Privacy Policy

Introduction

Sampl (“we”, “us”, “our”), is committed to protecting the privacy and security of your personal information, in accordance with the applicable data protection laws, including the General Data Protection Regulation (GDPR) and UK Data Protection Act 2018. Our policy is to be transparent about why and how we process personal data.

This privacy notice applies to personal data provided to us, both by individuals themselves or by others, and it describes why and how we collect and use personal data. It provides information about your data subject rights and what you can do if you have concerns about our processing of your personal data (hereafter called ‘personal information’).

This privacy notice covers personal information that is collected through our website (the “Website”) and all associated sub-domains, by telephone, through Live Chat and through any related social media applications.

Who are we?

We are Sampl Technologies Ltd; a company incorporated in England & Wales with company number 13069140.

For most campaigns — including sampling requests, SamplPay cashback claims, and feedback collection — we act as a Data Processor on behalf of the brand or campaign owner (the Data Controller). This means we collect and process personal information strictly under their instructions, for the purposes of delivering samples, managing cashback fulfilment, capturing feedback, and obtaining marketing preferences where applicable.

In limited cases, such as managing our own website or marketing communications for Sampl itself, we may act as a Data Controller for any data you provide directly to us.

Our registered office is:

4th Floor, Park Gate 161-163
Preston Road
Brighton
East Sussex
United Kingdom
BN1 6AF

Our website: https://www.sampltech.com

If you have any questions at all about this privacy notice, the information presented on our Website, or about how we use and process your personal information, please contact our Data Protection Officer by e-mail at: privacy@sampltech.com

What we use your information for

We collect and process personal information to deliver our services, fulfil sampling campaigns, support our brand clients, and manage our business operations. We only use personal information for the purposes set out in this notice or as clearly explained at the point of collection.

‍
As a Data Processor (on behalf of our brand clients)

In most cases, we process your personal information strictly on behalf of the campaign organiser (the Data Controller), under their instruction. This includes:

• To process and fulfil your requests for samples or product trials (including SamplPay cashback campaigns)
• To verify eligibility for campaigns based on demographic criteria or previous participation
• To collect, store, and pass on feedback or reviews, including User-Generated Content (UGC) such as written reviews, ratings, images or videos submitted by you
• To manage receipt validation and cashback fulfilment under SamplPay
• To collect marketing preferences and pass them securely to the client (where you have consented)
• To provide aggregated, anonymised insights or trend analysis to the campaign organiser

Where UGC is collected, this may be published or repurposed by the brand in line with the campaign’s terms. We will make this clear at the point of collection. You should avoid including personal data about yourself or others unless explicitly requested.

In all such cases, we act solely under the instructions of the Data Controller and do not use this information for our own purposes.

As a Data Controller (for our own operations)

In limited circumstances, we act as a Data Controller. This includes:

• To administer and secure our website and infrastructure
• To manage our communications with you (e.g. enquiries, support requests)
• To improve and personalise your experience on our website
• To perform internal analytics, reporting, or commercial analysis
• To fulfil contractual obligations with you or your organisation
• To issue invoices and recover any outstanding payments
• To comply with legal or regulatory obligations
• Where you have given explicit consent — for example, if you subscribe to updates or communications from Sampl

The sections below provide more detail about the personal information we collect for each of these purposes, the lawful basis for doing so, and the retention period applied to each type of data

In addition, to ensure that each visitor to any of our websites can use and navigate the site effectively, we collect the following to ensure that visitors can access and navigate our website effectively, and to help us monitor performance, detect issues, and improve security, we collect certain technical and usage related data when you visit our site. This includes:

• Your IP address (Internet Protocol)
• Browser type and version, time zone setting, and browser plug-in details
• Operating system and platform
• Login information (where applicable)
• Information about your visit, including pages viewed and URL clickstream data (to, through, and from our site)
• This information is collected using standard logging tools and cookies. Where cookies are not essential to the operation of the site, we ask for your consent before using them.

Our Cookies Policy, available from the homepage of our website, provides full details about how we use cookies and similar technologies, including how you can manage your preferences.

What we collect from you

To enable us to provide our services to you, we will collect certain personal information when you request a sample or participate in a campaign. This may be provided to us via our Website, by phone, app, email or via a third party, such as a social media platform (e.g. Facebook).

