Privacy Policy

Track360 Marketplace (“Track360”, “we”, “our”, “us”) operates a curated partner-discovery platform for the iGaming industry, connecting affiliates with brands through reviewed, intelligence-driven matching. Track360 Marketplace is operated by Track360. For any privacy-related question or request, contact us at [email protected].

This policy explains what personal data we collect, why we collect it, how we use and share it, how long we keep it, and what rights you have over it. It applies to every visitor of this site, every affiliate listed on the marketplace, every brand using the platform, and every operator working inside it.

We collect data in three ways:

• Data you give us directly — name, email, company, password (hashed), language, country, traffic channels, verticals and geos you serve, profile photo or logo, and anything else you type into a Track360 form or upload to your profile.
• Data generated by your use of the platform — account events (sign-ins, applications submitted, invites accepted), messages exchanged with other parties on the platform, consent choices, partnership status changes, and audit-trail metadata.
• Data we collect from public sources or partners — for prospects we are evaluating for the marketplace, we may gather publicly available signals (website, social handles, country, traffic channels) from enrichment providers. This material is used strictly for curation; it is never published without the prospect’s consent.

We do not knowingly collect special-category data (health, religion, political views, biometric identifiers). Please do not send us any.

We use personal data only for clearly defined purposes:

• To run the marketplace — create and authenticate accounts, list approved profiles, match brands with affiliates, relay messages between consenting parties, and record state changes for audit.
• To curate quality — operators review prospect and applicant data to decide whether a profile meets marketplace standards. This is the human-in-the-loop layer that keeps the discovery pool high-signal.
• To communicate with you — transactional emails (sign-up, password reset, invitation, partnership updates), replies to support tickets, and — only when you have opted in — occasional newsletter or product updates.
• To safeguard the service — detect and block fraud, abuse, spam, scraping, and brute-force attempts on authenticated endpoints; meet legal and regulatory obligations applicable to iGaming intermediaries.
• To improve the product — measure feature usage in aggregate (only after cookie consent) to understand which surfaces of the marketplace help our partners succeed.

For visitors and users in the European Economic Area, the United Kingdom, and Switzerland, we rely on the following lawful bases under the General Data Protection Regulation:

• Contract (Art. 6(1)(b)) — when we process your data to provide the marketplace service you signed up for.
• Legitimate interest (Art. 6(1)(f)) — for curation of prospect data, fraud prevention, security, and analytics that do not rely on cookies. We have run a documented balancing test for each of these uses.
• Consent (Art. 6(1)(a)) — for analytics cookies, marketing emails, and any optional features that require it. You can withdraw consent at any time without affecting prior processing.
• Legal obligation (Art. 6(1)(c)) — when we must retain or disclose data to comply with applicable law, regulator requests, or court orders.

Track360 is built on a strict separation rule: data flowing through one brand’s private relationships never feeds another brand’s marketplace views, and marketplace intelligence is generated only from marketplace-originated relationships. We disclose personal data only in the following cases:

• Other marketplace participants — your public profile (the parts you have chosen to make public) is visible to other marketplace participants. Messages you send through the platform are visible to the recipient. Performance metrics generated inside a partnership are visible only to the two parties in that partnership.
• Sub-processors — vetted third parties that help us run the service: cloud hosting, transactional email (Postmark), product analytics (PostHog), payment processing (where applicable), customer support, and anti-bot challenge providers. Each sub-processor is bound by a data-processing agreement and may only act on our instructions.
• Legal and regulatory requests — when we are required by law, a court order, or a binding regulatory request (for example, an iGaming licensing authority) we may disclose the minimum necessary data.
• Corporate transactions — in the event of a merger, acquisition, or asset sale, personal data may transfer to the successor entity, which will remain bound by this policy or one materially equivalent.

We do not sell personal data, and we do not share it for cross-context behavioural advertising.

Track360 uses a small number of cookies. Essential cookies (session token, CSRF token, language preference) are required for the platform to function and are always on. Analytics cookies, used to understand how the marketplace is used in aggregate, are only set after you choose “Accept” on the cookie banner. You can change your mind at any time by clearing your browser’s storage for this site or by toggling the choice in your account preferences.

Our analytics provider is configured to respect Do-Not-Track signals and IP-anonymisation; we do not use third-party advertising trackers on this site.

We keep personal data only for as long as it is needed for the purpose it was collected. Concretely:

• Active accounts — for the lifetime of the account plus the period required to handle financial, tax, or regulatory obligations after closure.
• Marketing consent records — for as long as the consent is active plus the period required to evidence its prior existence.
• Audit logs of partnership state changes — for at least the retention period required to honour disputes, typically three to seven years depending on jurisdiction.
• Prospect curation data — until the prospect is either onboarded, rejected, or marked dormant. Rejected and dormant prospect records are deleted on a rolling schedule.

Depending on where you live, you have some or all of the following rights:

• Access — get a copy of the personal data we hold on you.
• Rectification — correct data that is inaccurate or incomplete.
• Erasure — request deletion of your data, subject to legal-retention exceptions.
• Restriction and objection — limit how we use your data, or object to processing based on legitimate interest.
• Portability — receive your data in a structured, machine-readable format.
• Withdraw consent — for any processing that relied on consent.
• Lodge a complaint with your local data-protection authority. For EU residents this is normally the authority of your country of residence; for the UK this is the Information Commissioner’s Office (ICO).

To exercise any of these rights, write to [email protected]. We respond within 30 days, faster where the law requires.

Track360 is operated from servers within the European Union, but some of our sub-processors operate from other jurisdictions, including the United States. Where we transfer personal data outside the EEA, UK, or Switzerland, we rely on the European Commission’s Standard Contractual Clauses (and, where applicable, the UK Addendum or Swiss addendum), supplemented by appropriate technical and organisational safeguards.

We protect personal data with industry-standard measures: TLS in transit, encryption at rest for sensitive fields, hashed and salted passwords (bcrypt), short-lived access tokens, refresh-token rotation, role-based access control, audit logging on all administrative actions, and a least-privilege production database connection. No system is impervious to compromise — if a breach materially affects you, we will notify you and the relevant authorities within the legally required timeframes.

Track360 Marketplace is a business-to-business platform for the iGaming industry and is not intended for anyone under the age of 18. We do not knowingly collect data from minors. If you believe a minor has provided us with personal data, contact us and we will delete it.

We may update this policy from time to time. The date at the top always reflects the most recent change. For material changes, we will give registered users reasonable advance notice — by email or an in-product notice — before the new terms take effect.

Privacy questions, rights requests, and complaints should be sent to [email protected]. For general legal matters see our Terms of Service.