Privacy Policy
Referon Limited – www.www.referon.com
Draft Version 2.0 – prepared for legal review. Supersedes published Version 1.1
(effective 25 December 2022). https://www.www.referon.com/privacy-policy
Please read this Privacy Policy carefully and ensure that you understand it. This Privacy Policy is intended to give you a better understanding of the personal data we collect, the reasons why we collect it, the manner in which we process it, the entities with whom we share it, your rights in relation to that data, and any other matter relating to the privacy and security of your personal data.
We understand that your privacy is important to you and that you care about how your personal data is used and shared online. We respect and value the privacy of everyone who visits our Website and who interacts with us, and we will only collect and use personal data in the ways described here and in a manner consistent with our obligations and your rights under applicable law.
Under applicable law we are required to comply with personal data protection and processing requirements to ensure that your data is at all times stored and processed securely and that your rights as a data subject are observed and protected. We take these obligations seriously and have implemented technical and organisational measures designed to protect your privacy.
All processing of personal data described in this Privacy Policy is carried out in line with the following laws and regulations, together with any binding acts amending or implementing them (collectively, the “Data Protection Laws”):
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the General Data Protection Regulation, or “GDPR”);
- the Cypriot Law providing for the Protection of Natural Persons with regard to the Processing of Personal Data and for the Free Movement of such Data of 2018 (Law 125(I)/2018), as well as any subsidiary legislation issued under it, as amended from time to time; and
- the Cypriot legislation implementing Directive 2002/58/EC (the “ePrivacy Directive”), in so far as it governs our use of cookies and similar technologies and our sending of electronic direct marketing.
Our Website is operated by Referon Limited, a company incorporated in Cyprus with its registered address at 4 Promitheos Street, 3rd floor, 1065 Nicosia, Cyprus.
Referon Limited determines the means and purposes of the processing of personal data described in this Privacy Policy and therefore acts as the “data controller” for the purposes of the Data Protection Laws. Section 14 explains the more limited role we play in relation to personal data processed inside the ReferOn platform on behalf of our clients.
For any question about this Privacy Policy, or to exercise any of your rights, you can contact us by email at privacy@referon.com or by post at 4 Promitheos Street, 3rd floor, 1065 Nicosia, Cyprus, marked for the attention of our privacy contact.
This Privacy Policy applies to our processing of your personal data in connection with:
- your use of this Website at www.www.referon.com, and of our sub-domains, including our help centre at help.www.referon.com;
- your use of our enquiry, contact and demo request forms;
- our communications with you, including by email, telephone, video call and messaging applications;
- our marketing activity, including newsletters, campaigns, advertising and outbound business-to-business outreach;
- our attendance at, and your interaction with us during, industry conferences, trade shows and webinars;
- our recruitment activity and your job applications;
- testimonials, case studies and other marketing content in which you agree to take part; and
- our pages and profiles on third-party platforms such as LinkedIn, YouTube and Instagram, in respect of the personal data for which we act as controller.
Our Website contains links to, and embedded content from, other websites and platforms. We have no control over how your data is collected, stored or used by those third parties, and we recommend that you review their privacy policies before providing any data to them.
This Privacy Policy does not cover personal data that we process on behalf of our clients inside the ReferOn platform, or any relationship that is governed by a separate privacy notice or data processing agreement. See Section 14.
Legal obligation
We may process your personal data where this is necessary for compliance with a legal or regulatory obligation to which we are subject, for example obligations arising under tax, accounting, corporate, employment or anti-money laundering legislation, or in order to respond to a lawful request from a competent authority.
Contractual necessity
We may process your personal data where this is necessary for the performance of a contract to which you are party, or in order to take steps at your request prior to entering into a contract – for example, arranging and delivering a product demonstration you have requested, or preparing a commercial proposal.
Legitimate interests
A legitimate interest exists where we have a business or commercial reason for processing personal data. Before relying on a legitimate interest we balance that interest against your interests, rights and freedoms, and satisfy ourselves that our interest is compelling and that the processing does not create a disproportionate risk to you. Our legitimate interests are identified for each category of data in Section 5.
You have the right to object to processing carried out on the basis of a legitimate interest by contacting us at privacy@referon.com. We will consider every objection carefully, and if we are not in a position to meet your request we will tell you why. We will always honour an objection to processing for direct marketing purposes.
