Version: 1.2 Effective date: 18 September 2026
Language. This is a translation of the Dutch original. In the event of any discrepancy between this English version and the Dutch version, the Dutch text prevails.
Controller: Jaspers Media (trading as "Klatsa"), established in Limmen, the Netherlands, Chamber of Commerce 02093573, VAT NL002155155B89. Contact: privacy@klatsa.nl
This privacy statement explains how Klatsa processes personal data on the domains app.klatsa.nl (the portal for advertisers, publishers and staff) and to.klatsa.nl (the tracking domain for click redirects and conversion measurement).
For the legal allocation of roles between Klatsa, advertisers and publishers we refer to the Data Processing and Joint Controller Agreement (DPA) at https://klatsa.nl/en/data-processing-agreement.
1. Who we are
Klatsa is the affiliate marketing network of Jaspers Media. We connect advertisers with publishers (websites, apps, mailing lists, social channels) and measure clicks and conversions between the two.
2. When do we process your data
2.1. As a visitor to a publisher site or an advertiser site
When you click an affiliate link offered by Klatsa (a deeplink on to.klatsa.nl), or when you arrive on an advertiser site where Klatsa tracking is active, we may process technical data in order to attribute the click and any conversion to the right publisher.
2.2. As a visitor to app.klatsa.nl
When you visit the portal without logging in, we process minimal logging (server logs) for security purposes.
2.3. As a registered advertiser, publisher or member of staff
We process your account, contact, financial and activity data in order to run the platform, invoice, provide customer service and meet compliance obligations.
3. What data do we process
3.1. Visitors (click and conversion tracking)
| Category | Examples |
|---|---|
| Click identifier | Pseudonymous ULID (Click ID) |
| Technical data | IP address and user agent in hashed form only (the key changes daily), referrer URL, timestamp. The IP address itself is held in working memory for at most 1 hour for the check on VPN and proxy traffic |
| Attribution without a Click ID | A hash of the IP address and user agent with a fixed key, retained for at most 30 days, so that an order without a Click ID can still be attributed to the right publisher |
| Geo derivative | Country/region based on IP — not an exact location |
| Tracking cookie | First-party cookie on to.klatsa.nl, lifetime in line with the Programme (usually a maximum of 90 days) |
| Conversion data | Order number (often hashed), order amount, currency, product category, optionally a customer segment ("new" / "returning" customer) |
We do not process email addresses, name and address details or payment details of end users.
3.2. Account holders (advertisers, publishers, staff)
| Category | Examples |
|---|---|
| Identification | Company name, Chamber of Commerce number, VAT number, contact person |
| Contact | Email address, telephone number, address |
| Account | Login (email), hashed password (bcrypt), 2FA secret if enabled |
| Financial | IBAN, payment history, outstanding balance, invoiced amounts |
| Activity | Login history, IP address at login, audit log of changes in the platform |
| Communication | The content of support tickets and emails with our customer service |
4. Purposes and legal basis
| Purpose | Legal basis (Article 6 GDPR) |
|---|---|
| Measuring clicks and conversions and attributing them to publishers | Consent of the visitor (cookie banner on the publisher or advertiser site, Article 6(1)(a)) and legitimate interest for server-side measurement where consent is not required (Article 6(1)(f)) |
| Managing an advertiser or publisher account | Performance of the contract (Article 6(1)(b)) |
| Commission calculation and invoicing | Performance of the contract and legal obligation (points (b) and (c)) |
| Fraud detection and network security | Legitimate interest (point (f)) |
| Sending transactional email (invoice, account notification, data breach) | Performance of the contract and legal obligation (points (b) and (c)) |
| Marketing email to advertisers and publishers | Consent (point (a)) — opt-out always possible |
| Meeting accounting and tax obligations | Legal obligation (point (c)) |
5. Cookies and similar techniques
5.1. On to.klatsa.nl (the tracker)
We place a single functional first-party cookie containing the Click ID, for the duration of the Cookie Period of the Programme concerned (usually 30 to 90 days, 90 days at most). This cookie is strictly necessary for attributing any purchase to the right publisher, which is the basis of the affiliate business model.
Consent for this cookie is collected by the publisher site or advertiser site you visited. Klatsa only sets the cookie when you click the affiliate link, so setting it is a direct result of your own click.
5.2. On app.klatsa.nl (the portal)
We use session cookies (functional) for login and session management, and optionally a CSRF token cookie for security. No third-party marketing or analytics cookies without prior consent.
5.3. On klatsa.nl (the marketing website)
| Category | Purpose | Consent required |
|---|---|---|
| Functional | Session, CSRF, and remembering your cookie choice (klatsa_consent_v1 in localStorage) |
No — strictly necessary |
| Analytics | Google Analytics 4 — anonymised usage statistics (which pages are visited, from which referrer, on which device). The IP address is truncated by Google before storage. No advertising link, no user profiles, no cross-site tracking. | Yes — opt-in via the cookie banner |
Analytics scripts (Google Analytics) are only loaded after you have expressly agreed in our cookie banner. If you refuse or make no choice, no request is made to Google.
