Clickwise Data Processing Addendum for merchants
Last updated: 23 October 2026.
This Addendum develops point 4 of the section «Clickwise's role» of the Clickwise merchant terms published at https://partners.clickwise.net/en/merchant-terms/ ("the terms"), which merchants accept when they sign up. It forms part of the terms. If it and the terms differ on the processing of visitors' data, this Addendum prevails.
1. Parties and roles
1.1 Operator (processor): this Addendum applies where Clickwise is operated by SOFT DEV FZ LLC (United Arab Emirates); in this Addendum, "Clickwise" means SOFT DEV FZ LLC. It does not cover programs that your agreement places with AFVENTURES NETWORK S.L. (Spain).
- SOFT DEV FZ LLC: licence No. 9485/2016, Fujairah Creative City Free Zone Authority (Media Free Zone); Fujairah – Twin Towers, P.O. Box 4422, Fujairah, United Arab Emirates.
- Privacy contact: privacy@hello.clickwise.net
1.2 Merchant (controller): the merchant that runs its program on Clickwise ("you"). As controller of your site, you inform your visitors and, where the law requires it, obtain their consent before the click identifier is kept.
1.3 Visitor Data: for your visitors' clicks and sales (including the click identifier cwclk and order data), Clickwise acts as your processor.
1.4 Clickwise as controller: Clickwise acts as an independent controller only for its own commission, invoicing, accounting and tax records, for the account data of merchants and affiliates and, on the basis of its legitimate interest, for preventing fraud across its whole network with click signals (such as IP address and user agent, and risk scores derived from them). Its Privacy Policy covers that processing, and this Addendum does not.
2. Instructions and purpose
Clickwise uses Visitor Data only to track, attribute and pay commissions and to prevent fraud in your program, following the terms and this Addendum as your instructions. Clickwise informs you if, in its opinion, an instruction infringes the GDPR. Apart from the processing in section 1.4, it processes Visitor Data otherwise only where Union or Member State law requires it, and informs you first unless that law prohibits it.
3. Confidentiality and security
Clickwise keeps Visitor Data confidential, ensures that the persons it authorises to process it are bound by confidentiality, and protects it with appropriate security measures (Annex II).
4. Service providers (sub-processors)
4.1 You authorise Clickwise generally to use service providers bound by equivalent obligations. The current list is published at https://partners.clickwise.net/legal/subprocessors/ (Annex III).
4.2 Clickwise updates that page at least 14 days before a new provider starts processing Visitor Data. If you ask at privacy@hello.clickwise.net, Clickwise also tells you by email.
4.3 You may object on reasonable data protection grounds within that period. If the objection is not resolved, you may end the affected service.
4.4 Each provider is bound by data processing terms equivalent to these, including safeguards for transfers outside the European Economic Area (the EU Standard Contractual Clauses, or another transfer mechanism the provider has adopted, as shown in the list), and Clickwise remains responsible to you for its providers.
5. Helping you
5.1 Clickwise helps you answer requests from the people concerned. If a visitor writes to Clickwise about Visitor Data, Clickwise forwards the request to you.
5.2 Taking into account the nature of the processing and the information available to it, Clickwise helps you meet your obligations on security, personal data breaches, data protection impact assessments and prior consultation.
5.3 Clickwise tells you without undue delay after becoming aware of a personal data breach affecting Visitor Data. It shares what is known about the breach and adds the rest as it becomes available.
6. When the service ends
Clickwise deletes the data when the service ends, except where the law requires it to keep records.
If you ask in writing at privacy@hello.clickwise.net, Clickwise deletes your visitors' data within 30 days of your request, except records the law requires it to keep. Copies in backups are removed as the backups rotate (Annex II). Records that Clickwise keeps as controller (section 1.4) follow its Privacy Policy. Order reports you sent by email that support commissions Clickwise invoiced are accounting records and are kept for as long as tax and accounting law requires.
7. Information and audits
7.1 Clickwise makes available to you the information necessary to demonstrate compliance with this Addendum: the Addendum, its Annexes and its answers to a reasonable written questionnaire, once a year.
7.2 Only if those answers are not enough, Clickwise allows an audit by you or by an independent auditor you appoint, under these conditions:
- the auditor is bound by confidentiality;
- the audit is carried out with 30 days' written notice, during business hours and at your cost;
- there is no more than one audit a year, unless a supervisory authority requires it or after a personal data breach affecting Visitor Data.
8. International transfers
Where the law requires safeguards for transfers of the data to a country without an adequacy decision (such as the United Arab Emirates), the EU Standard Contractual Clauses (controller to processor) apply and are incorporated by reference. These are the clauses of Commission Implementing Decision (EU) 2021/914, Module Two, with these options:
- Clause 7: applies.
- Clause 9(a): Option 2, with the period in section 4.2.
- Clause 11: the optional language does not apply.
- Clause 13: the supervisory authority under that clause.
- Clauses 17 and 18: Option 1, the law and courts of Ireland.
- Annexes: the Annexes of this Addendum.
If the Clauses and this Addendum conflict, the Clauses prevail.
9. Governing law and language
This Addendum is governed by the laws of Ireland, and the courts of Ireland have exclusive jurisdiction over any dispute about it, without prejudice to Clause 18 of the Clauses (section 8). It is written in English. Translations are provided for convenience; if a translation differs from the English version, the English version prevails.
Annex I: Description of the processing
| Item | Description |
|---|---|
| Data exporter / controller | The merchant |
| Data importer / processor | SOFT DEV FZ LLC (section 1.1) |
| Data subjects | Visitors of the merchant who follow a Clickwise tracking link, and customers whose sales are attributed |
| Personal data | The click data in section 3.3 of the Privacy Policy (click ID cwclk, time, host, campaign, affiliate and link identifiers, destination URL, sub-ID, IP address as received, user agent, Referer and, for /dl/ clicks, the visitor's country); order data in conversion reports (event type, order ID, amounts, commission, currency, click ID, technical data of the reporting request); from the payment-provider notifications you connect (for example Stripe or Lemon Squeezy), only identifiers, amounts, currency, status, mode, dates and the click ID: Clickwise does not keep the buyer's name, email address or postal address from them; order reports you send by email, which can include buyer details (kept in the mailbox; Google Workspace in Annex III) |
| Special categories | None |
| Purpose | Track, attribute and pay commissions and prevent fraud in the merchant's program |
| Frequency and duration | Continuous, while the merchant runs its program on Clickwise; then section 6 |
| Sub-processors | Annex III |
Annex II: Security measures
Only measures described in the Privacy Policy (sections 6, 7 and 9).
- Hosting: application servers, databases, cache and file storage in Google Cloud, region
europe-west1(Belgium); logs in Google Cloud Logging's global location. - Transport: session and CSRF cookies are only sent over HTTPS.
- Credentials:
- service credentials in Google Cloud Secret Manager;
- passwords stored as salted hashes;
- two-factor authentication available, with authenticator secrets stored encrypted.
- Retention of copies:
- backups: the latest 30 of the panel database and the latest 7 of the tracking database, plus 7 days of transaction logs;
- application and request logs of our services (including IP address and user agent of requests), in Google Cloud Logging's global location: 30 days;
- Google Cloud's own audit logs of administrative actions on our infrastructure: 400 days;
- pseudonymised usage events (no names or email addresses; IP addresses shortened; free text scrubbed), in BigQuery in
europe-west1: technical events 90 days and product events 400 days.