Legal claims
We may process your personal data where this is necessary for the establishment, exercise or defence of legal claims.
Consent
We may process your personal data where you have given us your consent to do so. We rely on consent in particular for: non-essential cookies and similar tracking technologies; electronic direct marketing where consent is required by law; the use of testimonials, photographs, recordings and case study content in which you appear; and the retention of recruitment data in a talent pool. Where we rely on consent, you may withdraw it at any time by contacting us at privacy@referon.com or by using the opt-out mechanism provided. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.
The sections below set out the categories of personal data we process, where we obtain them, the purposes for which we process them and the corresponding legal bases. Some categories may be processed on more than one legal basis and for more than one purpose.
(a) Contact data
What this includes: your full name, email address, telephone or mobile number, postal address, the organisation you represent, your job title, and any messaging handle you choose to give us (for example WhatsApp, Telegram, Skype or LinkedIn).
Where we obtain it: from you, when you complete a form on the Website, email or call us, message us on a messaging application or professional network, give us a business card or badge scan at an event, or contact us by any other means; and from the sources described in Section 6.
Why we process it: to respond to your enquiries and demo requests; to arrange and follow up on meetings and demonstrations; to provide you with information about our offers, industry events, product news and other content that may be relevant to your role; and to respond to job applications and keep you informed about vacancies.
Legal basis: legitimate interests (responding to enquiries, developing our business and maintaining professional relationships, and recruiting qualified individuals); steps taken at your request prior to entering into a contract, and performance of a contract, where applicable; and consent where required for electronic direct marketing.
(b) Identity data
What this includes: your full name, the organisation you represent, your job title and seniority, and the country or market in which you operate.
Where we obtain it: from you, or from the sources described in Section 6.
Why we process it: to identify who we are dealing with, to route your enquiry to the right team, and to make our communications relevant to your role.
Legal basis: legitimate interests (responding to enquiries and communicating relevantly with business contacts); contractual necessity where applicable.
(c) Business and commercial data
What this includes: the organisation you represent, its brands and target markets, your role in relation to its affiliate programme, the affiliate platform you currently use, the size or stage of your affiliate operation, the objective you select when you contact us (for example launching a new business, migrating an existing brand, or exploring the product), your preferred communication channel, and any other commercial information you provide in our forms or in conversation with us.
Where we obtain it: from you, through our enquiry and demo request forms and in the course of our communications with you.
Why we process it: to assess whether and how our product fits your requirements; to prepare relevant demonstrations, proposals and commercial terms; to prioritise and route enquiries internally; and to analyse demand in aggregate so that we can develop our product and commercial offering.
Legal basis: steps taken at your request prior to entering into a contract; and legitimate interests (assessing and responding to commercial enquiries, and developing our product and commercial offering).
(d) Communications data
What this includes: the content and metadata of your communications with us – messages submitted through our forms, emails, messages sent through messaging applications and professional networks, notes of telephone calls, video calls and meetings, and support requests or tickets submitted through our help centre.
Where we obtain it: from you, in the course of communicating with us.
Why we process it: to answer your questions, provide support, maintain a record of our dealings with you, train our team and improve the quality of our service.
Legal basis: legitimate interests (managing communications, providing support and maintaining accurate business records); performance of a contract where applicable.
(e) Marketing and campaign data
What this includes: your subscription status and communication preferences; whether you have opened our emails and which links you clicked (collected using tracking pixels and tagged links); the campaign, channel, advertisement or referral source through which you reached us, including URL campaign parameters; your interactions with our newsletters, posts, webinars and advertisements; and the status, segment and notes recorded against your record in our customer relationship management system.
Where we obtain it: from you; automatically, through tracking technologies in our emails and on our Website; and from the advertising and social platforms we use.
Why we process it: to send you communications relevant to your role; to measure whether those communications are useful and how our campaigns perform; to avoid contacting you repeatedly or with irrelevant material; and to plan our marketing activity.
Legal basis: consent, where consent is required for electronic direct marketing or for the tracking technologies used to collect the data; and otherwise our legitimate interests (marketing our products to existing and prospective business contacts, and measuring the effectiveness of that marketing). You may object or unsubscribe at any time – see Section 8.
(f) Prospect data obtained from sources other than you
What this includes: your name, job title, employer, professional profile, business email address and business telephone number, the market and platforms your organisation works with, and publicly stated information about your professional activity.
