atlataca.comutschland GmbH provides this Data Protection Notice to individuals who are interested in the ATLETICA Affiliate Program, who register for it, or who already participate in it as an affiliate. This Data Protection Notice explains how personal data is processed in connection with registration, onboarding, the management of the affiliate partnership, the processing of commissions, and the related communication.

1. Controller

The controller for the processing of personal data described in this Data Protection Notice, as well as the appointed data protection officer, are:

atlataca.comutschland GmbH Goresstr. 5 55131 Mainz Germany Email: info@atlataca.com

External Data Protection Officer c/o TÜV SÜD Akademie GmbH Westendstraße 160, 80339 München Germany Email: info@atlataca.com

2. Scope

This Data Protection Notice applies to individuals who apply for the ATLETICA Affiliate Program or who participate in this program as an affiliate.

The Affiliate Program is directed exclusively at entrepreneurs within the meaning of § 14 of the German Civil Code (BGB) established in Germany or another Member State of the European Union.

3. Categories of personal data processed

3.1. Data processed as part of the application procedure

As part of the application procedure, ATLETICA processes personal data that is necessary to assess suitability for the Affiliate Program and to determine whether the requirements for participation are met. Depending on the information provided in the application form, this may include, in particular, the following data:

• First and last name
• Email address
• Full business address
• Telephone number
• Date of birth, insofar as this is necessary to comply with tax transparency or reporting obligations
• URL of the website and/or social media profile
• Further platform or social media URLs, if provided voluntarily
• Content category and geographic target audience, if provided voluntarily
• Number of followers or subscribers, as well as information on interaction or reach, if provided voluntarily
• Sample posts or corresponding links, as well as free-form information on motivation, if provided voluntarily
• Tax status, tax number and/or VAT identification number
• Confirmation of entrepreneur status (B2B confirmation)

3.2. Data processed as part of participation in the Affiliate Program

If an application for the Affiliate Program is accepted, ATLETICA additionally processes the personal data that is necessary for the performance of the contractual relationship and the processing of commission payments. This includes, in particular:

• Bank details (e.g. IBAN and BIC) or the email address linked to the PayPal account
• Information on commissions generated as well as their processing status
• Contract-related communication with the affiliate

3.3. Data processed during participation in the Affiliate Program

During participation in the Affiliate Program, ATLETICA and the service providers engaged process operational data regarding the use of the affiliate account and the performance of the affiliate partnership. This includes, in particular:

• Clicks on affiliate links
• Orders attributed to the affiliate
• Commissions generated as well as their status (e.g. pending, approved or refunded)
• Information on the affiliate account as well as the payout history
• Email correspondence with the affiliate manager, including communication via service@atlataca.com.

4. Purposes of processing and legal bases

ATLETICA processes personal data for the purposes set out below and on the basis of the respective applicable legal bases pursuant to Art. 6 DSGVO:

Purpose of processing	Legal basis
Review of the application and assessment of whether the applicant and the content provided are suitable for the Affiliate Program	Art. 6 Abs. 1 lit. b DSGVO, as the processing is necessary for the performance of pre-contractual measures taken at the request of the data subject.
Verification of whether the applicant meets the requirements for participation as an entrepreneur	Art. 6 Abs. 1 lit. b DSGVO; insofar as tax-related verification or documentation obligations exist, additionally Art. 6 Abs. 1 lit. c DSGVO.
Management and performance of the affiliate partnership	Art. 6 Abs. 1 lit. b DSGVO.
Processing of commission payments as well as the associated accounting processes	Art. 6 Abs. 1 lit. b DSGVO as well as, insofar as this is necessary to comply with statutory accounting and tax obligations, Art. 6 Abs. 1 lit. c DSGVO.
Compliance with statutory tax, commercial and accounting retention and documentation obligations	Art. 6 Abs. 1 lit. c DSGVO.
Communication with applicants and affiliates	Art. 6 Abs. 1 lit. b DSGVO.
Temporary retention of data from rejected applications after completion of the application procedure	Art. 6 Abs. 1 lit. f DSGVO. The legitimate interest lies in the establishment, exercise or defense of legal claims.

