Sections
Last updated: 13 October 2026
1. Introduction
Oasisfactor Lda (“Oasisfactor”, “Tagpeak”, “we”, “us” or “our”) is committed to protecting your privacy and personal data.
This Privacy Policy explains how we collect, use, store, share and protect your information when you access or use Tagpeak, including our website at www.tagpeak.com, our mobile applications for iOS and Android, and related services (collectively, the “Platform”).
We process personal data in accordance with the European Union General Data Protection Regulation (“GDPR”) and other applicable data protection laws.
2. Who Is Responsible for Your Data?
The Data Controller responsible for your personal data is:
Oasisfactor Lda
Registered office: Rua Alfredo Allen, Nr. 455, 4200-135 Porto, Portugal
Email: contact@tagpeak.com
Oasisfactor Lda operates the Tagpeak brand and determines how and why personal data is processed in connection with the Platform.
For privacy-related questions or requests, you can contact us at the email address above.
3. Personal Data We Collect
We collect personal data necessary to operate the Platform, administer cashback rewards, process payments, prevent fraud and improve our services.
3.1. Information You Provide
When you register, use your account or contact us, we may collect:
- Name and email address.
- Phone number and postal address, where required.
- Account credentials and authentication information.
- Bank account details, including IBAN, and information required to verify account ownership and process cashback withdrawals.
- Communications, support requests and other information you voluntarily provide.
3.2. Purchase and Cashback Information
To track qualifying purchases and administer rewards, we may process:
- Merchant or partner store information.
- Purchase dates, amounts and transaction identifiers.
- Transaction tracking, validation, cancellation and refund information.
- Cashback amounts, status, evolution, redemption and payment history.
- Loyalty status, referral codes and qualifying referral activity.
Some of this information is received from partner merchants, affiliate networks or other transaction-tracking providers rather than directly from you.
This information is necessary to determine whether purchases qualify for cashback, calculate rewards and process payments.
3.3. Website and Mobile Application Data
When you access our Platform, we may automatically collect technical and usage information, including:
- IP address.
- Device type, operating system, browser type and language.
- Application version and technical identifiers.
- Access dates, session information and pages or features used.
- Performance information, error logs and diagnostic data.
- Cookie and similar technology identifiers, where applicable.
Depending on the functionality enabled in our mobile applications, we may also process notification tokens and associated preferences.
Where advertising identifiers, analytics services or other non-essential tracking technologies are used, we provide applicable disclosures and request consent or permissions where required by law.
3.4. Information from Third Parties
We may receive information from third parties involved in providing our services, including:
- Partner merchants.
- Affiliate networks, such as Awin, CJ and Impact.
- Ecommerce integrations and transaction-tracking providers.
- Payment and banking service providers.
This information is used primarily to track and validate transactions, administer cashback and provide the services requested by users.
4. How and Why We Use Your Data
We process personal data for the following purposes:
Account Management
To create and manage your account, authenticate users and provide the Platform's services.
Legal basis: Performance of a contract.
Purchase Tracking and Cashback Administration
To track purchases, validate transactions, calculate cashback, manage referrals and loyalty benefits, and process withdrawals.
Legal basis: Performance of a contract and, where applicable, compliance with legal obligations.
Security and Fraud Prevention
To detect suspicious activity, prevent fraudulent transactions, protect accounts and maintain Platform security.
Legal basis: Legitimate interests and, where applicable, legal obligations.
Customer Support
To respond to enquiries, resolve disputes and provide assistance.
Legal basis: Performance of a contract or legitimate interests.
Analytics and Service Improvements
To analyse Platform performance, resolve technical issues and improve functionality and user experience.
Legal basis: Legitimate interests or consent where required.
Marketing and Communications
To send newsletters, promotional messages, surveys and product updates where permitted by applicable law.
Legal basis: Consent or another lawful basis permitted by applicable marketing laws.
Personalisation and Advertising
To provide relevant content or advertising where these activities are enabled.
Legal basis: Consent where required.
Legal and Regulatory Compliance
To fulfil applicable accounting, tax, regulatory and other legal obligations.
Legal basis: Compliance with legal obligations.
Where we rely on legitimate interests, we assess these interests against the rights and freedoms of individuals.
Where processing is based on consent, you may withdraw that consent at any time.
We do not sell your personal data to third parties.
5. Cookies and Tracking Technologies
Tagpeak uses cookies and similar technologies on its website and, where applicable, within its mobile applications.
These technologies may be used to:
- Authenticate users and maintain secure sessions.
- Remember preferences and support Platform functionality.
- Enable shopping referrals and purchase attribution.
- Measure technical performance and understand how the Platform is used.
- Support analytics, marketing and advertising activities, where enabled and permitted.
Some technologies are necessary to operate the Platform or support purchase attribution. Others are optional and require consent where applicable.
You can manage website cookies through the consent controls provided on the website, where available, and through your browser settings.
Mobile application permissions and certain tracking preferences can be managed through your device settings or applicable in-app controls.
Disabling or blocking certain technologies, particularly those used for purchase attribution, may prevent qualifying transactions from being correctly tracked and rewarded.
We request any additional permissions required by applicable law or platform rules, including Apple's App Tracking Transparency permission where relevant.
6. How We Share Your Data
We share personal data where necessary to provide our services, fulfil legal obligations or support legitimate business operations.
Recipients may include:
Partner Merchants and Affiliate Networks
To identify purchases, validate transactions, resolve tracking issues and administer cashback.
Payment and Banking Providers
To verify payment information, process withdrawals and comply with applicable financial or legal requirements.
Technology and Service Providers
To support hosting, infrastructure, security, analytics, communications, technical maintenance and other Platform operations.
Public Authorities
Where disclosure is required by law, a valid legal process or a competent regulatory authority.
