Privacy Policy

CashbackPro Legal Center

February 6, 2026

CashbackPro Ltd. Effective Date: February 6, 2026 Last Updated: February 6, 2026 Version: 2.0

Introduction
Definitions
Data Controller Information
Personal Data We Collect
Legal Basis for Processing
How We Use Your Data
Data Sharing and Disclosure
International Data Transfers
Data Retention
Your Rights
Security Measures
Cookies and Tracking Technologies
Children's Privacy
Changes to This Policy
Contact Information
Jurisdiction-Specific Provisions

1. Introduction

CashbackPro Ltd. ("we," "us," "our," or "CashbackPro") operates a global cashback rewards platform accessible at cashbackpro.org (the "Service"). We are committed to protecting your privacy and handling your personal data in accordance with applicable data protection laws, including:

GDPR (General Data Protection Regulation - EU Regulation 2016/679)
CCPA/CPRA (California Consumer Privacy Act and California Privacy Rights Act)
Israel Privacy Protection Law 1981 (as amended)
UK GDPR (UK Data Protection Act 2018)

This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and your rights regarding your data.

By using our Service, you acknowledge that you have read and understood this Privacy Policy.

2. Definitions

For the purposes of this Privacy Policy:

Personal Data: Any information relating to an identified or identifiable natural person.
Processing: Any operation performed on personal data, including collection, storage, use, disclosure, or deletion.
Data Controller: The entity that determines the purposes and means of processing personal data (CashbackPro Ltd.).
Data Processor: An entity that processes personal data on behalf of the Data Controller.
Data Subject: An individual whose personal data is processed.
Consent: Freely given, specific, informed, and unambiguous indication of agreement to processing.
Third Party: Any natural or legal person other than the Data Subject, Controller, Processor, or their authorized representatives.
Cashback: Commission earned by users through affiliate purchases made via our Service.
Affiliate Partner: Third-party merchants (e.g., AliExpress) with whom we have partnership agreements.

3. Data Controller Information

Company Name: CashbackPro Ltd. Registration Number: [To be provided] Registered Address: [To be provided], Israel Email: [email protected] Data Protection Officer (DPO): [email protected] Website: https://cashbackpro.org

4. Personal Data We Collect

We collect personal data in the following categories:

4.1 Data You Provide Directly

Account Registration:

Full name
Email address
Password (encrypted)
Country of residence
Preferred language
Date of birth (for age verification)

Financial Information:

PayPal email address
Stripe account details
Cryptocurrency wallet addresses
Bank account information (if applicable)
Tax identification numbers (when required by law)

Verification Data (KYC/AML):

Government-issued ID documents
Proof of address
Selfie photographs (for identity verification)

Communications:

Support tickets and correspondence
Feedback and survey responses
Email communications with our team

4.2 Data Collected Automatically

Technical Data:

IP address
Browser type and version
Operating system
Device identifiers (device ID, advertising ID)
Screen resolution
Time zone settings
Referral source

Usage Data:

Pages visited
Time spent on pages
Click patterns
Search queries
Features used
Error logs

Tracking Data:

Cookies and similar technologies
Device fingerprints
Session recordings (anonymized)
Heatmaps (anonymized)

4.3 Data from Third Parties

Affiliate Partners:

Order information (order ID, amount, status)
Purchase timestamps
Product categories
Commission amounts
Tracking parameters (sub_id, click_id)

Payment Processors:

Transaction confirmations
Payment status
Fraud risk assessments

Social Media (if you connect accounts):

Profile information
Email address
Profile picture

Anti-Fraud Services:

Risk scores
Device reputation
Behavioral analysis

5. Legal Basis for Processing

We process your personal data based on the following legal grounds (GDPR Art. 6):

5.1 Performance of Contract (Art. 6(1)(b))

Creating and managing your account
Processing cashback rewards
Facilitating withdrawals
Providing customer support

5.2 Legitimate Interests (Art. 6(1)(f))

Fraud prevention and security
Service improvement and analytics
Marketing to existing customers
Network and information security

5.3 Legal Obligation (Art. 6(1)(c))

Tax reporting and compliance
Anti-money laundering (AML) checks
Know Your Customer (KYC) verification
Responding to legal requests

Marketing communications (where required)
Non-essential cookies
Third-party data sharing (where applicable)

You may withdraw consent at any time without affecting the lawfulness of processing based on consent before withdrawal.