Where we obtain it: publicly accessible sources such as company websites, professional networking platforms (in particular LinkedIn), industry media, public registers and licensing authority listings; third-party business contact and lead-generation providers; attendee, exhibitor and delegate listings and networking applications operated by the organisers of industry events; and referrals from mutual contacts.
Why we process it: to identify organisations that may benefit from our product, and to contact you in your professional capacity with information about it.
Legal basis: legitimate interests (business-to-business direct marketing to professional contacts whose role makes our product relevant to them). We have assessed this interest against your interests, rights and freedoms and consider that contacting you at your place of work, about a product relevant to your professional responsibilities, with a clear means of opting out, does not override them. Where consent is required for a particular channel, we obtain it.
We contact you in your professional capacity only. We do not seek out or process special categories of personal data for this purpose, and we do not carry out this activity in relation to individuals acting in a personal capacity. If you do not wish to hear from us, tell us at privacy@referon.com or reply to any message asking us to stop, and we will cease contacting you. We may keep the minimum information necessary on a suppression list so that we do not contact you again in error.
(g) Event data
What this includes: your name, job title, employer and contact details, together with notes of our conversation, where you visit our stand, exchange a business card with us, allow your badge to be scanned, or connect with us through an event networking application.
Where we obtain it: from you at the event, and from the event organiser or its networking application.
Why we process it: to follow up on conversations begun at the event and to continue a commercial discussion.
Legal basis: legitimate interests (following up on professional contacts made at industry events); consent, where a badge scan or networking connection constitutes your consent under the organiser’s terms.
(h) Employment and qualifications data
What this includes: your full name, contact details, employment history, education and qualifications, and other information relevant to the assessment of your application, including anything contained in your CV or covering letter.
Where we obtain it: from you, when you submit an application, CV or enquiry; from third parties, such as referees you nominate and recruitment agencies; and from publicly accessible professional sources.
Why we process it: to assess your candidacy for a role with us, to communicate with you during the recruitment process, and, where you agree, to consider you for future vacancies.
Legal basis: steps taken at your request prior to entering into an employment contract; legitimate interests (recruiting qualified individuals); consent, where we retain your details in a talent pool after a recruitment process has concluded.
(i) Testimonial, case study and marketing content data
What this includes: your name, job title, employer, photograph, video or voice recording, and any quotation or statement you provide, where you agree to give a testimonial, take part in a case study, appear in a video, webinar or podcast, or be photographed or filmed at an event.
Where we obtain it: from you, or from your employer where it has arranged your participation.
Why we process it: to produce and publish marketing and reference materials about our product.
Legal basis: consent, which you may withdraw at any time by contacting privacy@referon.com. On withdrawal we will remove the material from channels under our control, although we may be unable to recall copies already distributed or cached by third parties.
(j) Other information you provide to us
What this includes: any other information you choose to share with us.
Why we process it, and on what basis: this depends on the nature of the information. If it does not relate to any purpose or legal basis set out in this Privacy Policy, it will be deleted and not processed further. The initial processing necessary to review such information, determine the applicable purpose and legal basis, or delete it, is carried out on the basis of our legitimate interests (providing accessible contact channels to the public).
(k) Activity data
What this includes: your activity on the Website – the pages you visit, the links and buttons you click, the videos you play, the forms you begin and complete, the time and duration of your visit, and the page from which you arrived.
Where we obtain it: automatically, through cookies and similar technologies, as described in Section 17.
Why we process it: to understand how the Website is used, to measure the reach and performance of our content and campaigns, and to improve the Website.
Legal basis: consent, where this data is collected through non-essential cookies or similar technologies; and otherwise our legitimate interests (operating, evaluating and improving our Website and our commercial communications).
(l) Technical data
What this includes: traffic data, IP address and approximate location derived from it, information provided by your browser, computer or mobile device when you access the Website, and device and network information.
Where we obtain it: automatically, when you access the Website.
Why we process it: to operate and secure the Website; to detect, prevent and investigate fraudulent or malicious activity; to maintain the stability and availability of the Website; and to evaluate its reach and performance.
Legal basis: legitimate interests (operating and securing our Website and ensuring its stability); consent, where the data is collected through non-essential cookies or similar technologies.