5.4. Managing your preferences
You can change your cookie choice at any time through the "Cookie preferences" link in the footer of klatsa.nl, or by clearing localStorage in your browser. You can also delete cookies through your browser settings. Disabling the Klatsa attribution cookie on to.klatsa.nl means that any purchase will not be attributed to the publisher, but it has no effect on your experience as a visitor.
5.5. Version control of the cookie banner
Each version of our cookie banner has a version number. When we change the policy materially — for example by introducing a new category of cookies, adding a different sub-processor, or changing the purpose of an existing category — we increase that number. Choices made earlier then automatically become invalid and you are given the opportunity to confirm your preferences again.
| Version | Date | Change |
|---|---|---|
| 1 | 4 May 2026 | First version of the category-based consent banner: functional (always on) + analytics (opt-in via Google Analytics 4). Replaces the earlier information banner without formal consent. |
Cosmetic changes to the text, to the order of the buttons or to translations do not increase the version.
6. Who do we share your data with
6.1. Advertisers and publishers within the network
In the context of conversion attribution, the advertiser receives anonymous conversion data (Click ID, order amount) and Klatsa shares the result (conversion successful yes/no) with the publisher it is attributed to. No directly identifying data about end users is shared in the process.
6.2. Sub-processors
We use carefully selected sub-processors; see the current list in Annex C of the DPA at https://klatsa.nl/en/data-processing-agreement. Examples:
- OVHcloud for hosting (Germany, backups in France, EU)
- Postmark for transactional email (US, with EU standard contractual clauses)
- proxycheck.io for recognising VPN, proxy and data centre traffic on clicks (fraud detection). For this the IP address is sent to their servers in Europe (United Kingdom and EU)
- Front (FrontApp, Inc.) for our mailbox and customer service, including requests to privacy@klatsa.nl (US, EU-U.S. Data Privacy Framework and EU standard contractual clauses)
- Sentry for error monitoring (self-hosted, EU, Frankfurt) — the IP address and email address are removed by our software before transmission; only technical error data and a pseudonymous user ID are sent along for debugging
- Google Analytics 4 (Google Ireland Ltd. — only with your consent) for anonymous usage statistics on
klatsa.nl. The IP address is truncated by Google and there is no advertising personalisation. Transfer to the US takes place under EU standard contractual clauses. - Jortt for bookkeeping (Netherlands, EU)
- ABN AMRO for payouts (Netherlands, EU)
6.3. Legal obligations
We share data with authorities (the Tax Administration, the judicial authorities, the Dutch Data Protection Authority) where we are legally required to do so.
6.4. No sale of data
We never sell your personal data to third parties for marketing or profiling purposes.
7. Transfers outside the EEA
As standard we process within the EEA. For sub-processors outside the EEA (such as Postmark and Front in the US) we ensure appropriate safeguards through EU standard contractual clauses in accordance with Article 46 GDPR, or an adequacy decision in accordance with Article 45 GDPR (such as the EU-U.S. Data Privacy Framework and the decision for the United Kingdom).
8. Retention periods
| Data | Retention period |
|---|---|
| Click data (raw) | 13 months, aggregated / pseudonymised thereafter |
| Hash of IP address and user agent (attribution without a Click ID) | 30 days |
| Conversion data | 7 years (tax retention obligation for invoicing) |
| Cookie in the end user's browser | Cookie Period of the Programme (usually a maximum of 90 days) |
| Account and invoicing data | Term of the agreement + 7 years (tax) |
| Audit and login logs | 12 months |
| Support correspondence | 24 months after the last contact |
| Data breach incident register | 5 years |
9. Security
Klatsa takes appropriate technical and organisational measures, including: HTTPS/TLS, hashed password management (bcrypt), optional 2FA, restrictive database access, encrypted backups, error monitoring without PII (IP, email and request body fields are actively stripped by our software before transmission to Sentry), periodic security updates and awareness training. See Annex B of the DPA for details.
10. Your rights
Under the GDPR you have the right to:
- Access the data we hold about you;
- Rectification of incorrect data;
- Erasure (the "right to be forgotten"), unless we are legally required to retain it;
- Restriction of processing;
- Object to processing based on legitimate interest;
- Portability (a data export in a commonly used format);
- Withdraw consent (where processing is based on consent);
- Lodge a complaint with the Dutch Data Protection Authority (
autoriteitpersoonsgegevens.nl).
You can send requests to privacy@klatsa.nl. We respond within one month, with a possible extension of two months where a request is complex.
For requests about processing for which the advertiser or publisher is the controller (for example the cookie on their own site), we will refer you on where necessary, or handle the request together with that party.
11. Changes
We may amend this privacy statement from time to time. The most recent version is always available at https://klatsa.nl/en/privacy. We announce material changes by email to account holders and/or through a banner in the portal.
12. Contact
Jaspers Media — Klatsa Network Email: privacy@klatsa.nl Address: Westerweg 16, 1906 ED Limmen, the Netherlands Chamber of Commerce: 02093573 · VAT: NL002155155B89