ValueAgain Account Privacy Notice

1. Controller and contact

ScalePoint Ventures Oy, Business ID 3620767-9, Almavägen 26, 65610 Mustasaari, Finland, is the controller for the ValueAgain account service ("ValueAgain", "we", "us"). Contact privacy@valueagain.com for privacy questions or requests.

This notice covers the personal cashback account, activations, affiliate attribution, cashback transactions, claims and manual EUR-SEPA bank payouts. The separate Privacy & Cookies notice at valueagain.com/privacy/ covers general visits to the public website and its optional technologies.

2. Data we process

Account and eligibility

We process your email address, authentication method and provider identifier, display name where supplied, preferred language, country of habitual residence, adult-status attestation, declared main travel use, account status, security settings and the versions of legal documents you accepted or acknowledged. The launch service offers personal accounts only, including where a user declares permitted work-related travel.

If you choose Google or Facebook sign-in, the provider sends the provider identifier, email address and basic profile fields shown in that flow. We do not request your posts, contacts or friends. The provider separately processes the sign-in under its own privacy notice. Email sign-in avoids a social identity provider. We do not automatically merge identities only because email addresses match.

Activations, attribution and transactions

We process the partner, offer, market, displayed rate or formula and conditions, activation time, pseudonymous attribution identifier, limited device and security signals, and data reported by an affiliate network or partner. Reported data may include the purchase date, eligible value, commission and cashback amounts, currency, status, and cancellation, return, no-show, refund or rejection information. We do not receive the merchant's complete payment-card data.

Claims and support

We process the related activation, partner, purchase date and amount, order or booking reference, your description, any redacted confirmation, correspondence and outcome. Remove full card or bank information and unrelated traveller data before sending evidence.

Referrals

If you voluntarily join the separately governed referral programme, we process your randomly generated invitation code, a one-time attribution between the referrer and a new account, registration date, qualification deadline, eligible EUR cashback progress, bonus entries and indicators needed to review misuse or reversals. The referrer sees only the number of referred accounts and their own bonuses, not friends' names, email addresses, partners, bookings or cashback amounts. We do not send invitations or read your contacts.

Manual bank payouts

We process the Available balance, requested amount, currency, payout status and history; the submitted account-holder legal name and IBAN; your holder attestation; a masked destination, account fingerprint, verification status and opaque evidence reference; operator approvals; bank references; and reconciliation evidence.

The submitted name and normalized IBAN are encrypted together with authenticated AES-256-GCM encryption before database storage. They are not stored in plaintext in the application database. Ordinary customer, support and review views use masked data. A specifically authorised named finance operator using multi-factor authentication may reveal the destination briefly for verification or transfer execution; each reveal is purpose-limited, expires, is not cached and is audited. ValueAgain's bank receives the recipient data required to execute the EUR-SEPA transfer.

Security and administration

We process login and request metadata, IP-derived security signals where necessary, fraud and abuse indicators, session and system events, role assignments, audit records and incident or support communications needed to protect the service and demonstrate correct handling.

3. Purposes and legal bases

We process data for these purposes and legal bases under Article 6 GDPR:

• Steps at your request and contract performance (Article 6(1)(b)): create and secure your account; assess eligibility; record legal acceptance; activate and attribute offers; calculate and display cashback; administer an optional referral programme accepted under separate terms; investigate claims; maintain balances; and verify, review and execute requested bank payouts.
• Legal obligations (Article 6(1)(c)): keep records and make disclosures required by applicable accounting, tax, sanctions, court, authority or other law.
• Legitimate interests (Article 6(1)(f)): secure accounts and systems; prevent duplicate, manipulated or fraudulent rewards; reconcile partner and bank reporting; troubleshoot and improve reliability; answer ordinary enquiries; and establish, exercise or defend legal claims. We balance these interests against your rights and expectations.
• Consent (Article 6(1)(a)): optional marketing and non-essential website technologies where separately offered. You may withdraw consent prospectively at any time. Consent is not required to receive ordinary cashback service messages.

We do not intentionally request special-category data. Do not include health, identity-document, complete card, complete bank-statement or unrelated traveller information in support or claim material.

4. Sources

We receive data from you; your browser or device; an authentication provider you select; participating affiliate networks and partners; our bank or payout-related verification service; and service providers acting for us. Partner and network information may arrive after your purchase and may later change because of validation, cancellation, return, no-show, refund, chargeback or commission payment. Where data are obtained from another source, this section and the categories in section 2 provide the information required by Article 14 GDPR.

5. Required and optional information

An email address, residence and adult attestations, security data and acceptance of the current terms and acknowledgement of this notice are required to create and operate an account. Without an eligible activation and partner attribution data, we cannot award cashback for a purchase. An account-holder name, IBAN, holder attestation and required verification result are necessary to make a bank payout; without them, Available cashback remains unpaid until a valid method is provided. Social sign-in, optional website technologies and marketing consent are optional.