We obtain personal data from the following sources:
- directly from you, when you complete a form, contact us, meet us at an event, apply for a role or otherwise communicate with us;
- automatically, when you use the Website, through cookies and similar technologies (Section 17);
- from your colleagues or employer, where they provide your details as a contact point;
- from publicly accessible sources, including company websites, professional networking platforms, industry media, public registers and regulatory listings;
- from third-party business contact and lead-generation providers;
- from event organisers, including attendee and exhibitor listings and networking applications;
- from referees you nominate, in a recruitment context; and
- from our group companies and commercial partners.
We may send you information about our products, product updates, industry events at which we will be present, newsletters and other content relevant to your professional role, by email, telephone, professional networking platforms and messaging applications where you have given us the relevant handle.
Every marketing email we send contains a link allowing you to unsubscribe. You can also opt out at any time, from all or from particular types of communication, by writing to privacy@referon.com. We will action your request without undue delay. We may retain a minimal record of your objection on a suppression list, so that we can ensure you are not contacted again; that record is kept for the purpose of honouring your objection and for no other purpose.
Where we rely on your consent for marketing, you may withdraw it at any time by the same means.
As a data subject you have the following rights, which this Privacy Policy and our processing have been designed to uphold. Please contact us at privacy@referon.com for more information or to exercise any of them:
- the right to be informed about our processing of your personal data, and the right to access the personal data we hold about you;
- the right to rectification, if any of the personal data we hold is inaccurate or incomplete;
- the right to erasure – that is, to ask us to delete the personal data we hold about you;
- the right to restrict our processing of your personal data;
- the right to object to processing carried out on the basis of our legitimate interests, and an absolute right to object to processing for direct marketing purposes, which we will always honour;
- the right to withdraw your consent at any time, where our processing is based on consent, without affecting the lawfulness of processing carried out before the withdrawal;
- the right to data portability – to obtain a copy of the personal data you have provided to us in a structured, commonly used and machine-readable format, and to have it transmitted to another controller. We will provide such a copy free of charge unless the request is manifestly unfounded or excessive, in which case a reasonable administrative fee may be charged;
- rights in relation to automated decision-making and profiling, as described in Section 13; and
- the right to lodge a complaint with a data protection supervisory authority. The supervisory authority for Cyprus is the Office of the Commissioner for Personal Data Protection. Without limiting this right, we would ask you to raise any concern with us first, so that we have the opportunity to resolve it.
We will respond to any request without undue delay and in any event within one month of receipt, although we may extend that period by up to two further months where the request is complex or where we have received a number of requests from you, in which case we will tell you and explain why. We may need to ask you for information to verify your identity before we act on a request.
Our commitment to protecting personal data is delivered through both technical standards and organisational discipline. Personal data processed by us is protected using industry-standard security processes and systems. Data is held on encrypted storage and with certified data centres. Our storage environment and those of the data centres we use are certified to the ISO/IEC 27001 information security management standard. Communication between the Website and your browser is secured using HTTPS, and access to personal data within our organisation is restricted to those personnel who need it in order to perform their role.
Despite the measures we take, no party can guarantee the absolute security of an internet connection. Data sent over the internet may be transmitted across international borders even where the sender and the recipient are located in the same country. We cannot be held responsible for anything done or omitted in relation to your personal data before that data reaches us.
