Draft pending legal review. This notice describes the processing the Partner Programme actually performs. It has not yet been reviewed by a qualified lawyer or a data-protection adviser, and should be before the programme is opened to participants.
This notice explains how EasyLounge handles personal data about participants in the Partner Programme — how we collect it, why, who sees it, and what you can require of us.
It sits alongside our main Privacy Policy, which covers use of the EasyLounge platform. If you both operate a lounge with us and take part in the Programme, both apply: the main Policy to your use of the platform, this notice to your participation in the Programme. Where they describe the same processing, this notice is the more specific and governs.
It forms an integral part of the Partner Programme Terms.
1. Who Is Responsible
SIR PATRYK PEAS, ul. Długa 57c/45, 53-633 Wrocław, Poland, NIP / VAT: PL8982147972, trading as EasyLounge, is the controller of the personal data described here. We decide what is collected and why.
For questions, requests, or complaints about this notice: support@easylounge.io.
2. What We Collect
2.1 From you, when you join
- Identity and contact: your name and email address.
- Tax residence and status, if you apply for a cash link: the country where you're tax resident, and whether you take part as a business or as a private individual.
- Authentication: your password, stored only as a salted hash by our authentication provider. We never see it.
- Acceptance record: the date, time and version of the Partner Programme Terms you accepted. We keep this to show what you agreed to and when.
- Your application, if you join without a lounge of your own: what you tell us about how you'll refer venues, and a website or profile link if you give one. We use it only to decide whether to approve you.
2.2 From you, if you are paid in cash
Payout details: the method you choose (Revolut or PayPal) and the account handle you give us, so we can send money to it.
Tax details: before your first cash payment, and depending on your tax residence and status, only where a settlement or a tax information statement requires it: for a business, its legal name, registered address and tax identification number; for a private individual resident in Poland, your PESEL number and home address; and evidence of your tax residence where the law applying to you calls for it.
Invoices you issue us, if you take part as a business.
We do not ask for payout or tax details unless you are on the Cash rail, and beyond your tax residence and status we do not ask for them at signup — only before your first withdrawal.
2.3 Generated by your participation
- Your referral code or codes, and the links built from them.
- Your earnings ledger: each commission, the venue it came from, the amount, the rate, when it was earned, when it clears, and how and when it was settled.
- Settlement records: each discount applied or payment sent, with its reference.
- Status: whether your application is pending, approved or declined; whether your participation is active, suspended, or ended; when each decision was made, and the reason we recorded.
2.4 About venues you refer
Your dashboard shows the name of each venue attributed to you, its plan, whether it is paying, and what you earn from it. Where a venue is an individual trading under their own name, that venue name is personal data about them.
We show it because you cannot otherwise identify your own earnings. We show no other information about a referred venue — not its contact details, not its own customers, not its trading figures beyond what you earn.
2.5 What your referral link collects from other people
When someone opens your referral link, we set a cookie in their browser recording your code for ninety days, so we can attribute a signup to you. That cookie is read only by our servers and is not shared with you. That processing concerns the visitor, not you, and is described in the main Privacy Policy.
You should be aware that sharing your link causes that cookie to be set, and should say so where the law applying to you requires you to disclose it.
3. Why We Process It, and On What Legal Basis
| What for | Legal basis (GDPR Art. 6) |
|---|---|
| Reviewing your application to take part | Contract — Art. 6(1)(b), steps you ask us to take before entering into it |
| Creating and running your partner account | Contract — Art. 6(1)(b) |
| Attributing venues, calculating and settling what you earn | Contract — Art. 6(1)(b) |
| Sending you a payment, or applying a discount to your invoice | Contract — Art. 6(1)(b) |
| Keeping accounting and tax records of amounts settled | Legal obligation — Art. 6(1)(c) |
| Deciding how tax applies to a payment, withholding tax, and issuing tax information statements (such as a PIT-11) where the law requires it | Legal obligation — Art. 6(1)(c) |
| Detecting self-referral, fraud, and breaches of the programme rules | Legitimate interests — Art. 6(1)(f) |
| Operational email about your participation | Contract — Art. 6(1)(b) |
Where we rely on legitimate interests, the interest is protecting the programme and our business from abuse. We have weighed this against your rights and consider it proportionate: the checks are limited to the data you and your referrals generate within the Programme, and are not used to build any wider profile of you.
