Partner Privacy Notice
1. Who we are (data controller)
The data controller for Partner personal data is Paul McManus Dowdall, a sole trader trading as "NeverForgotten Memorials", based in Ireland. For any privacy question, or to exercise your rights, contact us at [email protected].
2. What this notice covers
This notice applies to personal data we process about Partners and applicants to the partner referral programme. How we handle the personal data of bereaved families and memorial visitors is covered by our main site privacy policy.
3. What personal data we collect
- Account & identity: your name, business name, email address and login credentials.
- Verification: information we may ask for to confirm your business and identity.
- Payment: the bank account or payment details needed to pay your Commission, and the record of payments made to you.
- Programme activity: your referral code, links, QR codes, referral and commission records, withdrawals and balance.
- Communications: emails and messages you exchange with us.
- Technical: limited log and device data generated when you use your Dashboard, and the referral cookie described in section 6.
4. Why we use it & our lawful basis
- To operate the Programme: create and manage your account, track referrals, calculate and pay Commission, and provide your Dashboard. Lawful basis: performance of our contract with you.
- To meet legal obligations: keep financial, tax and accounting records, and carry out anti-fraud / anti-money-laundering checks. Lawful basis: compliance with a legal obligation.
- To protect the Programme: prevent, detect and investigate fraud, abuse and breaches of our terms, and secure our systems. Lawful basis: our legitimate interests in running a safe, lawful programme.
- To send programme updates: service emails and, where you have opted in, partner reports and updates. You can turn optional emails off in your settings. Lawful basis: legitimate interests or your consent, as applicable.
5. Data about families you refer
Partners only ever see anonymised referral activity: a first name and last initial. We do not share names in full, contact details, or any other personal data about referred families with Partners. This is a deliberate data-minimisation measure to protect grieving families.
6. Cookies
We set a referral cookie ("nf_ref") in a visitor's browser to attribute a referral to the correct Partner. It lasts 60 days and stores only the referral code, no name or contact details. Cookie behaviour on our public site is also covered by our main site cookie information.
7. Who we share data with
We use trusted service providers ("processors") to run the Programme. They act on our instructions under contract and only for the purposes above. They include:
- Stripe: payment and subscription processing.
- Cloudinary: image and QR-code media hosting.
- Heroku: application hosting.
- Google / Gmail: email delivery.
We may also disclose data where required by law, to professional advisers, or in connection with a sale or reorganisation of the business. We do not sell your personal data.
8. International transfers
Some of our processors are based outside the European Economic Area (for example in the United States). Where data is transferred outside the EEA, we rely on appropriate safeguards recognised under the GDPR, such as an adequacy decision or the European Commission's Standard Contractual Clauses, so that your data remains protected.
9. How long we keep it
We keep financial and commission records for 6 years to meet Irish tax and accounting obligations. Other Partner data is kept for as long as your account is active and is deleted, or anonymised, after account closure where no legal retention period applies.
10. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected (rectification);
- have your data erased, where no legal obligation requires us to keep it;
- restrict or object to certain processing;
- data portability for data you provided, where applicable;
- withdraw consent at any time, where we rely on consent.
To exercise any of these, email [email protected]. We will respond within the timeframes set by law. Exercising your rights will not affect financial records we are legally required to retain.
11. Automated decision-making
We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. Referral attribution and Commission are calculated automatically but are subject to manual review and approval by us.
12. Security
We apply appropriate technical and organisational measures to protect your data, and we require our processors to do the same. No method of transmission or storage is completely secure, but we work to protect your data and to respond appropriately to any incident.
13. Closing your account
To close your account, email [email protected]. Closure is processed by us (it is not automatic), and financial and commission records are retained for 6 years as described in section 9.
14. Changes to this notice
We may update this notice from time to time. We will post the updated version on this page with a revised "last updated" date and, where the change is significant, take reasonable steps to notify you.
15. Complaints
If you have a concern about how we handle your data, please contact us first so we can help. You also have the right to lodge a complaint with the Irish Data Protection Commission at dataprotection.ie.