Privacy policy

What this means for you, in short

This summary is provided for convenience and does not replace the full Privacy Policy below.

• We collect only the personal data we need to provide and improve TOSE — to open your account, pay your cashback, run competitions, and send you what you've asked for.
• Affiliate tracking is how you get paid. When you shop through TOSE, a tracked link lets us attribute your purchase so we can credit your cashback. It's core to the service.
• We never sell your personal data. We share it only with the partners needed to run TOSE — affiliate networks, payment providers, sign-in providers, and our infrastructure — and only for that purpose.
• You remain in control of your personal data. You can access, correct, or delete your data, change your marketing choices, and manage cookies at any time.
• We never store or process your full payment card details.

Introduction

This notice explains how The Online Shopping Expert ("TOSE", "we", "us", "our") collects, uses, shares and protects your personal data when you visit our website or app, create an account, earn and withdraw cashback, reveal codes, claim freebies, enter prize draws, take part in our creator programme, or hear from us by email.

Please read it carefully. It also sets out your rights and how to contact us or the regulator if you have a concern.

1. Who we are

The Online Shopping Expert is a trading name of Dome Media Ltd, a company registered in England & Wales (Company No. 15464039), registered office 3rd Floor Hampton Place, 7 Leacon Road, Ashford, England, TN23 4AN.

Dome Media Ltd is the data controller for the personal data described in this notice.

For any privacy question, or to exercise your rights, contact our data protection contact:

data@theonlineshoppingexpert.co.uk, or by post at the registered office above.

You have the right to complain to the Information Commissioner's Office (ICO), the UK regulator for data protection (ico.org.uk). We encourage you to contact us first so we can try to resolve your concern.

2. Changes to this notice

We keep this notice under review and will update it when our practices or the law change. The "last updated" date at the top shows the current version. Where a change is material, we'll tell you, for example by email or a notice on the site. Please keep the personal data you give us accurate and current.

3. The personal data we collect

We collect, use, store and transfer different kinds of personal data, grouped as follows.

Account data — your name, email address, a hashed password (we never store your password in readable form), and the preferences you set: the categories, brands and creators you follow, and your communication settings. If you choose to sign in with Google or Apple, we receive basic profile details from the sign-in provider, such as your name, email address and a profile or account identifier, to create or access your TOSE account.

Cashback and transaction data — your cashback activity (the offers you click through, the resulting tracked transactions), your wallet balances (pending, confirmed, available, paid), withdrawals, and your chosen payout details: your bank account details for transfer, or your PayPal identifier where you choose PayPal. Payments are processed through Stripe; we never store or process your full payment card details. Members receive cashback as a payout to a bank account or PayPal — you don't enter card details to use TOSE.

Tracking and usage data — the click-throughs you make to retailers, the click reference that attributes your purchase to your account so you can be paid, device and cookie identifiers, pages viewed, and how you use the platform.

Competition data — your entries; and, if you win, a delivery address so the prize can be sent to you.

Creator data — if you join the creator programme: your public profile, the content and recommendations you post, your performance figures, and your payout information.

Profile and feedback data — your interests and preferences, survey responses, and any feedback you send us.

Technical data — IP address, browser type and version, time zone and approximate location, operating system, and the device and settings you use to access the platform.

Marketing and communications data — your marketing preferences and how you choose to hear from us.

We also use aggregated data (statistical or demographic data that does not identify you) to understand and improve the service. If we ever combine aggregated data with data that identifies you, we treat the combined data as personal data.

We do not seek to collect special category data (such as health, race or ethnicity, religious beliefs, or sexual orientation), and we do not collect data about criminal convictions, except in the limited circumstances the law allows and where made clear to you.

If you don't provide certain data, for example your email and payout details, we may be unable to open your account, pay your cashback, or fulfil a prize.

4. How we collect your data

Directly from you — when you create an account, set your preferences, reveal a code or claim a freebie, enter a competition, request a withdrawal, take part in the creator programme, complete a survey, send feedback, or contact us.

Automatically as you use the platform — through cookies and similar technologies, server logs, and the click-tracking that attributes your referral to a retailer so your cashback can be credited. See our Cookie Policy.

From third parties —

• Affiliate networks, such as Awin, Impact, Partnerize, CJ, Rakuten, Optimise Media and PartnerStack, report whether your click-through resulted in a qualifying transaction, so we can credit your cashback.
• Retailers, in the limited cases where a transaction needs to be validated or a missing-cashback claim investigated.
• Sign-in providers, including Google and Apple, if you choose to use them to sign in. We receive the account information needed to create or access your TOSE account.
• Analytics providers, such as Google Analytics, where you have consented to analytics cookies.

Using Google to sign in is separate from the use of Google Analytics. Google sign-in is used to authenticate you when you choose that sign-in method; Google Analytics, where used, is an optional analytics service and is only used where you have given the required cookie consent.

5. How we use your data, and our lawful basis

We only use your data where the law allows. The lawful bases we rely on are: performance of a contract with you, legitimate interests, your consent, and legal obligation.

Our legitimate interests mean running and improving our business and keeping it secure, balanced against your rights — we don't use your data this way where your interests override ours, unless we have your consent or the law requires it.

A note on cashback tracking. Attributing your purchases is essential to paying you cashback — it's part of delivering the service you signed up for, so we treat it as necessary for our contract with you. The technologies that make tracking work are strictly necessary to provide that service, so we do not ask for your consent to them and they are not part of your cookie choices. If you choose to block them in your browser, purchases may not track and cashback may not be earned.

6. Automated processing and profiling

We use automated processing in a few limited ways: to attribute your transactions to your account so cashback can be credited, to help detect fraud and protect the platform, and to tailor the offers and content we show you.