We do not rely on consent for any of the above, and we do not use your partner data for advertising.
4. Self-Referral Checks
To enforce the no-self-referral rule we compare the account that owns a referred venue against your account, and the billing email on that venue's subscription against your email address. This happens automatically when a referral is recorded, and results only in the referral being accepted or rejected — with the reason shown on your dashboard.
5. Who Sees It
We share your personal data only with the processors needed to run the Programme:
- Supabase — database and authentication hosting. Holds your account, your codes, and the earnings ledger.
- Stripe — payment infrastructure. Where you are on the Subscription Discount rail, the discount is applied to your own Stripe customer record and appears as a line on your invoice. Stripe does not receive your partner data where you are on the Cash rail.
- Our email provider — to send you operational messages about your participation.
- Your chosen payout provider (Revolut or PayPal), where you are paid in cash — they receive the handle you gave us and the amount, to make the payment.
Each acts on our instructions under a written data-processing agreement.
We may also disclose personal data where we are legally required to — for example, the Polish tax office receives a copy of any PIT-11 we must issue you — where necessary to establish or defend a legal claim, or to a buyer as part of a merger or sale of assets — in which case we will tell you.
We do not sell your personal data, and we do not share it with advertising networks.
6. International Transfers
Some processors may handle data outside the European Economic Area. Where they do, the transfer is covered by the European Commission's Standard Contractual Clauses or another lawful transfer mechanism. You may ask us which mechanism applies to a particular processor.
7. How Long We Keep It
- Your partner account and codes — while your participation is active, and for the retention periods below afterwards.
- The earnings ledger and settlement records — retained for the period Polish accounting and tax law requires of records supporting amounts paid or credited, currently five years from the end of the tax year in which the settlement occurred. We cannot delete these earlier: they are the record of money moved.
- Your acceptance of the Partner Terms — kept for as long as any claim arising from your participation could be brought.
- Your application and our decision on it — kept with your partner account for as long as it exists. If we decline your application, you may ask us to delete the account, and the application goes with it.
- Payout details — deleted when your participation ends and all settlements are complete, except where a retained record is required above.
- Tax details, invoices and tax information statements — kept with the settlement records they support, for the same period.
- Revoked referral codes — retained rather than deleted, so a code is never reissued to someone else and historic attributions stay explicable.
Where a retention period requires us to keep a record, we will keep only that record and restrict it from further use.
8. Your Rights
Under the GDPR you may:
- Access the personal data we hold about you, and receive a copy.
- Correct it where it is inaccurate or incomplete.
- Erase it, subject to the retention obligations in Section 7 — we cannot delete records of money settled while the law requires us to keep them.
- Restrict processing while a dispute about accuracy or legitimacy is resolved.
- Port the data you gave us, or that your participation generated, in a machine-readable format.
- Object to processing carried out on the basis of legitimate interests, on grounds relating to your situation.
- Withdraw from the Programme at any time. This is a contractual right, not a data-protection one, and is covered by Section 11 of the Partner Terms.
To exercise any of these, email support@easylounge.io. We will respond within one month, and will tell you if we need longer because the request is complex.
You may lodge a complaint with a supervisory authority. Ours is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland — uodo.gov.pl. You may also complain to the authority where you live or work.
9. Automated Decisions
Attribution and commission calculation are automatic and rule-based: they follow the rules in the Partner Terms, not a profile of you. The self-referral check in Section 4 is likewise a rule. Applications to take part are decided by a person, never automatically.
These do not produce legal effects concerning you or similarly significantly affect you within the meaning of Art. 22 GDPR. Where a referral is rejected you are told the reason, and you may ask us to review it — a person will.
Suspending or ending participation for breach is always a human decision.
10. Security
Access to partner data is restricted to those who need it to operate the Programme. Data is encrypted in transit, and at rest by our hosting provider. Passwords are stored only as salted hashes. Payout details are visible only to you and to the people who settle payments.
We will notify you and the supervisory authority of a personal-data breach where the GDPR requires it.
11. Changes to This Notice
We may revise this notice. When we make material changes we will update the version and date above and notify you by email or through the Programme.
12. Contact
SIR PATRYK PEAS (operating as EasyLounge) Address: ul. Długa 57c/45, 53-633 Wrocław, Poland NIP / VAT: PL8982147972 Email: support@easylounge.io Website: https://easylounge.io