Data Processing Notice

1. Definitions

• "Agreement" means the Tasskel Affiliate Program Terms and any other written terms that govern Affiliate's participation in the Program.
• "Personal Data" means information that identifies, relates to, or could reasonably be linked with an individual or household, including "personal information" under U.S. state privacy laws.
• "Process" means any operation performed on Personal Data, such as collecting, recording, storing, using, disclosing, or deleting it.
• "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data Processed under this Notice.
• "Sub-processor" means a third party engaged by Tasskel to Process Personal Data in connection with the Program.
• "Privacy Laws" means all U.S. federal and state laws that apply to the Processing, including the California Consumer Privacy Act as amended (CCPA) and similar state laws, and — only where they apply to a particular individual — non-U.S. laws such as the EU or UK General Data Protection Regulation.

2. Roles of the parties

Tasskel is responsible for the Personal Data it collects to run the Program — for example, affiliate account, payout, and tax records, and referral tracking data on Tasskel websites. For that data, Tasskel decides how and why it is Processed, as described in our Privacy Policy.

Affiliate is independently responsible for Personal Data it collects from its own audience, website visitors, subscribers, or prospects. When Affiliate submits a prospect's details to Tasskel (for example, through a referral or lead form), Affiliate confirms it has a lawful basis to do so and has given any notice or obtained any consent required by Privacy Laws.

To the extent Tasskel Processes Personal Data on Affiliate's behalf, Tasskel acts as Affiliate's "service provider" or "contractor" under the CCPA (or "processor" where the GDPR applies) and follows this Notice.

3. Purpose and limits on use

Tasskel Processes Personal Data only to operate the Program: tracking and attributing referrals, calculating and paying commissions, preventing fraud, maintaining tax and financial records, supporting affiliates, and complying with law. Categories of data and individuals are listed in Annex 1.

Tasskel will not sell Personal Data, will not share it for cross-context behavioral advertising, and will not use data it Processes on Affiliate's behalf for any purpose outside the Agreement, unless the law requires it. If the law requires other Processing, Tasskel will tell Affiliate first unless the law prohibits that notice.

Tasskel will notify Affiliate if it determines it can no longer meet its obligations under Privacy Laws, and Affiliate may then take reasonable steps to stop and remediate unauthorized Processing.

4. Security

Tasskel maintains reasonable administrative, technical, and physical safeguards appropriate to the nature of the data and the risks involved, designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. A summary of these measures is in Annex 2. By joining the Program, Affiliate acknowledges these measures.

5. Confidentiality

Tasskel limits access to Personal Data to personnel who need it to perform the Program and who are bound by confidentiality obligations.

6. Sub-processors

Affiliate authorizes Tasskel to use the categories of Sub-processors listed in Annex 3. Tasskel requires each Sub-processor, by written contract, to protect Personal Data with obligations at least as protective as this Notice, and remains responsible for their performance.

Tasskel will update Annex 3 before adding or replacing a Sub-processor category. Affiliate may object in writing, with reasonable detail, within 14 days of the update, and Tasskel will make commercially reasonable efforts to address the objection. If it cannot, Affiliate may end its participation in the Program.

7. Where data is processed

Tasskel is based in the United States, and Personal Data is primarily Processed in the United States. Some Sub-processors may Process data in other countries. Where Privacy Laws require safeguards for transfers — for example, data about individuals in the EU or UK — Tasskel will rely on a recognized transfer mechanism such as standard contractual clauses.

8. Security Incidents

Tasskel will notify Affiliate without undue delay after confirming a Security Incident affecting Personal Data related to Affiliate, and within any period required by applicable law. The notice will describe, to the extent known, what happened, the data involved, and the steps Tasskel is taking. Tasskel will take reasonable steps to contain and remediate the incident and will reasonably cooperate with Affiliate's own legal obligations. A notice is not an admission of fault.

9. Requests from individuals

If Tasskel receives a request from an individual to access, correct, delete, or opt out regarding Personal Data that Affiliate controls, Tasskel will direct the request to Affiliate where appropriate. Tasskel will provide reasonable help, taking into account the nature of the Processing, so Affiliate can respond to requests and meet its obligations under Privacy Laws. Requests about data Tasskel controls may be submitted through our Privacy Rights Request form.

10. Retention, return, and deletion

When Affiliate's participation ends, Tasskel will delete or de-identify Personal Data it Processed on Affiliate's behalf within a reasonable period, except where it must keep records to pay earned commissions, meet tax, accounting, or legal obligations, prevent fraud, or resolve disputes. Retained data remains protected by this Notice.

11. Information and audits

On reasonable written request, and no more than once per year unless required by a regulator or after a Security Incident, Tasskel will provide information reasonably necessary to show compliance with this Notice. Requests must be made with reasonable notice, protect Tasskel's confidential information and the security of other affiliates' data, and be at Affiliate's own cost.

12. Liability and precedence

The limitations of liability in the Agreement apply to this Notice. If this Notice conflicts with the Agreement regarding the Processing of Personal Data, this Notice controls for that Processing.

13. Governing law and changes

This Notice is governed by the laws of the State of North Carolina, without regard to conflict-of-law rules, except where Privacy Laws require otherwise. Tasskel may update this Notice to reflect changes in law, the Program, or its Sub-processors; material changes take effect after notice by email or in the affiliate dashboard.

Annex 1 — Data processed

Individuals

Affiliate applicants and affiliates; their authorized signers; referred prospects and customers; visitors who click affiliate links.

Types of data

Names, email addresses, company and website details, application answers, government photo ID images and date of birth; referral links, coupons, sub-IDs, click and conversion times, landing and referring pages, browser type, approximate country, hashed IP addresses; transaction and commission records; payout details; tax form information (with encrypted tax ID numbers); communication preferences; support messages.

Sensitive data

Government photo ID images and date of birth for identity verification; tax identification numbers (SSN/EIN or foreign TIN) for IRS reporting and withholding requirements. Access is limited to authorized staff; tax identification numbers are encrypted at rest.

Purposes

Operating the Program; attribution; commission calculation and payout; fraud prevention; tax and financial recordkeeping; support; communications; legal compliance.

Duration

For the length of the Program relationship, plus any period required to pay earned commissions and meet legal, tax, and accounting obligations.

Annex 2 — Security measures

• Role-based access controls; administrative functions restricted to authorized staff.
• Encryption of data in transit (HTTPS) and encryption of tax ID numbers at rest.
• Private storage for signed agreements, tax forms, and invoices, accessible only through short-lived links after a permission check.
• Hashing of IP addresses in click and signup records; hashed API credentials.
• Signature verification on incoming payment webhooks and signed outgoing webhooks.
• Rate limiting and validation on public forms and tracking endpoints; automated bot filtering.
• Audit logs of administrative changes and sensitive exports.

Annex 3 — Sub-processor categories

Cloud hosting, database, authentication, and file storage

Runs the Tasskel Affiliates website, portal, and records.

Transactional email delivery

Sends account, commission, payout, and support emails.

Tasskel Pay

Processes customer payments and reports referral transactions used to calculate commissions; stores partners’ bank details in its vault and delivers direct-deposit payouts to U.S. bank accounts.

Google Fonts

Loads website fonts from Google; visitors’ browsers connect to Google to request font files.

AI service provider

Powers the Tasskel AI assistant and admin payout-error troubleshooting; requests are configured not to be retained where that option is available.

Contact

Tasskel LLC, P.O. Box 121, Mars Hill, NC 28754 · admin@tasskel.com · Submit a privacy rights request