When you participate in a campaign or request a sample, we may collect:

• Your full name
• Email address
• Postal address (for sample delivery)
• Phone number (where required for contact or SMS)
• Demographic details (e.g. age range, gender, location) — if needed for eligibility checks
• Your product preferences or interests
• Proof of purchase (for SamplPay cashback claims)
• Feedback or reviews you provide about the product
• Other information as requested by the campaign organiser (Data Controller), where relevant to participation

When prospective clients contact us, we may collect:

• Company name
• Contact person’s name
• Business email address
• Telephone number

When you use our website and applications, we may automatically collect:

• Technical data such as:
  
  • IP address
  • Browser type and version
  • Operating system and device type
  • Login information and session data
  • Device identifiers and mobile network information (if applicable)
• Usage data such as:
  
  • Pages visited, time spent, and clickstream path
  • Search terms used and forms submitted
  • Page response times and download errors
  • Referral links or URLs clicked from our website to others
• Fraud detection data such as:
  
  • Device reputation profile used to identify and block suspicious activity. This data may be shared with our third-party fraud prevention provider (see Subprocessors page) to help ensure fair use of our platform and prevent multiple claims from the same device.

We may also receive personal information from third parties:

This includes:

• Social media platforms (e.g. Facebook)
• Analytics and tracking providers
• Digital advertising networks
• Technology and data enrichment partners

‍We only collect and use this information as necessary to deliver our services, measure campaign performance, improve our platform, and meet our contractual or legal obligations.

What is our lawful basis for processing your personal information?

Under the GDPR, the lawful bases we rely on for processing your personal information are:

• (a) Your consent. You can withdraw your consent at any time by contacting: privacy@sampltech.com
• (b) We have a contractual obligation.
• (c) We have a legal obligation.
• (f) We have a legitimate interest.

Where we act as a Data Processor (e.g. during sample campaigns or cashback offers), we process personal data solely under the instruction of the Data Controller, who determines the appropriate lawful basis for that activity.

Who do we share your personal information with?

We only share your personal information where necessary to deliver our services, fulfil campaign obligations, or comply with legal requirements. All third parties are required to handle your data securely and in accordance with applicable data protection laws.

We may share your data with the following types of organisations:

Brand Partners and Campaign Organisers

• The brand or client running the sampling campaign (the Data Controller), where we act as their Data Processor.
• Any company you have explicitly agreed may receive your information — for example, reward platforms involved in a campaign

Service Providers

We use third-party suppliers to support our operations. These include:

• Fulfilment partners who store, pack, and ship samples on our behalf
• Managed Service Providers and IT support
• Platform hosting and cloud providers
• Email and communication tools (e.g. chat services, email campaign platforms)
• Survey and feedback tools
• Data analytics platforms
• Professional services, such as solicitors, accountants, or debt recovery firms
• Call recording providers (for support and quality assurance)

All service providers are contractually bound to handle your data securely, keep it confidential, and only use it for the purpose we have instructed.

Third-party Data Subprocessors

When acting as a Data Processor, we may engage subprocessors to support campaign on behalf of our clients. These include providers of hosting, communications, analytics, and fulfilment services.

All subprocessors are subject to strict contractual obligations to handle personal data securely, confidentially, and in line with our clients’ instructions.

Please see our full list of data subprocessors.

Regulators and Law Enforcement

We may share your information with:

• Regulators, tax authorities, or other official bodies where required by law
• Law enforcement, where disclosure is necessary for the detection or prevention of crime or fraud, or where required by court order

Business Transfers

In the event of a merger, restructuring, or sale of part or all of our business, personal data may be shared with the prospective buyer or their advisers, under appropriate confidentiality terms.

We will never sell your personal information. Any data sharing is strictly limited to the purposes for which the data was collected and in accordance with data protection laws.

Where we keep your personal information and how we keep it safe

We take data protection very seriously and have implemented appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way.

Sampl is certified to ISO 27001 for Information security and we are audited annually by a UKAS Accredited certification body.

We limit access to your personal information to our clients and other third parties as required in the fulfilment of our services. They will only process your personal information on our instructions, and they are subject to a duty of confidentiality.

While we will use all reasonable efforts to safeguard your personal data, you acknowledge that the use of the internet is not entirely secure and for this reason, we cannot guarantee the security or integrity of any personal data that are transferred via the internet.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

How long will we hold onto your data for?

We will only retain your personal information for as long as necessary to fulfil the sampling activity we collected it for, or as instructed by the data controller. When determining retention, we take into account the amount, nature and sensitivity of the data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process the data and whether those purposes can be achieved by other means, together with any applicable legal or regulatory requirements.

As a general rule, we retain personal information processed as part of sampling campaigns for up to 90 days after the campaign has ended, unless the data controller specifies a different period. This period is measured from the end of the campaign rather than the delivery of an individual sample.

In some circumstances, we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you.