We do not keep your personal data for longer than is necessary for the purposes for which it was collected. The following retention periods apply:
| Retention period | Category of data | Rationale |
|---|---|---|
| Enquiry, demo request, business and communications data | for the duration of the relationship and for 24 months after the last meaningful interaction | Commercial cycles in this market are long; a prospect may return after an extended period |
| Prospect data obtained from other sources | 12 months from collection if no engagement follows, then deleted | Data with no engagement loses accuracy and its retention is harder to justify |
| Marketing and campaign data | Until you unsubscribe or object, and thereafter only the minimum needed for suppression | To honour your objection |
| Suppression list entries | Retained for as long as we carry out marketing | Necessary to ensure you are not contacted again |
| Recruitment data | 6 months after the conclusion of the process, or longer with your consent for a talent pool | Handling of any subsequent query or claim |
| Contract, invoicing and accounting records | the statutory retention period applicable in Cyprus | Legal obligation |
| Website analytics data | the retention period configured in the analytics tool | Set within the tool |
| Retention period | Enquiry, demo request, business and communications data | Prospect data obtained from other sources | Marketing and campaign data | Suppression list entries | Recruitment data | Contract, invoicing and accounting records | Website analytics data |
|---|---|---|---|---|---|---|---|
| Category of data | for the duration of the relationship and for 24 months after the last meaningful interaction | 12 months from collection if no engagement follows, then deleted | Until you unsubscribe or object, and thereafter only the minimum needed for suppression | Retained for as long as we carry out marketing | 6 months after the conclusion of the process, or longer with your consent for a talent pool | the statutory retention period applicable in Cyprus | the retention period configured in the analytics tool |
| Rationale | Commercial cycles in this market are long; a prospect may return after an extended period | Data with no engagement loses accuracy and its retention is harder to justify | To honour your objection | Necessary to ensure you are not contacted again | Handling of any subsequent query or claim | Legal obligation | Set within the tool |
We may share your personal data with competent authorities having jurisdiction over us. Such disclosures will only be made where permitted or required under the Data Protection Laws or other legislation applicable to us.
We may share your personal data with other companies in our corporate group – our parent, subsidiary and sister companies – which will process it on our behalf on the grounds and for the purposes set out in this Privacy Policy.
We also use the following categories of third-party service providers, which act as our processors and may process your personal data on our instructions: website hosting and content delivery providers; form and landing page providers; customer relationship management and marketing automation providers; analytics and advertising providers; video hosting providers; help desk and knowledge base providers; outbound outreach and business contact data providers; cloud infrastructure and storage providers; and our lawyers, auditors, accountants and other professional advisers, whom we may engage from time to time and who may need access to personal data in order to advise us.
The principal providers we use are:
| Provider | Purpose | Primary place of processing |
|---|---|---|
| Webflow, Inc. | Website hosting and content management | United States |
| Heyflow GmbH | Enquiry and demo request forms on the Website | Germany / EU |
| Amazon Web Services | Cloud infrastructure and storage | European Union |
| CRM and marketing automation provider (understood to be HubSpot, Inc.) | Customer relationship management, email marketing, campaign measurement | United States / EU |
| Recruitment data | 6 months after the conclusion of the process, or longer with your consent for a talent pool | Handling of any subsequent query or claim |
| Google Ireland Limited / Google LLC | Website analytics, tag management, advertising and measurement, business email and file storage | European Union / United States |
| Meta Platforms Ireland Limited | Advertising and conversion measurement pixel | European Union / United States |
| LinkedIn Ireland Unlimited Company | Advertising, conversion tracking, page analytics and professional outreach | European Union / United States |
| Provider | Webflow, Inc. | Heyflow GmbH | Amazon Web Services | CRM and marketing automation provider (understood to be HubSpot, Inc.) | Recruitment data | Google Ireland Limited / Google LLC | Meta Platforms Ireland Limited | LinkedIn Ireland Unlimited Company |
|---|---|---|---|---|---|---|---|---|
| Purpose | Website hosting and content management | Enquiry and demo request forms on the Website | Cloud infrastructure and storage | Customer relationship management, email marketing, campaign measurement | 6 months after the conclusion of the process, or longer with your consent for a talent pool | Website analytics, tag management, advertising and measurement, business email and file storage | Advertising and conversion measurement pixel | Advertising, conversion tracking, page analytics and professional outreach |
| Primary place of processing | United States | Germany / EU | European Union | United States / EU | Handling of any subsequent query or claim | European Union / United States | European Union / United States | European Union / United States |
Some of the providers described in Section 11 are established outside the European Economic Area, or process personal data outside it, principally in the United States. Where we transfer personal data outside the EEA, we do so only where the transfer meets the requirements of the Data Protection Laws, and in particular where one of the following applies:
- the European Commission has decided that the recipient country, or a certification framework applicable to the recipient, ensures an adequate level of protection – including, where relevant, the EU-US Data Privacy Framework;
- the transfer is governed by the European Commission’s Standard Contractual Clauses, supplemented where necessary by additional technical and organisational safeguards identified through a transfer impact assessment; or
- another derogation permitted under Chapter V of the GDPR applies.
You may request further information about the safeguards applied to a particular transfer, and a copy of the relevant documentation, by writing to privacy@referon.com.
