Affiliate Program Privacy Notice
Version 2026-08-v1. This notice explains how Time2Show, Inc. ("we") processes personal data of participants in the Vesteri Affiliate Program. It supplements our general Privacy Policy at www.vesteri.com/en/privacy-policy.
Controller
Time2Show, Inc., 1111B S Governors Ave STE 20579, Dover, DE 19904, USA. Contact for privacy matters: privacy@vesteri.com.
What we collect
- Identity and contact data: first name, last name, email, phone number.
- Account data: password (stored hashed), affiliate code, account status, login timestamps.
- Program data: sales recorded against your code, sale dates, property reference, commission and discount amounts, payout status.
- Payment and tax data you provide for payout: bank details, invoice details, tax identification (only when a payout is due).
- Consent records: the terms version you accepted, the date, and your marketing preference.
Why and on what legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Creating and running your account, generating your code, recording sales, calculating and paying commission | Performance of a contract with you (6(1)(b)) |
| Keeping records of consents, payouts and invoices | Legal obligation (6(1)(c)) — accounting and tax law |
| Preventing fraud and abuse of the Program, keeping an activity log | Legitimate interest (6(1)(f)) — protecting our business and other participants |
| Sending you Program news and Vesteri offers by email | Consent (6(1)(a)) — optional, withdrawable at any time |
Who receives your data
Our hosting, database and email providers acting as processors under Article 28 contracts: Cloudflare, Inc. (hosting, database and web analytics) and HubSpot, Inc. (website analytics and CRM tracking). Banks and payment providers when we pay you. Tax authorities where required by law. We do not sell your data and do not share it with property sellers.
International transfers
[IF ANY PROCESSOR OR THE CONTROLLER IS OUTSIDE THE EEA: We transfer data to [COUNTRY] under [EU adequacy decision / Standard Contractual Clauses]. A copy of the safeguards is available on request.] [IF NONE: Your data is stored and processed within the EEA.]
How long we keep it
- Account and program data: for the duration of your participation and 12 months after, unless a claim is pending.
- Payout, invoice and tax records: for the retention period required by applicable accounting law ([e.g. 5 or 10] years).
- Consent and activity logs: for the same period as the data they relate to.
- Marketing consent: until you withdraw it.
Your rights
You can ask us to access, correct, delete or restrict your data, object to processing based on legitimate interest, receive your data in a portable format, and withdraw consent at any time (this does not affect processing before withdrawal). Write to privacy@vesteri.com. We respond within one month. You can complain to your national data protection authority; in Poland this is the President of the Personal Data Protection Office (UODO), https://uodo.gov.pl.
Data about investors
When Vesteri records a sale against your code, we store at most a short reference label and a property reference. We do not show you investors' personal data in your dashboard.
Security
Passwords are stored as salted hashes, sessions are protected with secure cookies, and access to program data is restricted to authorised Vesteri staff.