In addition, we retain pseudonymised engagement records in the form of hashed email addresses. These records are used to past participation and engagement in order to improve campaign effectiveness and prevent misuse. Hashed records are retained for up to 3 years, after which they are securely deleted.

Should you no longer wish to use our services, you may request that we delete your personal data.

What marketing activities do we carry out?

You are in control of whether we use your personal information for marketing purposes. We are committed to only sending marketing communications where you have clearly expressed an interest in receiving.

When we engage with you, (on our website, by email or other direct contact) we will always ask for your permission to send marketing messages and your preferred method for this communication. . Depending on your preferences, the marketing could be about:

• our own products and services,
• products and services for other companies we work with, or
• products or and services from selected third parties.

We may send these communications to you directly or via third parties such as search engine operators and marketing companies.

You can withdraw your consent or update your preferences at any time by following the instructions that appear in all marketing communications, or by contacting us at privacy@sampltech.com.  Please note that opting out of marketing communications will not affect service related (non-marketing) communications that are necessary.

We do not use personal information in online advertising campaigns that you may see on search engines or social media platforms. These are based on cookies or platform profiling. To stop seeing such ads, you will need to manage your cookie settings, browser preferences, or the privacy settings on your social media accounts.

How we use “Cookies”

For full details of our use of cookies on our website, please refer to our Cookies Policy.

Your data protection rights

As a data subject whose personal information we may process , you have certain rights under data protection law. If you wish to exercise any of these rights, please email: privacy@sampltech.com or use the information supplied in the “How to contact us” section below.

To verify your request, we will ask you to provide two valid forms of identification. Your rights are as follows:

• The right to be informed
  We are obliged to provide clear and transparent information about our data processing activities. This is provided by this privacy notice and any related communications we may send you.
  
  
• The right of access
  You may request a copy of the personal data we hold about you free of charge. Once we have verified your identity and, if relevant, the authority of any third-party requestor, we will provide access to the personal data we hold about you
  
  
• If there are exceptional circumstances that mean we are unable to provide the information, we will explain them. If requests are frivolous or vexatious, we reserve the right to refuse them. If answering requests is likely to require additional time or occasions unreasonable expense (which you may have to meet), we will inform you.
  
  
• The right to rectification
  When you believe we hold inaccurate or incomplete personal information about you, you may exercise your right to correct or complete this data.
  
  
• The right to erasure (the ‘right to be forgotten’)
  Where no overriding legal basis or legitimate reason continues to exist for processing personal data, you may request that we delete the personal data. We will take all reasonable steps to ensure erasure.
  
  
• The right to restrict processing
  You may ask us to stop processing your personal data. We will still hold the data but will not process it any further. This right is an alternative to the right to erasure. If one of the following conditions applies you may exercise the right to restrict processing:
  
  a) The accuracy of the personal data is contested.
  b) We no longer need the personal data for processing but the personal data is required for part of a legal process.
  c) The right to object has been exercised and processing is restricted pending a decision on the status of the processing.
  
  
• The right to data portability
  You may request your personal data be transferred to another controller or processor. This right is only available if the original processing was on the basis of consent or fulfilment of a contract and the processing is by automated means.
  
  
• The right to object
  You have the right to object to our processing of your data where:
  
  
  • Processing is based on legitimate interest
  • Processing is for the purpose of direct marketing
  • Processing is for the purposes of scientific or historic research
  • Processing involves automated decision-making and profiling

You will not be charged for exercising your rights. If you make a request, we will respond within one month from validating a request to respond to you.

Please note that if you request erasure, object to our processing or request the restriction of our processing we may not be able to provide our services and we may need to deactivate your account on our Website.

You can always unsubscribe from our email communications at any time by following the unsubscribe link in our email communications, or by updating your email preferences on your profile on our Website.

How to contact us

If you would like to stop receiving information from us; or your personal preferences change and you do not want us to send you the information requested; or if you have any queries about how we use your personal information; or if you wish to exercise your rights (listed in the Your data protection rights section) then please let us know by contacting us directly by email: privacy@sampltech.com

How to complain

If you have any concerns about our use of your personal information, you can make a complaint to us at privacy@sampltech.com.
You can also complain to the ICO if you are unhappy with how we have used your data.

The ICO’s address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113
ICO website: https://www.ico.org.uk

For more details about your rights under the Act, the rules we have to adhere to in collecting and storing your personal information, and how you can check your data records, please visit https://www.gov.uk/data-protection/the-data-protection-act

Other websites

Our website may contain links to other websites. This privacy notice only applies to our own website so when you link to other websites you should read their own privacy policies.

Changes to this privacy notice

Any changes we may make to our privacy notice in the future will be posted on this page.