We don't make decisions that have a legal or similarly significant effect on you using solely automated means. If that ever changed, we'd tell you and explain your rights first.

7. Marketing

If you choose to receive them, we'll send you marketing emails about offers, codes and our editorial. You decide what and how often when you join, and you can change your mind or unsubscribe at any time — using the link in any marketing email or in your account settings.

We use Klaviyo to send marketing emails and Resend for service and transactional emails. Service messages, for example about your account, a withdrawal, or a prize, aren't marketing and will still be sent.

We will never sell your personal data. Sharing data with an affiliate network to attribute your purchase so you can be paid is part of providing the service — it is not a sale of your data.

8. Cookies and affiliate tracking

We use cookies and similar technologies, which fall into two groups with different rules.

Essential (no consent needed) — login and session, security, and core functionality. This includes the tracking that attributes your purchase to your account so cashback can be credited, which is essential to the service you've signed up for.

Optional (consent) — analytics, preference, and marketing cookies, which we only set with your consent.

You can manage your optional choices any time in cookie settings. Where the tracking that enables cashback relies on cookies you decline, your purchases may not track and you may not earn cashback.

See our Cookie Policy for full detail.

9. Who we share your data with

We share your data only as needed to run the service. Where a provider acts as our processor, we require it to keep personal data secure and process it only for the agreed purposes and in accordance with the applicable data-protection requirements.

• Affiliate networks (e.g. Awin, Impact, Partnerize, CJ, Rakuten, Optimise Media, PartnerStack) — to attribute your transactions via a click reference so you can be paid.
• Retailers — only where needed to validate a transaction or investigate a missing-cashback claim.
• Stripe — to process payments and payouts (member cashback and creator commission out; brand payments in). We never store or process your full payment card details.
• PayPal — where you choose PayPal as a withdrawal method. We hold your PayPal identifier, not card details.
• Sign-in providers — Google and Apple, where you choose to use one of those services to sign in to TOSE. The provider authenticates your identity and makes the account information you have authorised available to us so that we can create or access your TOSE account.
• Our infrastructure and service providers — Cloudflare (hosting, content delivery and security), Supabase (database and authentication, hosted in the UK / EU), and Sanity (our editorial content system).
• Email providers — Resend (service and transactional emails) and Klaviyo (marketing emails, where you've consented).
• Analytics providers — Google Analytics, where you've consented to analytics cookies. This is separate from Google's role as a sign-in provider.
• Prize partners — for competitions, only the winner's details needed to fulfil the prize.
• Professional advisers and authorities — lawyers, accountants, auditors, insurers, and regulators or authorities where we're legally required.
• A buyer or successor — if our business is reorganised, sold or merged, in which case the new owner uses your data as set out here.

We do not sell your personal data.

10. International transfers

We aim to keep your data within the UK or EU. Some of our providers are based in, or may process personal data in, countries outside the UK, including the United States. These may include Cloudflare, Stripe, Google, Klaviyo and Resend.

Google may process personal data in connection with Google sign-in where you choose to use that service. Separately, Google Analytics may process analytics data where that service is enabled and you have consented to analytics cookies.

Where personal data is transferred outside the UK, we make sure it is protected using an appropriate safeguard. Depending on the provider and destination, this may include the destination having UK adequacy status, including the UK Extension to the EU–US Data Privacy Framework where the relevant US organisation participates, or the use of approved contractual protections such as the International Data Transfer Agreement or Standard Contractual Clauses with the UK Addendum.

You can ask us for details of the safeguard used for a particular provider.

11. How long we keep your data

We keep your data only as long as we need it:

• Account data — while your account is active, and for a reasonable period after closure to handle any queries or obligations, after which it is deleted or anonymised.
• Financial and transaction records — generally up to six years after the relevant tax year, to meet UK tax and accounting requirements.
• Marketing data — until you withdraw consent or unsubscribe, after which we stop using it for marketing.
• Competition data — entrant data is minimised after the draw; winner data is kept only as long as needed to fulfil the prize and meet our records obligations.

Where data is no longer needed, we delete it or make it anonymous.

12. How we keep your data secure

We use appropriate technical and organisational measures to protect your data against loss, misuse, and unauthorised access — including access controls, encryption in transit, and limiting access to those who need it.

Stripe handles card data under PCI standards; we never store or process your full payment card details.

We have procedures to handle any suspected data breach and will notify you and the regulator where the law requires.

13. Children

The platform is for adults: you must be 18 or over to hold an account.

We don't knowingly collect data from children. If you believe a child has given us their data, contact us and we'll remove it.

14. Your rights

Under UK GDPR you have the right to:

• Access a copy of the personal data we hold about you.
• Correct data that's inaccurate or incomplete.
• Erase your data, where there's no overriding reason for us to keep it.
• Object to processing based on our legitimate interests, and to direct marketing at any time.
• Restrict our processing in certain circumstances.
• Portability — receive your data in a structured, machine-readable format, or have it sent to another provider, where the right applies.
• Withdraw consent at any time, where we rely on consent. This doesn't affect processing already carried out.

To exercise any right, contact data@theonlineshoppingexpert.co.uk. You won't usually pay a fee, and we'll respond within one month. We'll tell you if a complex request needs longer. We may need to verify your identity first.

You can also complain to the ICO (ico.org.uk) — though we'd welcome the chance to put things right first.

15. Third-party links

Our platform links to retailers' and other third-party sites. We don't control those sites and aren't responsible for their privacy practices.

When you leave TOSE, we encourage you to read the privacy notice of any site you visit.