Need help applying this to your account?
Contact support and we will keep this article attached to your request.
Overview
Yes. Referral Factory is GDPR compliant. You still need to set up each referral campaign to match your audience, purpose, data, and legal requirements.
Who is responsible for what?
For customer data processed through the platform, Referral Factory acts as the Data Processor. Your organisation is generally the Data Controller. You decide why you collect the data and how you use it.
Referral Factory provides the platform, a Data Processing Addendum, and privacy and security controls. You are still responsible for your campaign's notices, permissions, retention rules, and terms.
What should you check before launch?
Collect only the information you need for the referral journey.
Tell people what happens when they join, what messages they may receive, and how rewards work.
Add campaign-specific Terms & Conditions in Campaign Settings.
Use email verification when participants need to confirm access to an email address.
Review tracking and analytics before enabling tools such as Google Analytics or Facebook Pixel.
Decide how your organisation handles requests to correct or delete data, and confirm with Referral Factory support what happens to related records, exports, and retention requirements.
Where can I find more information?
The Privacy and Cookie Policy explains Referral Factory's privacy practices. The Data Processing Addendum covers customer data, security measures, subprocessors, help with requests about personal data, and incident notification.
Is this legal advice?
No. GDPR obligations vary by country, audience, campaign purpose, and the information you collect. Ask the person responsible for privacy or legal compliance in your organisation to review the campaign when needed.
For the wider launch checklist, read What Legal, Privacy and Compliance Rules Should I Consider for a Referral Program?.