We do not take decisions based solely on automated processing that produce legal effects concerning you or that similarly significantly affect you.
We do carry out limited profiling for marketing and analytical purposes. This includes grouping business contacts by role, organisation, market or platform in order to send relevant communications; measuring how contacts engage with our content in order to judge what is useful; and allowing the advertising platforms described in Section 17 to show you advertisements based on inferred professional interests. This activity has no legal or similarly significant effect on you, and you may object to it at any time by contacting privacy@referon.com or by adjusting your cookie preferences.
This Privacy Policy concerns personal data for which Referon Limited acts as controller – broadly, data about visitors to the Website, prospective and existing clients, event contacts and job applicants.
Separately, we license the ReferOn affiliate management platform to operators, who use it to run their own affiliate programmes. Personal data processed within that platform – for example data relating to our clients’ affiliates and their end users – is processed by us as a processor, on the documented instructions of the client, which is the controller of that data. That processing is governed by the data processing agreement between us and the client, not by this Privacy Policy. If you are an affiliate or an end user of an operator that uses ReferOn, and you wish to exercise rights in relation to your data, you should contact that operator in the first instance.
The Website and our products are directed at businesses and business professionals. They are not intended for, or directed at, children, and we do not knowingly collect personal data relating to children through the Website. If you believe that a child has provided us with personal data, please contact us at privacy@referon.com and we will delete it.
We may update this Privacy Policy from time to time, for example to reflect changes in the way we operate, in the technologies we use or in the law. Any updated version will be posted on this page with a new version number and effective date. Where the changes are material, we will take reasonable steps to bring them to your attention, which may include notifying you by email. We recommend that you review this page periodically.
When you visit or access our Website, or interact with our content (together, the “Services”), we and third parties authorised by us use cookies, pixel tags, beacons, local storage and similar technologies (“Tracking Technologies”). These allow information to be collected automatically about you, your device and your online behaviour, in order to operate the Services, improve their performance, perform analytics, and – where you have agreed to it – show you content and advertising that is more likely to be relevant to you.
Tracking Technologies placed by us are referred to as first-party technologies. Those placed by third parties whose content or services run on our Services – for example our analytics providers, advertising partners and video hosts – are referred to as third-party technologies. Both types may persist only for the duration of your visit, or across repeat visits.
Strictly necessary Tracking Technologies are placed automatically, because the Services cannot function without them; we do not need your consent for these. All other Tracking Technologies – functional, performance and analytics, advertising and social media technologies – are placed only after you have given your consent through the cookie banner presented when you first visit the Website.
You can change or withdraw your consent at any time using the “Cookie settings” link in the footer of the Website. Withdrawing consent will not affect the lawfulness of any processing carried out before you withdrew it.
- Strictly necessary – placed automatically when you access the Services. They are essential to allow you to navigate the Website and use its features, and to keep it secure and available. Consent is not required for these.
- Functional – these allow the Services to remember choices you make, such as your language or your position in a multi-step form, and to provide enhanced features.
- Performance and analytics – these collect information about your use of the Services, including pages viewed, duration of visit and content engagement, and are used for analytics, research and statistics, generally in aggregate.
- Marketing and advertising – these are used to deliver advertising relevant to your inferred professional interests, to limit the number of times you see a particular advertisement, and to measure the effectiveness of our campaigns. They are generally placed by advertising platforms and provide them with insight into the people who see and interact with our advertising.
- Social media and embedded content – our Website includes links to, and content embedded from, third-party platforms, including LinkedIn, YouTube, Instagram and Vimeo. Where you interact with that content, or in some cases simply where it loads, the provider may set its own technologies. Your interaction with those features is governed by that provider’s own privacy policy.
The table below lists the Tracking Technologies used in connection with our Services. For further information about a third-party technology, please consult the provider’s own privacy documentation.