6. How We Use Your Data

We use your personal data for the following purposes:

6.1 Service Provision

Account creation and authentication
Tracking affiliate clicks and purchases
Calculating and crediting cashback
Processing withdrawal requests
Sending transactional emails (order confirmations, payment notifications)

6.2 Security and Fraud Prevention

Detecting and preventing fraudulent activities
Verifying user identity (KYC/AML)
Monitoring for suspicious behavior
Protecting against unauthorized access

6.3 Customer Support

Responding to inquiries
Resolving disputes
Investigating complaints
Providing technical assistance

6.4 Analytics and Improvement

Analyzing usage patterns
Improving user experience
Developing new features
Conducting A/B testing
Performance monitoring

6.5 Marketing and Communications

Sending promotional emails (with consent)
Personalized offers and recommendations
Newsletters and updates
Referral program communications

6.6 Legal and Compliance

Complying with legal obligations
Enforcing our Terms of Service
Protecting our legal rights
Responding to legal requests

We share your personal data with the following categories of recipients:

7.1 Affiliate Partners

Who: AliExpress, eBay, and other merchant partners What: Click tracking data, order information, user identifiers Why: To track purchases and calculate cashback Legal Basis: Performance of contract

7.2 Payment Processors

Who: PayPal, Stripe, cryptocurrency payment gateways What: Payment details, transaction amounts, user identifiers Why: To process withdrawals and payments Legal Basis: Performance of contract

7.3 Service Providers

Who: Hosting providers, email services, analytics tools What: Technical data, usage data, contact information Why: To operate and maintain our Service Legal Basis: Legitimate interests

7.4 Anti-Fraud Services

Who: Fraud detection and prevention providers What: Device data, behavioral data, transaction patterns Why: To prevent fraud and abuse Legal Basis: Legitimate interests

7.5 Legal Authorities

Who: Law enforcement, regulators, courts What: Any data required by law Why: To comply with legal obligations Legal Basis: Legal obligation

7.6 Business Transfers

In the event of a merger, acquisition, or sale of assets, your personal data may be transferred to the acquiring entity. We will notify you of any such change. We do not sell your personal data to third parties for their marketing purposes.

8. International Data Transfers

CashbackPro operates globally. Your personal data may be transferred to and processed in countries outside your country of residence, including:

Israel (our primary servers)
European Union (cloud infrastructure)
United States (payment processors, analytics services)

8.1 Transfer Safeguards

For transfers outside the EEA, we use the following safeguards:

Standard Contractual Clauses (SCCs) approved by the European Commission
Adequacy Decisions (for countries deemed adequate by the EU)
Binding Corporate Rules (where applicable)
Your explicit consent (where required)

8.2 Israel Adequacy Decision

Israel has received an adequacy decision from the European Commission, meaning data transfers to Israel are considered to provide adequate protection.

9. Data Retention

We retain your personal data for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

9.1 Retention Periods

Data Category	Retention Period	Legal Basis
Account data (active users)	Duration of account + 3 years	Contract performance
Financial transaction records	7 years	Tax and AML laws
KYC/AML verification documents	5 years after account closure	Legal obligation
Marketing consent records	Until consent withdrawn + 3 years	Accountability
Server logs and analytics	90 days	Legitimate interests
Support tickets	3 years after resolution	Legitimate interests
Fraud investigation data	7 years	Legal obligation

9.2 Account Deletion

When you delete your account:

Personal identifiers are anonymized within 30 days
Financial records are retained for legal compliance (7 years)
Aggregated, anonymized data may be retained indefinitely

10. Your Rights

Under GDPR, CCPA, and other applicable laws, you have the following rights:

You may request a copy of your personal data we hold. You may request correction of inaccurate or incomplete data. You may request deletion of your data, subject to legal retention requirements. You may request that we limit how we use your data. You may request your data in a structured, machine-readable format. You may object to processing based on legitimate interests or for direct marketing. You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. Where processing is based on consent, you may withdraw it at any time.

10.9 Right to Lodge a Complaint

You may file a complaint with your local data protection authority:

EU: Your national DPA (list at https://edpb.europa.eu)
Israel: Privacy Protection Authority (https://www.gov.il/en/departments/the_privacy_protection_authority)
UK: Information Commissioner's Office (https://ico.org.uk)

10.10 How to Exercise Your Rights

Email: [email protected] Subject Line: "Data Subject Rights Request" Include: Your name, email, account details, and specific request Response Time: We will respond within 30 days (GDPR) or 45 days (CCPA).

