billed invoices, proofs of payment and credit notes — performance of the contract (Article 6(1)(b)) and legal obligation (Article 6(1)(c)).
  • Keep accounting, tax, invoicing and VAT records (including reverse-charge reporting to EU tax authorities) and self-billing evidence — legal obligation (Article 6(1)(c)).
  • Record your acceptance of the Agreement and self-billing terms (including IP and browser) — performance of the contract (Article 6(1)(b)); legitimate interest in holding proof of agreement (Article 6(1)(f)).
  • Prevent, detect and investigate fraud, abuse and payment disputes; secure the Site; handle code complaints — legitimate interests (Article 6(1)(f)): our interest in protecting the Site, our finances, and other partners from fraud and abuse outweighs the limited privacy impact, because we confine this to signals consistent with abuse and review any consequence by a human (see §10).
  • Operate the introducer programme — record who introduced whom, calculate introducer commission, show your introducer the aggregate figures described in §7, and show you who introduced you — legitimate interests (Article 6(1)(f)): our interest, and the introducer's, in operating and accounting for a transparent introduction programme outweighs the limited privacy impact, because visibility is confined to the aggregate figures described in §7 and you can object (§11).
  • Service messages about your account and payments — performance of the contract (Article 6(1)(b)).
  • Programme updates and surveys — legitimate interests (Article 6(1)(f)), subject to your right to opt out at any time; consent (Article 6(1)(a)) where the law of your country requires it.
  • Measure the self-service application and programme-conversion journey in Google Analytics — consent (Article 6(1)(a)). Withdrawing Analytics consent stops future lifecycle events from being sent; it does not affect processing already carried out lawfully before withdrawal.

7. Who we share your data with

  • Processors acting on our behalf (bound by Article 28 data-processing agreements): authentication (Clerk), database and website hosting (Neon, Vercel), transactional and marketing email (Resend), internal team notifications (Slack), and consented usage analytics (Google Analytics 4, provided by Google Ireland Ltd / Google LLC). They protect your data and use it only on our instructions.
  • Our business banking and payment provider — to pay you, we share your name, IBAN and payout amount with our banking provider (Revolut Business) and our bank. This provider acts as a separate controller for the payment it executes.
  • Our accountant — for invoicing, self-billing, VAT and tax compliance. The accountant acts as a separate controller for those obligations.
  • Tax and regulatory authorities — where required by law (Cyprus tax filings and EU VAT reporting for reverse charge).
  • Legal, regulatory and law-enforcement authorities, and our professional advisers, where required by law or to establish, exercise or defend legal claims.
  • Your introducer and the affiliates you introduce — where another affiliate introduced you to the Programme, that affiliate can see your display or business name, your Programme status, the date you joined, and monthly aggregate amounts of the introducer commission derived from your attributed bookings. They are never shown your individual bookings, booking references, tour dates, customers, or contact details. Where you introduce an affiliate, that affiliate is told your name as their introducer. You can object to this visibility (§11).
  • A buyer or successor, in connection with a merger, acquisition or sale of the business; we will notify you of any change of controller.

We do not sell your personal data.

8. International transfers

Some processors are based outside the EEA (in particular the United States and the United Kingdom). Where your data is transferred outside the EEA, we rely on an adequacy decision by the European Commission (for example the United Kingdom, and the EU-US Data Privacy Framework where the provider is certified) or on Standard Contractual Clauses with appropriate supplementary measures, such as encryption in transit. To obtain details of a specific transfer or a copy of the safeguards, contact support@cyprusbucketlist.com.

9. How long we keep your data

  • Accounting, tax, invoicing, VAT and self-billing records, and payout records — for at least 6 years, the statutory retention period under Cyprus tax and company law, because we are legally required to keep them.
  • Agreement and self-billing acceptance records (clickwrap evidence) — for the period needed to evidence the agreement and to defend potential claims, in line with the applicable Cyprus limitation period.
  • Account, application and trust-and-safety data — for the duration of our relationship and a reasonable period afterwards; free-text application notes and admin notes may be deleted sooner.
  • Analytics attribution data and lifecycle-event outbox records — for up to 24 months, then deleted or anonymised; Google Analytics applies the retention configured for the property.

When data is no longer needed for any of these purposes, we delete or anonymise it.

10. Automated decision-making and profiling

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects (for example, we do not automatically suspend an account without human review). We do use automated signals, including referral-velocity checks, to flag potentially abusive accounts for manual review by our team. Any suspension, code revocation, or commission decision is taken by a person, and you can challenge it using your rights in §11 or by contacting support@cyprusbucketlist.com.

11. Your rights

Subject to the conditions in the GDPR, you have the right to:

  • access the personal data we hold about you;
  • have inaccurate data rectified and incomplete data completed;
  • have your data erased ("right to be forgotten") where it is no longer needed and no legal retention obligation applies; note that accounting, tax and invoicing records cannot be erased while the law requires us to keep them, and proof of your acceptance of the Agreement may be retained to defend potential claims;
  • restrict our processing in certain circumstances;
  • receive your data, and have it transmitted to another controller, in a structured, commonly used, machine-readable format (portability), where processing is based on contract or consent and is automated;
  • object to processing based on our legitimate interests, on grounds relating to your situation, and to object to direct marketing (programme updates and surveys) at any time, by using the unsubscribe link in any such email or contacting us; this will not affect transactional messages about your account or payments. You may also object to the introducer visibility described in §7; if you do, we unlink the introduction going forward, which ends both the visibility and any further introducer commission on your bookings (commission already accrued is unaffected);
  • withdraw consent at any time where we rely on consent, without affecting prior processing.

To exercise any right, contact support@cyprusbucketlist.com. We may need to verify your identity. We will respond within one month of receipt; for complex requests we may extend this by up to two further months and will tell you why.

12. Complaints

Please contact us first. You also have the right to lodge a complaint with a data protection supervisory authority — in Cyprus, the Office of the Commissioner for Personal Data Protection (https://www.dataprotection.gov.cy), or the authority in your own country of residence or work.

13. Changes to this notice

We may update this notice from time to time. We will post the current version and, where the change is material, notify you by email or through your dashboard.