Punkt. Affiliate Programme – Privacy Policy

Last updated: 27/10/2026

At Punkt. we believe that privacy is a right, and we treat the data of our affiliates with the same care we ask of our products. This policy explains what personal data we collect when you take part in the Punkt. Affiliate Programme (the "Programme"), why we collect it and what rights you have. It complements the general privacy policy available at punkt.ch/policies/privacy-policy.

1. Who is responsible

The controller of your personal data is Punkt Tronics AG, Via Losanna, 4, 6900 Lugano, Switzerland ("Punkt.", "we", "us").

Contact for privacy questions: privacy@punkt.ch.

2. What data we collect

We only process the following categories of data where relevant to run the Programme:

Account data: name, email address, country, language, business details, login and authentication information managed by our affiliate platform.
Profile data you choose to share: website, social media handles, audience information, a short description of how you plan to promote Punkt.
Payout data: PayPal email address or bank details, billing name and address, invoices or self-billing records, and, where required for compliance, tax or VAT information.
Programme activity: your referral link and code, referral events, attributed orders references, dates, eligible product values, commission calculations and status, adjustments and payouts.
Communication: messages you send us and our replies and records of Programme support or disputes.
Technical data: IP addresses, browser and device information, timestamps, referring URLs, cookie or similar identifiers, account access records and records of consent or privacy preferences, to the extent used by the Programme.
Review loans: delivery and return contact details, device identifiers and records reasonably needed to administer a review loan, where one is provided.

We obtain data from you, your use of the portal and Programme, our e-commerce and affiliate platforms, payment providers and, where relevant, public information on the professional websites or social media profiles you identify. Referral and order information may be generated when customers interact with Programme links or codes and place orders.

The registration and payout forms identify required fields. Without information necessary to assess an application, operate an account or make payment, we may be unable to provide the relevant part of the Programme.

Programme reports made available to Affiliates are limited to transaction information needed to understand attribution and commission.

We do not disclose names, addresses or contact details of customers who buy through your link or code.

3. Why we use your data and on what basis

We process personal data to assess applications; administer accounts and the Programme; attribute qualifying orders; calculate, validate and pay commissions; organise review loans; provide support; maintain security; investigate fraud and misuse; meet legal obligations; and establish, exercise or defend legal claims.
Under Swiss law, we comply with the processing principles and requirements of the Federal Act on Data Protection. Where a justification is required, we rely on valid consent, an overriding private or public interest, or the law.
Where the EU GDPR or UK GDPR applies, we rely on the following grounds as appropriate:
- Contract and requested pre-contractual steps: assessing an individual’s application and performing the agreement with that individual, including account administration, commission payments and agreed review loans.
- Legitimate interests: administering relationships with business Affiliates and their contacts, protecting accounts and the Programme, preventing fraud, checking commission accuracy and handling disputes and legal claims. We assess these interests against the rights and interests of the individuals concerned.
- Legal obligations: processing required by a legal obligation recognised as a valid basis under the applicable data-protection law. Where an obligation arises under Swiss law but does not qualify for that ground under the applicable GDPR rules, we assess reliance on our legitimate interest in complying with that obligation.
- Consent: optional tracking and marketing where consent is legally required. Cookie-free order attribution and commission reconciliation may be based on our legitimate interest in administering a fair and accurate Programme, subject to applicable law and the rights of customers and Affiliates. The affiliate agreement is not treated as the customer’s consent to tracking.
We distinguish essential account, payment, security and contractual communications from optional marketing about products and campaigns. We send marketing with consent where required, and otherwise only where applicable law permits it. You can unsubscribe or object to marketing at any time without losing access to essential Programme communications.

4. Tracking of referrals

When a visitor clicks your referral link, referral cookies or similar identifiers may be used to connect a later purchase with the relevant Affiliate.

Where prior consent is required, optional referral tracking starts only after the visitor gives that consent. Tracking must also respect the visitor’s applicable privacy preferences. Visitors can refuse or withdraw optional tracking. Refusing optional tracking does not prevent an ordinary purchase, but may mean a referral cannot be recorded.

A valid Affiliate discount code entered at checkout can attribute the order without requiring an Affiliate referral cookie. The code and the associated order information are processed to calculate the discount and commission. Other cookies or technologies used by the website remain subject to the website and cookie notices.

5. Who we share your data with

We disclose personal data only with service providers who help us run the Programme, in accordance with applicable law, under contracts that require them to protect it:

GoAffPro, our affiliate platform, which hosts the affiliate portal and processes account, tracking and payout data on our behalf;
Shopify, which operates our e-commerce platform and supply relevant order information;
payment providers such as PayPal or UBS Switzerland AG, to handle your commission payments;
our accountants and auditors, where required by law.

We may also disclose data to authorities when required by law.

6. International transfers

Some of these providers may process data outside Switzerland or the European Economic Area. In that case we make sure appropriate safeguards are in place, such as the standard contractual clauses recognised by the Swiss Federal Data Protection and Information Commissioner and the European Commission. You may contact us at privacy@punkt.ch for further information about the relevant safeguards or to request a copy, with confidential or unrelated information redacted where appropriate.

7. How long we keep your data

We retain identifiable personal data only for as long as reasonably necessary for the relevant purpose, subject to legal retention requirements and the need to establish, exercise or defend legal claims. In particular:

Unsuccessful or withdrawn applications: normally up to six (6) months after the application process ends, unless a specific legal or fraud-prevention need justifies retaining limited information longer.
Account and profile information: during participation and, where needed to close the account and resolve outstanding matters, for up to twelve (12) months after closure. Information no longer needed is deleted or anonymised earlier.
Commission, payment, invoice and other accounting records required under Swiss law: generally ten years from the end of the relevant financial year, or another period where applicable law requires it.
Records relevant to a specific dispute or legal claim: for as long as necessary to handle that matter and the applicable legal retention or limitation requirements.

Access to information retained only for compliance or legal claims is restricted to those purposes. Deletion arrangements include relevant providers and backup deletion cycles.

8. Your rights

Under the Swiss Federal Act on Data Protection and, where applicable, the EU General Data Protection Regulation, you have the right to:

access the personal data we hold about you;
correct inaccurate data;
ask us to delete your data, unless we must keep it by law;
restrict or object to certain processing, including processing based on legitimate interest;
receive your data in a portable format;
withdraw your consent at any time, where processing is based on consent.

To exercise these rights, write to privacy@punkt.ch. You can also lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or with the competent data protection authority in your country of residence.

9. Security

We use appropriate technical and organisational measures to protect your data, including encrypted connections and restricted access within our team and measures to secure Programme administration and payments. We require appropriate safeguards from providers processing data on our behalf. Access is limited to authorised persons who need it for their responsibilities. If a personal data breach occurs, we assess and make the notifications required by applicable law.

10. Changes to this policy

We may update this policy to reflect changes in the Programme, our processing or applicable law. We will inform you of material changes through the affiliate portal or by email.