Make a data request

Last updated 26 August 2026

Which of these are you

Who holds what

AffiliateRail is software that companies use to run their own affiliate programs. If you signed up as an affiliate, or you bought something after clicking an affiliate link, it was that company's program.

They decide why your data is held, and we hold it for them. In UK GDPR terms they are the controller and we are the processor. It matters here for one practical reason: a processor may not decide on its own to hand out or delete a controller's data. So we do not answer a request about their program on their behalf. We pass it to them, and we do it quickly rather than telling you to find them yourself.

Where we are the controller in our own right, which is our own customers' account and billing data and anyone who emails us, we answer directly. That is set out in the privacy policy.

What you can ask for

Under UK GDPR and the Data Protection Act 2018 you can ask to:

• See it. A copy of the personal data held about you, and what it is used for.
• Correct it. Fix anything wrong or incomplete.
• Delete it. Erasure, where no legal obligation requires the record to be kept.
• Restrict it. Stop it being used while something is disputed.
• Take it elsewhere. A machine-readable copy you can hand to someone else.
• Object. Including to any processing based on a legitimate interest.
• Withdraw consent, where consent was the basis, without affecting what happened before.

What we hold, if you are an affiliate

So you know what to expect back rather than being surprised by it: your name and email, your handle, your application and its answers, your links, the clicks and referrals attributed to you, your commissions and payouts, your payout method (encrypted), any tax form you filed (encrypted), messages the program sent you, and a log of actions taken on your account.

For a customer who came through a link: your email and name where the program's billing provider gave them to us, your identifier with that program, and the visit, sale and commission the referral produced.

How to ask

Email support@affiliaterail.com with "data request" in the subject and tell us:

• What you want: a copy, a correction, deletion, or one of the others above.
• Which program, if you know. The company's name, or the portal address you signed in at, or the affiliate link.
• The email address you used with that program, so we can find you. Please write from it if you can.

There is no form to fill in and no account to create. A plain email is a valid request and we treat it as one.

What happens next

1. Within 2 working days we reply and tell you which company runs that program.
2. We pass the request to them, and copy you, so you can see it has gone.
3. They have one month to respond, from the day the request reached them. That is their obligation under UK GDPR, and it can be extended by two months for a complicated request, in which case they have to tell you why.
4. If it is our own data rather than theirs, we skip the middle and answer it ourselves, within the same month.

It is free. Nobody may charge you for this, except for a request that is manifestly unfounded or excessive, which is rare and would be explained rather than simply invoiced.

Proving who you are

We may need to check that you are the person the data is about, because handing someone's data to the wrong person is itself a breach. Usually it is enough to reply from the email address on the account. We will not ask you for a passport to answer a question about an email address.

What deletion does not remove

Being straight about this up front, because finding out later feels like a trick.

Some records survive a deletion request because the law requires them to be kept. Where that applies, the record is kept, restricted so it is not used for anything else, and you are told which records and why. In practice it is:

• Tax forms and the payment records behind them, where a tax authority requires the company that paid you to keep them.
• The amounts of commissions and payouts, kept with your name and details removed, because the program's own accounts have to keep balancing.
• The audit log, including the record that your data was deleted.

Everything else goes: your name, your email, your address, your payout details, your application answers.

If you are not happy

Tell us, or tell the program, and give whoever it is a chance to put it right. You can also complain to the UK's Information Commissioner's Office at ico.org.uk, or to the data protection authority in your own country. You do not have to come to us first, and complaining does not affect any other right you have.

Who we are

James Barkway trading as AffiliateRail
Office 4382, 182-184 High Street North, London, E6 2JA, United Kingdom
support@affiliaterail.com

There is no data protection officer, because the business is not required to appoint one. The address above reaches a person, and that person can act.