Service providers acting on our behalf are required to process personal data in accordance with applicable data protection requirements, including contractual safeguards where required.
Some third parties, such as merchants and payment providers, may act as independent data controllers for their own processing activities. Their respective privacy policies may also apply.
We do not sell users' personal data.
7. International Data Transfers
Your personal data may be processed or stored outside Portugal or the European Economic Area (“EEA”) where this is necessary for the operation of the Platform or the use of third-party service providers.
Where personal data is transferred outside the EEA, we apply safeguards required under applicable data protection laws.
These may include:
- European Commission adequacy decisions.
- Standard Contractual Clauses approved by the European Commission.
- Additional technical, organisational or contractual safeguards where necessary.
You may contact us at contact@tagpeak.com for further information about applicable international data-transfer safeguards.
8. Data Retention
We retain personal data only for as long as necessary for the purposes described in this Privacy Policy or as required by applicable law.
Retention depends on the nature of the information and the reason for processing it.
Account Information
Retained while your account remains active and subsequently where necessary to fulfil legal obligations or resolve outstanding matters.
Purchase and Cashback Records
Retained as necessary to administer transactions, validate rewards, process withdrawals, resolve disputes and comply with legal obligations.
Payment and Financial Records
Retained for the periods required under applicable accounting, tax and other laws.
Fraud Prevention and Security Records
Retained for as long as reasonably necessary for security, fraud prevention, investigations or related legal claims.
Marketing Information
Retained while the relevant legal basis continues to apply, including until consent is withdrawn where processing relies on consent.
Technical and Diagnostic Information
Retained according to its operational purpose and applicable legal requirements.
When personal data is no longer required, it will be deleted or anonymised, unless continued retention is legally justified.
9. Data Security
We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, disclosure and misuse.
These measures may include access controls, encryption, secure infrastructure, authentication mechanisms and technical monitoring appropriate to the risks involved.
Access to personal data is limited to authorised personnel and service providers who require it for legitimate operational purposes.
Although we take reasonable steps to protect your information, no digital system or method of transmission can be guaranteed to be completely secure.
10. Your Privacy Rights
Under the GDPR and other applicable data protection laws, you may have the following rights:
Access: Request confirmation of whether we process your personal data and obtain a copy of it.
Rectification: Request the correction of inaccurate or incomplete personal data.
Erasure: Request the deletion of personal data where applicable.
Restriction: Request that certain processing activities be restricted.
Portability: Receive certain personal data in a structured, commonly used and machine-readable format and, where applicable, have it transferred to another provider.
Objection: Object to processing based on legitimate interests or to processing for direct marketing.
Withdrawal of Consent: Withdraw previously granted consent at any time, without affecting the lawfulness of processing conducted before withdrawal.
Automated Decision-Making: Exercise applicable rights relating to decisions based solely on automated processing that produce legal or similarly significant effects.
These rights may be subject to legal conditions and exceptions.
To exercise your rights, contact us at contact@tagpeak.com.
We may request reasonable verification of your identity before responding to certain requests.
We will respond without undue delay and generally within one month, subject to extensions permitted under applicable law.
You also have the right to lodge a complaint with a supervisory authority, including the Portuguese Data Protection Authority (Comissão Nacional de Proteção de Dados, or CNPD), at www.cnpd.pt.
11. Account and Data Deletion
You may request the deletion of your Tagpeak account and associated personal data.
To request account deletion, use the Delete Account option in the mobile application or send an email to contact@tagpeak.com with the subject Account Deletion Request.
We may need to verify your identity before processing your request.
Deleting your account will result in the removal of personal data that we are no longer required or legally entitled to retain.
Certain information may need to be retained for legal, accounting, fraud prevention, dispute resolution or other legitimate purposes permitted by law.
If your account contains pending transactions, active cashback, available balances or outstanding withdrawal requests, we will explain how these are affected before your deletion request is finalised.
Account deletion is not the same as temporarily disabling or deactivating an account.
12. Marketing Communications and Notifications
We may send you communications concerning your account, purchases, cashback, withdrawals, security and other operational matters necessary to provide our services.
We may also send promotional communications, newsletters, surveys or product updates where permitted by applicable law.
You can unsubscribe from marketing emails using the unsubscribe link included in those messages or by contacting us.
Where mobile push notifications are offered, you can manage notification permissions through your device settings.
Opting out of marketing communications will not prevent us from sending necessary service-related messages.
13. Automated Processing and Fraud Prevention
We may use automated systems to support transaction tracking, cashback administration, account security and fraud prevention.
These systems may identify unusual activity, potential tracking errors or transactions requiring further verification.
Where we engage in solely automated decision-making that produces legal or similarly significant effects, we will provide the additional information and safeguards required by applicable data protection law.
You may contact us if you have concerns about how automated processing affects your personal data or your account.
14. Third-Party Websites and Services
The Platform may contain links to websites, applications or services operated by third parties, including partner merchants.
When you leave Tagpeak to complete a purchase, the relevant merchant may collect and process personal data under its own privacy policy.
Tagpeak is not responsible for the privacy practices of independently operated third-party websites or services.
We encourage users to review the applicable privacy policies before providing personal data to third parties.
15. Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes in our services, technology, data-processing activities or applicable legal requirements.
The latest version will be published on our website and made accessible through our mobile applications.
Where changes are material, we will provide additional notice where appropriate or required by law.
The date at the beginning of this Privacy Policy indicates when it was last updated.
16. Contact Us
If you have questions, concerns or requests relating to this Privacy Policy or the processing of your personal data, please contact:
Oasisfactor Lda
Operating under the brand name Tagpeak
Rua Alfredo Allen, Nr. 455
4200-135 Porto, Portugal
Email: contact@tagpeak.com
Website: www.tagpeak.com