11. Security Measures

We implement appropriate technical and organizational measures to protect your personal data:

11.1 Technical Measures

Encryption: SSL/TLS for data in transit, AES-256 for data at rest
Access Controls: Role-based access, multi-factor authentication
Firewalls: Network segmentation and intrusion detection
Regular Security Audits: Penetration testing and vulnerability assessments
Secure Development: Code reviews and security testing

11.2 Organizational Measures

Data Protection Policies: Internal policies and procedures
Employee Training: Regular privacy and security training
Confidentiality Agreements: All employees sign NDAs
Incident Response Plan: Procedures for data breach notification
Vendor Management: Due diligence on third-party processors

11.3 Data Breach Notification

In the event of a data breach, we will:

Notify affected users within 72 hours (GDPR requirement)
Notify relevant supervisory authorities
Provide information about the breach and mitigation steps

No security system is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

12. Cookies and Tracking Technologies

We use cookies and similar technologies to enhance your experience. For detailed information, please see our Cookie Policy.

12.1 Types of Cookies

Essential Cookies:

Authentication and session management
Security and fraud prevention
Load balancing

Analytics Cookies:

Google Analytics (anonymized IP)
Usage statistics and performance monitoring

Marketing Cookies:

Affiliate tracking pixels
Retargeting and personalization
Conversion tracking

12.2 Managing Cookies

You can control cookies through:

Browser Settings: Most browsers allow you to refuse cookies
Cookie Consent Tool: Available on our website
Opt-Out Links: For third-party cookies (e.g., Google Analytics opt-out)

Note: Disabling essential cookies may affect Service functionality.

13. Children's Privacy

Our Service is not intended for individuals under 18 years of age (or 16 in the EEA).

We do not knowingly collect personal data from children. If we become aware that we have collected data from a child without parental consent, we will take steps to delete it promptly.

If you are a parent or guardian and believe your child has provided us with personal data, please contact us at [email protected].

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements.

14.1 Notification of Changes

Material Changes:

Email notification to registered users (30 days' notice)
Prominent notice on our website
Updated "Last Updated" date

Non-Material Changes:

Updated "Last Updated" date
Notice on website

14.2 Continued Use

Your continued use of the Service after changes take effect constitutes acceptance of the updated Privacy Policy.

We encourage you to review this Privacy Policy periodically.

15. Contact Information

For privacy-related questions, requests, or complaints:

General Privacy Inquiries: Email: [email protected] Data Protection Officer: Email: [email protected] Legal Department: Email: [email protected] Mailing Address: CashbackPro Ltd. [Street Address] [City, Postal Code] Israel Response Time: We aim to respond within 5 business days.

16. Jurisdiction-Specific Provisions

Legal Representative in the EU: [To be appointed if required] Data Protection Authority: You may lodge a complaint with your national DPA. Data Transfers: We use Standard Contractual Clauses for transfers outside the EEA.

16.2 California (CCPA/CPRA)

California Residents have additional rights: Right to Know: Categories and specific pieces of personal information collected. Right to Delete: Request deletion of personal information (subject to exceptions). Right to Opt-Out of Sale: We do not sell personal information. Right to Non-Discrimination: We will not discriminate against you for exercising your rights. Shine the Light: Request information about data shared with third parties for marketing (if applicable). To Exercise CCPA Rights: Email: [email protected] Subject: "California Privacy Rights Request" Verification: We may request additional information to verify your identity. Authorized Agent: You may designate an authorized agent to make requests on your behalf.

16.3 Israel

Privacy Protection Authority Registration: [Registration number to be provided] Data Breach Notification: We will notify the Privacy Protection Authority within 72 hours of becoming aware of a breach. Data Subject Rights: Israeli residents have rights similar to GDPR, including access, correction, and deletion.

16.4 United Kingdom

ICO Registration: [Registration number to be provided] UK GDPR Compliance: We comply with UK GDPR and the Data Protection Act 2018. UK Representative: [To be appointed if required]

17. Additional Information

17.1 Do Not Track Signals

Our Service does not currently respond to "Do Not Track" (DNT) browser signals. We will update this policy if we implement DNT support in the future.

17.2 Third-Party Links

Our Service may contain links to third-party websites. We are not responsible for the privacy practices of these websites. We encourage you to review their privacy policies.

17.3 Automated Decision-Making

We use automated systems for:

Fraud Detection: Flagging suspicious transactions
Cashback Matching: Matching orders to user accounts

You have the right to request human review of automated decisions that significantly affect you.

Last Updated: February 6, 2026 Version: 2.0 Effective Date: February 6, 2026

Have questions about our policy?

[email protected]