Privacy Policy

1. Controller

Calla Ref GmbH, Austria ("CALLA", "we") is the controller for personal data processed through this partner portal. Contact: contact@callaref.com. Full company details are in the imprint.

2. What we process

• Partner account data — name, e-mail address, company name and VAT ID, sign-in records (legal basis: contract performance, Art. 6(1)(b) GDPR).
• Payout data — IBAN / bank details and billing address you provide to receive referral commission (Art. 6(1)(b); retained 7 years under §132 BAO once a payout occurred).
• Referral & commission data — your referral codes, aggregated referral counts and commission amounts (Art. 6(1)(b), legitimate interest Art. 6(1)(f)).
• Analytics — only with your consent via the cookie banner (Art. 6(1)(a)); nothing non-essential runs before consent. You can change this any time via “Cookie settings” in the footer.

3. Processors

We use Supabase (database & authentication, EU region), Vercel (hosting), PostHog (analytics, EU Cloud, consent-gated), Stripe (subscription billing of referred customers) and Resend (transactional e-mail). Each acts under an Art. 28 data-processing agreement.

We also use Sentry (Functional Software, Inc.) for error monitoring, with EU data residency (Frankfurt). Sentry receives technical error reports only — no session replay and no advertising use. Legal basis: our legitimate interest in a stable, secure service (Art. 6(1)(f) GDPR), so this is not consent-gated.

4. Your rights & how to exercise them

You have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR).

To exercise any of these rights, e-mail contact@callaref.com from your registered partner e-mail address. Requests are fulfilled manually within one month (Art. 12(3)). Data we must keep for legal reasons — payout and billing records under §132 BAO — is retained for 7 years and excluded from erasure (Art. 17(3)(b)).

You may also lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde, dsb.gv.at).