This policy describes how AncillaryOffers, Inc. ("we," "us") handles personal data collected through our websites, products, and services. We comply with the GDPR, the CCPA/CPRA, and applicable privacy laws in the jurisdictions we operate.
What we collect
- Account data you provide to us — name, email, employer, role.
- Service data processed on behalf of customers under our DPA.
- Telemetry needed to operate the platform — request logs, performance metrics, error traces.
- Marketing data from forms you submit on our website.
How we use it
We use personal data to operate the service, to support our customers, to comply with our legal obligations, and to communicate with you about products you've requested information about. We do not sell personal data.
Lawful bases
Where the GDPR applies, our lawful bases include the performance of a contract, our legitimate interests, your consent (where required), and compliance with legal obligations. You can withdraw consent at any time without affecting prior lawful processing.
Sharing
We share personal data with subprocessors listed on our subprocessors page, with our customers (where you are their end user), and where required by law.
Retention
We retain personal data for as long as needed to provide the service and to meet our legal obligations. Customer data is retained per the contract; marketing data is retained until you opt out or for 24 months of inactivity.
Your rights
You have rights to access, rectify, erase, restrict processing of, and port your personal data. You can exercise these rights by emailing privacy@ancillaryoffers.com.
International transfers
Personal data may be transferred to the US under the EU-US Data Privacy Framework and Standard Contractual Clauses where applicable.
Contact
Our Data Protection Officer can be reached at dpo@ancillaryoffers.com.
Changes
We update this policy when we change how we handle personal data. Material changes are communicated to designated contacts.