Genting Group has become the latest tier one operator to partner with affiliate landing page tracker, Rightlander, as it looks to improve affiliate compliance and  strengthen its responsible gambling measures.

Rightlander’s technology scans affiliate websites, simultaneously building a list of locations where an operator’s brand is mentioned or linked to while also searching for certain events and conditions defined by the operator.

These can be inclusive or exclusive and specific to the individual operator. The technology also captures images and the content of anchor text used to link to the operator’s brands and creates a variety of custom reports and alerts for the operator

This will help Genting discover affiliate websites linking to its brands that they are currently unaware of, allowing it to ensure the affiliates sending traffic to its sites are acting responsibly.

Rightlander also allows operators to set automatic “compliance violation events” that notify these whenever they occur on any of the websites linking to their brands.

By using Rightlander, Genting can demonstrate to the UK Gambling Commission and other regulators that it is doing all it can to ensure the affiliates sending traffic to its websites are acting responsibly.

Ian Sims, founder of Rightlander, said: “Compliance is a key consideration for operators now and moving forwards. The Rightlander platform makes this process easy and efficient, and ensures operators can be confident that the affiliates they are working with are fully compliant with the rules and regulations they must adhere to.”

Robert Wakeham, head of affiliates at Genting, said: “We take compliance very seriously. This has allowed us to improve our monitoring process, and to significantly boost compliance as a result.”

The partnership with Genting comes shortly after Rightlander striking similar deals with the likes of LeoVegas and GVC, as well as with ALEA for its SlotsMillion and LadyLucks brands, the bgo Group for its roster of online casino sites and the Kindred Group.

Data collection has become an essential part of the operations of most organisations, especially those operating online. While it is effective, it has also given rise to a number of concerns surrounding how that data can both be misused, and become the target of theft.

This GDPR is a new legislative agenda that aims to improve the safety of individuals’ data, as well as regulate how that data is collected, processed and used.

As of the 25th of May, businesses of all shapes and sizes, will need to ensure that they are fully compliant with this new legislation if they serve customers (have traffic) originating from the EU – and affiliates are no exception.

The purpose of affiliate sites is to drive traffic to merchants and operators in order to earn a commission. The more savvy of affiliates, will collect data in numerous ways in order to be able to remarket to their users, if not only to understand their users better, improve customer journey, and in turn, conversion rates.

The data collected on those users most likely falls under the realms of GDPR, and with some heavy penalties of up to €20,000,000, or 4% of annual turnover, it isn’t just another ‘inconvenience’ that should be ignored.

How to Ensure Compliance

Understand what Personal Information is

Personal information includes obvious data such as name, email address and phone number. Many affiliates won’t collect this kind of data, unless they at least have a newsletter subscription form on their website. However, it’s likely that all affiliates have some kind of website tracking/analytics software installed on their website.

Under GDPR’s definition of personal data, it includes “any information relating to an identified or identifiable natural person”.

It then continues to explain that “an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”.

Note the use of the terms “identification number”, “location data” and “online identifier”. Under GDPR, collection of IP addresses and the storing of cookies could be deemed to be deserving of consent from the individual prior to collection, if that data could be used to identify them. Note also, that it doesn’t necessarily mean personally identifying them – if cookies are being used to create a ‘profile’ on an individual, which is being processed on subsequent visits or across websites, then that is deemed as identifying them.

Obtain Consent

The key to the GDPR’s vision is the role of consent. Consent must be obtained from all individuals prior to collecting data on them that could be used to identify them “directly, or indirectly”, as well as an explanation as to the purpose for processing that data.

Consent must be “clear and distinguishable from other matters” and “provided in an intelligible and easily accessible form”. This means that it can no longer be hidden away in the midst of a website’s T&Cs, and in fact it must be entirely separate and written in clear and plain language.

The request for consent can be included in a Privacy Policy, however, a timestamp of when consent was given, as well as details of what the individual was consenting to (i.e. version of privacy policy), must be recorded for audit purposes. Therefore, an “opt-in” style checkbox or similar must be presented to users before any data collection can commence. Furthermore, pre-ticked boxes or “opt-out” options are no longer permitted, and as a minimum, a link to the full request for consent (privacy policy) must be presented.

All affiliates should review their privacy policies (or create one if they don’t already have one), and ensure it complies with GDPR.  The request for consent must explain what data is being collected, why it’s being collected, how it will be used, and how long it will be kept for.

If affiliates’ privacy policies and “opt-in” practices don’t satisfy the condition of GDPR, then reconfirmation or re-permission must be obtained.

Users should also have the ability to easily opt-out or close their account with immediate effect if they no longer wish to be subscribed or for their data to be used. It must be “as easy to withdraw consent as it is to give it”.