5. Recipients of personal data

Insofar as this is necessary for the purposes described above, personal data may be transmitted to the following categories of recipients:

• GoAffPro Inc. as a processor and technical platform provider of ATLETICA for affiliate tracking, affiliate dashboards and reporting. GoAffPro processes personal data in connection with the Affiliate Program exclusively on documented instructions from ATLETICA and for the purposes determined by ATLETICA.
• Internal specialist departments of ATLETICA involved in the management of the Affiliate Program, in particular accounting as well as the responsible contact persons in the affiliate or marketing area.
• External tax advisors, insofar as they support the preparation of credit notes or the accounting and tax processing.
• Payment service providers or banks, insofar as this is necessary for the payout of commissions.
• Authorities and tax authorities, insofar as disclosure is required on the basis of statutory obligations.

6. International data transfers

ATLETICA engages GoAffPro Inc., a company based in India, as a processor for the technical management of the Affiliate Program. This includes, in particular, the registration of affiliates, the provision of the affiliate dashboard, tracking, reporting, and the management of commissions. (Link to GoAffPro's privacy policy: https://goaffpro.com/privacy)

In this context, personal data is processed within GoAffPro's infrastructure. Access to personal data by GoAffPro employees in India, in particular for the purposes of technical support and maintenance, cannot be entirely ruled out.

Since this involves a transfer of personal data to a third country for which no adequacy decision by the European Commission exists, ATLETICA ensures that appropriate safeguards pursuant to Art. 46 DSGVO are in place. In particular, ATLETICA has concluded a data processing agreement with GoAffPro pursuant to Art. 28 DSGVO and has agreed on the Standard Contractual Clauses of the European Commission. These are supplemented by appropriate technical and organizational measures.

7. Storage period

Unless longer statutory retention obligations apply, personal data is only stored for as long as this is necessary for the purposes described in this Data Protection Notice. Currently, the following storage periods apply in particular:

• Data from rejected applications: deletion no later than six months after the rejection.
• Data of active affiliates: storage for the duration of the contractual relationship.
• Tax-relevant documents, including credit notes and data on commission payouts: generally ten years in accordance with the statutory tax retention obligations.
• Contract-related documents and business correspondence: generally six years in accordance with the statutory commercial and tax retention obligations.
• Marketing or statistical data used for performance analyses: insofar as possible and appropriate, this is anonymized after termination of the contractual relationship.

Insofar as personal data is required beyond the aforementioned periods for the establishment, exercise or defense of legal claims, it will be stored until the respective matter has been concluded.

8. Obligation to provide personal data

The provision of the personal data marked as required as part of the application or onboarding is necessary in order to review the application, determine the requirements for participation in the Affiliate Program, establish the contractual relationship, and process commission payments. If the required data is not provided, ATLETICA may not be able to properly review the application or to establish and perform the affiliate contractual relationship.

9. Rights of data subjects

Under the DSGVO – subject to the respective statutory requirements – data subjects have, in particular, the following rights:

• Right of access to the personal data processed by ATLETICA.
• Right to rectification of inaccurate personal data or completion of incomplete personal data.
• Right to erasure, provided that the statutory requirements are met.
• Right to restriction of processing.
• Right to data portability, insofar as the statutory requirements are met.
• Right to object to processing based on Art. 6 Abs. 1 lit. f DSGVO, on grounds relating to the particular situation of the data subject.
• Right to lodge a complaint with a competent data protection supervisory authority. For atlataca.comutschland GmbH, the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate (LfDI Rheinland-Pfalz) is, in particular, responsible.

10. Automated decision-making

ATLETICA does not use the personal data of applicants or affiliates for automated decision-making within the meaning of Art. 22 DSGVO, including profiling, that produces legal effects concerning the data subject or similarly significantly affects them.

In particular, neither admission to the Affiliate Program nor the management of the affiliate partnership takes place exclusively on the basis of automated decision-making.

As of: 22.07.2026