Privacy notes: referral and partner programme

Last updated: October 2026

What this is about

These notes supplement our privacy policy for two programmes: the referral programme for customers and the partner programme for bloggers and creators. Anything not covered here is governed by the privacy policy, in particular your rights (access, rectification, erasure, restriction, objection, data portability, complaint to a supervisory authority).

Controller: WeitLäufer, Alexander Düren, Hochburger Str. 35, 79312 Emmendingen, Germany, info@weitlaeufer.de.

Referral programme

Customers who bought an Agilist receive a personal referral link and code. With the code we store the email address, first name, last name and postcode (the last two only to prevent misuse), language and the time of credits issued. We also transfer the code and link to our newsletter service Brevo so we can include them in emails to subscribers.

If someone buys via a referral link or code, we store with the order which code was used. About 30 days after shipping we check whether the order was kept and compare email, last name and postcode with the referring person to exclude own orders and orders from the same household. The referring person does not learn who bought, they only see the date and status.

Legal bases: Art. 6(1)(b) GDPR (running the programme and issuing credit) and Art. 6(1)(f) GDPR (legitimate interest in preventing misuse). We keep the code data as long as you take part; data attached to orders according to statutory retention periods.

Cookies: When someone opens a referral link, we set the cookies wl_ref (code), wl_ref_n (first name of the referring person for the note on the product page) and wl_ref_gift (chosen free pouch) for 30 days. They deliver the offer requested with the click (free pouch) and are therefore strictly necessary (Sec. 25(2) No. 2 TDDDG).

Partner programme

For the application and the partnership we process first and last name, company, address, email address, your channels, the requested code, tax status, tax number and VAT ID, account holder and IBAN, and the time you accepted the partner terms. The IBAN is stored encrypted. We create a customer account for the partner area.

The purpose is deciding on the partnership, attributing orders, calculating and paying commission by self-billing credit note and bank transfer, and meeting tax obligations. For payouts we share name, IBAN, amount and payment reference with our bank; statements may go to our tax advisers and our accounting software. Partners only see date, basket value and commission for orders, no names or addresses of buyers.

Legal bases: Art. 6(1)(b) GDPR (partner agreement), Art. 6(1)(c) GDPR together with Sec. 147 AO and Sec. 14b UStG (retention of statements, usually ten years). Other data is deleted after the partnership ends once no commission is outstanding. Rejected applications are deleted after we decline.

If someone arrives via a partner link, we set the cookie wl_partner for 30 days only if the person consents to the marketing category in the cookie settings (Art. 6(1)(a) GDPR, Sec. 25(1) TDDDG). It stores the partner code so a later order can be attributed to the partner. Consent can be withdrawn at any time in the cookie settings. If someone enters a partner code at checkout, we attribute the order without a cookie (Art. 6(1)(f) GDPR, legitimate interest in correct settlement with the partner). We only count clicks on partner links as a total per partner and month, without reference to any individual.