6. Recipients

Access is limited according to purpose. Recipient categories are:

• infrastructure, hosting, database, authentication, security, monitoring, private evidence-storage and transactional-email providers acting for us;
• the social identity provider you choose;
• participating affiliate networks and partners where necessary to attribute, validate, reconcile or investigate a transaction or claim;
• our bank and any verification or banking provider needed to validate and execute a requested EUR-SEPA payout;
• named authorised personnel and professional advisers subject to confidentiality; and
• courts, regulators, tax, law-enforcement or other authorities where disclosure is lawfully required.

We do not sell personal data. We do not disclose a full bank destination to affiliate partners, ordinary support staff, analytics services or other members.

7. International transfers

We prefer providers and processing locations in the EEA. Some providers or their subprocessors may process data outside the EEA. Where no European Commission adequacy decision applies, we use an appropriate safeguard such as the Commission's Standard Contractual Clauses, together with supplementary measures where required. A copy or description of the applicable safeguard can be requested from privacy@valueagain.com, subject to necessary redactions.

When you follow a partner link or choose a social sign-in provider, that third party may also make transfers under its own privacy notice.

8. Retention

We keep personal data only as long as necessary for the stated purpose, then delete, anonymise or securely destroy it unless a documented legal obligation or legal claim requires restriction and longer retention. We apply these criteria:

• account and preference data: while the account is open and for the short period needed to complete closure, unresolved transactions, rights requests and security checks;
• legal-version acceptances, transaction ledger, payout and accounting evidence: for the period required by applicable accounting, tax and recordkeeping law and any applicable claim period;
• encrypted bank destination: while it is active or needed for an open, dispatched or final payout; an inactive, rejected or replaced destination is restricted and reviewed for deletion once cooling-off, payout, dispute, fraud and security needs have ended;
• activation, attribution, claim and referral data: through partner validation, the referral qualification period, bonus reconciliation, the applicable claim period and any related dispute;
• support and rights-request correspondence: until the request is resolved and for a proportionate period needed to demonstrate the response or handle a claim;
• security and audit records: for a period proportionate to detecting, investigating and evidencing misuse or incidents; and
• consent records: for as long as needed to demonstrate the choice and until related claims are time-barred.

A legal hold may temporarily suspend ordinary deletion for identified records. We do not keep full bank data merely because a masked operational or accounting reference is sufficient.

9. Automated processing

Rules may automatically validate inputs, calculate cashback, match partner reports, prevent duplicate requests or flag unusual activity for review. We do not make a decision based solely on automated processing that produces legal or similarly significant effects. A material or contested fraud, account, cashback or payout decision is subject to authorised human review. You may contact hello@valueagain.com to contest an outcome.

10. Security

Measures include separation of the public and authenticated services, encryption in transit, row-level access controls, purpose-based roles, multi-factor authentication for sensitive administration, pseudonymous affiliate identifiers, private evidence storage, immutable audit records, masked bank data, authenticated encryption for the payout destination, purpose-limited short reveal windows and no-store controls. Access and incidents are reviewed. No internet service can guarantee absolute security.

11. Your rights

Depending on the circumstances, you may request access, correction, deletion, restriction or portability, or object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it at any time without affecting earlier lawful processing. You also have the right to lodge a complaint with a supervisory authority.

Send a request to privacy@valueagain.com or use available in-account controls. We may request proportionate information to confirm identity. We respond without undue delay and normally within one month; where a request is complex or numerous, the GDPR permits an extension of up to two further months and we will explain the extension within the first month. Requests are normally free. Manifestly unfounded or excessive requests may be handled as permitted by law.

Deletion is not absolute. We explain any record that must be restricted and retained for an unresolved payout, legal obligation, fraud prevention, dispute or legal claim. Account and Facebook data-deletion instructions are available at valueagain.com/data-deletion/.

12. Account closure

You may close the account at any time through the account where available or by contacting hello@valueagain.com. Closure stops new activations. We first resolve or preserve outstanding cashback and payout obligations, then delete or anonymise data that is no longer needed and restrict any record retained under section 8. Account closure and a GDPR erasure request are related but legally distinct.

13. Complaints

You may complain to the data-protection authority in your habitual residence, place of work or the place of the alleged infringement. In Finland, the authority is the Office of the Data Protection Ombudsman (tietosuoja.fi). You may contact us first, but this is not required.

14. Changes

We publish the current version and effective date. We communicate material changes appropriately and request a new acceptance or acknowledgement where law or the nature of the change requires it. Published versions and acceptance records are kept as immutable evidence.