| Name | Provider | Category | Purpose and duration |
|---|---|---|---|
| _ga | Performance | Distinguishes unique users by assigning a randomly generated identifier, used to calculate visitor, session and campaign data. Duration: 2 years | |
| _ga_[container ID] | Performance | Used by Google Analytics 4 to persist session state. Duration: 2 years | |
| _gcl_au | Marketing | Used by Google to store and track conversions attributed to advertising. Duration: 3 months | |
| _fbp | Meta | Marketing | Used by Meta to deliver advertising and to measure and attribute campaign performance. Duration: 3 months |
| bcookie, lidc, li_gc, UserMatchHistory, li_fat_id | Marketing / functional | Set by the LinkedIn Insight Tag and by embedded LinkedIn content, for advertising, conversion measurement and platform functionality. Duration: session to 2 years | |
| vuid, player | Vimeo | Performance / functional | Set by the embedded video player to store viewing preferences and analytics. Duration: session to 2 years |
| VISITOR_INFO1_LIVE, YSC | YouTube (Google) | Marketing / functional | Set where YouTube content is embedded, to estimate bandwidth, track views and support advertising. Duration: session to 6 months |
| __cf_bm and similar | Cloudflare / hosting | Strictly necessary | Bot management and Website security. Duration: 30 minutes |
| Webflow and Heyflow session identifiers | Webflow / Heyflow | Strictly necessary / functional | Support the operation of the Website and the multi-step enquiry forms. Duration: session |
| Name | _ga | _ga_[container ID] | _gcl_au | _fbp | bcookie, lidc, li_gc, UserMatchHistory, li_fat_id | vuid, player | VISITOR_INFO1_LIVE, YSC | __cf_bm and similar | Webflow and Heyflow session identifiers |
|---|---|---|---|---|---|---|---|---|---|
| Provider | Meta | Vimeo | YouTube (Google) | Cloudflare / hosting | Webflow / Heyflow | ||||
| Category | Performance | Performance | Marketing | Marketing | Marketing / functional | Performance / functional | Marketing / functional | Strictly necessary | Strictly necessary / functional |
| Purpose and duration | Distinguishes unique users by assigning a randomly generated identifier, used to calculate visitor, session and campaign data. Duration: 2 years | Used by Google Analytics 4 to persist session state. Duration: 2 years | Used by Google to store and track conversions attributed to advertising. Duration: 3 months | Used by Meta to deliver advertising and to measure and attribute campaign performance. Duration: 3 months | Set by the LinkedIn Insight Tag and by embedded LinkedIn content, for advertising, conversion measurement and platform functionality. Duration: session to 2 years | Set by the embedded video player to store viewing preferences and analytics. Duration: session to 2 years | Set where YouTube content is embedded, to estimate bandwidth, track views and support advertising. Duration: session to 6 months | Bot management and Website security. Duration: 30 minutes | Support the operation of the Website and the multi-step enquiry forms. Duration: session |
You can manage your consent at any time through the “Cookie settings” link in the footer of the Website.
In addition, most browsers accept cookies automatically but can be configured to refuse them or to notify you before a cookie is stored. Please consult your browser’s guidance for details. Disabling cookies entirely may reduce the functionality of parts of the Website. Guidance is available for Google Chrome, Microsoft Edge, Mozilla Firefox, Safari on desktop and mobile, and the Android browser.
You can also opt out of certain third-party advertising cookies through the Network Advertising Initiative, through the Digital Advertising Alliance opt-out programme at www.aboutads.info/choices, through www.youronlinechoices.eu for users in the EU and EEA, and through www.aboutads.info/appchoices for mobile devices.
If you have any question about the Website or this Privacy Policy, or if you wish to exercise any of your rights, please contact us by email at privacy@referon.com or by post at 4 Promitheos Street, 3rd floor, 1065 Nicosia, Cyprus. Please make your request as clear as you can, particularly where you are asking for information about the data we hold.
For media requests and press enquiries, please contact press@referon.com.
In this Privacy Policy, the following terms have the following meanings:
“personal data” means any information relating to an identified or identifiable natural person – that is, a person who can be identified, directly or indirectly, from that information. Where used here it means personal data that you provide to us or that we collect or obtain in the circumstances described in this Privacy Policy. This definition incorporates the definition given in the GDPR.
“data controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
“data processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
“processing” means any operation or set of operations performed on personal data, whether or not by automated means, including collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
“Data Protection Laws” has the meaning given in Section 1.
“GDPR” means Regulation (EU) 2016/679, the General Data Protection Regulation.
“Tracking Technologies” has the meaning given in Section 17.
“Website” means this website at https://www.www.referon.com/, together with our sub-domains.
“we”, “us” and “our” mean Referon Limited, as described in Section 2.
“you” and “your” mean you, the individual using the Website or otherwise interacting with us.