What does this mean for cookies, and website analytics software?

If the cookies set by your analytics software are collecting data that will be used across websites (i.e. for advertising), then you must obtain consent from users before using it. The standard Google Analytics code doesn’t have Advertising Features turned on, and so technically it doesn’t even fall under the ‘Cookie Law’.

Affiliates should limit the features and data they collect to an absolute minimum. E.g. if they don’t need or use demographic reports in Google Analytics, then they should disable Advertising Features. Relying on consent should be avoided at all times where possible.

Provide Access to Data

Individuals will have the right to request a copy of the data held on them under GDPR. Requests must be fulfilled within 1 month, and the data supplied free of charge, in an easily accessible, understandable, and electronic format. They also have the right to correct or amend any information they see as inaccurate.

Affiliates should therefore prepare for the eventuality that one of their users exercises such a request.

Right To Be Forgotten

Individuals will also have the power to request that any information held on them be deleted. This will most certainly include personally identifiable data held in affiliates’ databases and 3rd party tools, but will also include any data which is ‘linked’ to from affiliates’ systems. For example, Google Analytics has a feature allowing the linking of User IDs and tracking cookies. The purpose is to track users across devices, and count them as the same user, rather than 2 or more unique users. Google have announced a tool which allows deletion of any data linked to such User IDs.

Improve Security

Security should be a top priority anyway, even a before GDPR was on the horizon. Nevertheless, affiliates should review their website security and ask themselves what they are doing to prevent a breach, as well as the ways in which data could be stolen/abused in the event of a breach. Historically only passwords were encrypted, however there is now more of a case than ever to encrypt other data too.

Notify Breaches

If an affiliate is unfortunate enough to suffer a breach, they will need to make the appropriate Data Protection Authority (DPA) aware of it. All organisations have 72 hours to report the breach, and organisations acting as data processors will be required to notify their customers (data controllers).

Appoint a Data Protection Officer

A DPO will only be required if your organisation handles a large volume of data, or is involved in monitoring this data on a large scale. In most cases this doesn’t apply to affiliates, however, they will still need to act responsibly, review their internal record keeping, and ensure that consent and data collected is auditable.

Be Paranoid about Privacy

Under the GDPR, failure to implement adequate precautions when it comes to data protection and privacy will result in the most serious penalties they have to offer. And this doesn’t only relate to online privacy.

Affiliates should review the existing safeguards they have in place to prevent data getting into the wrong hands, both online and offline i.e. in their home office or work premises.  Staff should be restricted to accessing information that is absolutely critical to their role and thought should be given to what physical data would be at risk in the event of a physical break-in.

This article contains general information for affiliates to make their own informed decisions about the upcoming GDPR. You must not rely on the information in this article as an alternative to professional legal advice.  The article has been contributed by Pavlos Sideris of Cashbacker – the leading gambling cashback community.

Rightlander will help Kindred Group strengthen affiliate compliance through its innovative landing page tracker.

Rightlander, the ground-breaking affiliate landing page tracker, has partnered with Kindred Affiliates, the affiliate program of Kindred Group, to help the operator strengthen affiliate compliance and boost its responsible gambling measures.

The technology scans any website and builds a list of locations where an operator’s brand is referenced or linked to. It follows each link to its final destination on the website and records data including affiliate tags, anchor text and creative materials being used to link to the brand.

This will help Kindred Affiliates monitor affiliate websites linking to all of its brands, including Unibet, 32Red and Roxy Palace, allowing the program to further confirm the affiliates sending traffic to its sites are acting responsibly.

The platform also allows Kindred Affiliates to set “compliance alerts” that notify both the program and any Rightlander-registered affiliate automatically when specific criteria defined by the operator is found on affiliate websites during scans. By using Rightlander, Kindred Affiliates is taking additional steps to ensure the affiliates sending traffic to its websites are complying with supplier agreements and corporate values.

Rightlander founder, Ian Sims, said: “We are pleased to have joined forces with Kindred Affiliates, helping them strengthen affiliate compliance and responsibility across all of its online gambling brands. In the eyes of UK regulators, operators are responsible for the affiliates acting on their behalf, but keeping track of their activity is complex and time consuming. We make that process much easier and far more effective.”

Ryan Henderson at Kindred Affiliates, said: “As a licensed operator in multiple jurisdictions, Kindred Group puts Responsible Gambling and Sustainability at the very core of our business. Our affiliate partners are expected to share these values, while remaining compliant with the regulations and rules issued by the relevant authorities.

Rightlander adds an additional layer of oversight to our existing processes. The technology provides automated reporting that allows the Kindred Affiliates team to quickly identify where and how our Brands are being promoted, ensuring that all partners are aligned in their marketing approach.”