Privacy Statement

Contact form

When you submit a message via our contact form, we collect your name and e-mail address to respond to your inquiry. This data is not used for any other purpose. It is sent to our service inbox and automatically deleted from our backend within 4 weeks.

Account registration & profile

When you create a Refybe account, we collect your name, e-mail address, company name, and billing details where applicable. This data is necessary to provide access to the platform, process payments, and send transactional emails (such as invoices and account notifications). We do not use this data for marketing without your explicit consent.

Login via Google or Microsoft

You may choose to sign in using your Google or Microsoft account. In this case, we receive your name and e-mail address from that provider. We do not receive your password and do not store any additional data from your provider account.

Cookies

We only use functional cookies that are strictly necessary to operate the platform, such as keeping you logged in and maintaining your session. No tracking or advertising cookies are placed. Third parties do not have access to these cookies.

Embedded content from other websites

No embedded content from third parties (such as video players or social streams) is used on this website.

Third-party tools

We do not share your personal data with third parties for their own purposes. If we integrate a third-party tool in the future that processes personal data, we will update this policy and notify affected users where required.

Your rights

You have the right to access, correct, or delete your personal data at any time. You may also request a data export. These rights do not apply to data we are legally required to retain (e.g. for financial or legal purposes). To exercise your rights, contact us via our contact page.

Refybe's role as data processor

When a business uses Refybe to run a campaign, that business is the data controller — they determine what data is collected from participants and why. Refybe acts as the data processor: we store and process participant data solely on behalf of, and under instruction from, that client. Our obligations as a processor are set out in our Data Processing Agreement (DPA).

What data is collected

The data collected from participants depends entirely on the configuration chosen by the client (the data controller). This may include your name, e-mail address, phone number, game score, or other information entered in a campaign form. Refybe does not collect participant data beyond what the client has configured.

How participant data is used

Refybe uses participant data only to operate the campaign: recording entries, distributing prizes, and providing the client with campaign results. We do not use participant data for our own marketing, profiling, or any purposes outside the scope of the relevant campaign.

Data retention

Participant data is retained for as long as the client's campaign is active, plus a reasonable period thereafter to allow for prize fulfilment and dispute resolution. Clients may delete participant data from their dashboard at any time. Refybe will fully remove participant data upon written request from the client or upon account termination.

Exercising your GDPR rights as a participant

If you participated in a campaign and wish to exercise your rights (access, correction, deletion, portability), please contact the organisation that ran the campaign — they are the data controller responsible for your data. If you are unable to identify or reach that organisation, you may contact us and we will assist where possible.

Security

All participant data is stored on servers located within the European Union. We apply technical and organisational measures to protect personal data against unauthorised access, loss, or disclosure, in accordance with GDPR Article 32.

Updates to this policy

We may update this privacy statement from time to time. Registered users will be notified of material changes via e-mail or an in-platform notice. The date at the top of this page reflects the most recent update.

Supervisory authority

If you believe we are processing your data unlawfully, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.