Privacy policy

This is a translation. The Estonian version applies if the two differ.

Last updated: 23 August 2026

1. Who are we?

Rahatagasi is a cashback service that gives you money back when you shop with our partners. The service is provided by Monsen AS (Norwegian registration number 931 063 499), Inger Bang Lunds vei 5, 5059 Bergen, Norway. Monsen AS is the data controller for the processing of personal data described here. Norway belongs to the European Economic Area (EEA), and the General Data Protection Regulation (GDPR) applies there in the same way as in the European Union. Contact: tugi@rahatagasi.ee.

2. What data do we collect?

We process the following personal data:

• Account information: name and email address. If you log in with your Google account, we receive the name and the email address from there. We do not ask for your personal identification code.
• Purchase data: information about purchases you make through our affiliate links: the store, the amount and the time.
• Technical information: IP address, browser, device and operating system, so that the service works and in order to prevent misuse.
• Cookies: we use the cookies necessary for login and for affiliate tracking, including a device identifier (the “sb_did” cookie, lifetime 180 days).
• Click and account events: when you click through to a partner, we record the time, the partner, the IP address, browser information and the device identifier. The same happens on registration and on login. The purpose is to link purchases to the right account, including purchases you made before you registered, so that you receive the cashback you are entitled to, and in order to prevent misuse. This data is kept for no longer than 180 days and is processed on the basis of legitimate interest (GDPR art. 6(1)(f)).
• Order confirmations for cashback claims: when you submit a cashback claim, you upload the order confirmation from the store (PDF or image). We use it solely to verify your claim and delete it automatically no later than 90 days after the claim has been decided.

The payout is made through a Revolut payment link that you complete yourself. We therefore neither collect nor store your account number.

3. Why do we process this data?

• To provide the cashback service and register your purchases.
• To create and manage your user account.
• To pay out the cashback you have earned.
• To improve the service and the user experience.
• To meet legal obligations (accounting and tax).

4. Legal basis

We process personal data on the following bases: our agreement with you (GDPR art. 6(1)(b)), legitimate interest (GDPR art. 6(1)(f)), consent where it is required (GDPR art. 6(1)(a)), and legal obligation where accounting and tax rules require it (GDPR art. 6(1)(c)).

5. Who do we share data with?

• Affiliate networks: Adtraction, Addrevenue, Tradedoubler and others, in order to register and confirm purchases.
• Google: if you choose to log in with Google. The login is handled by Google Ireland Limited, which passes your name and email address on to us. Google is an independent data controller for its own part of the processing.
• Payment service provider: Revolut, for paying out earned cashback.
• Technical service providers: operation, hosting and email (see section 8).

We never sell your personal data to third parties.

6. Storage and deletion

Personal data is kept for as long as you have an active account. If you delete your account, we delete your data within 30 days, except for data we are legally obliged to keep (a maximum of 5 years under the Norwegian Accounting Act, which applies to Monsen AS). Click and account events containing the IP address and the device identifier are deleted automatically after 180 days.

7. Your rights

You have the right to:

• Access the data we hold about you.
• Have incorrect data corrected.
• Have your data deleted.
• Data portability: receive a copy of your data.
• Object to processing that is based on legitimate interest.
• Withdraw a consent you have given, at any time.
• Lodge a complaint with the Data Protection Inspectorate (Andmekaitse Inspektsioon), which is the Estonian supervisory authority.

8. Where data is processed, and our processors

Data is processed mainly in Norway and in the European Union and the EEA; the exceptions that involve a transfer of data to a third country are listed below. Norway is a party to the EEA Agreement and the GDPR applies there, which is why a transfer of data to Norway is not a transfer to a third country. We use the following processors:

• Hostinger: operation and hosting of the platform (EU/Lithuania)
• Resend: transactional email. Resend is located in the United States, so the email address and the content of the message travel there. The transfer takes place under the EU-US Data Privacy Framework, and additionally under the European Commission's standard contractual clauses (SCC) and supplementary safeguards.
• Revolut: payouts (EU)
• Google Ireland Limited: login with Google (EU). Google may in turn transfer data to the United States under the Data Privacy Framework.

Rahatagasi for business customers, a subscription in which a store sends us customer transactions and we act as processor, is not yet available in Estonia. If it launches, we will enter into a data processing agreement as part of the terms of use.

9. Analytics, marketing and tracking

9.1 Statistics (without cookies)

We use Plausible Analytics to measure traffic and use of the service. Plausible does not collect personal data, uses no cookies and does not identify you. No data is transferred outside the EEA.

9.2 Ad tracking (only with your consent)

If you give your consent in our consent banner, we may activate ad tracking from platforms such as Meta (Facebook/Instagram), Google Ads, TikTok, Snapchat, Microsoft/Bing, Pinterest, X and Reddit, in order to measure and target advertising. The legal basis is consent (GDPR art. 6(1)(a)). These platforms may transfer data to the United States under the EU-US Data Privacy Framework or the European Commission's standard contractual clauses (SCC). You may change or withdraw your consent at any time by clicking “Cookies” at the bottom of the page. Without consent, none of them are loaded.

See our cookie page for a full overview of cookies and tracking.

9.3 Affiliate attribution (necessary)

So that we can register cashback and credit it to your account, we use affiliate tracking: when you click through to a partner via Rahatagasi, a first-party subId (a pseudonymous identifier) is stored with us and with the affiliate network in question (see section 5). This is necessary for the service to work and is processed on the basis of our agreement with you (GDPR art. 6(1)(b)). No third-party advertising cookie is set at this step.

10. Contact us

Questions about privacy? Write to us at tugi@rahatagasi.ee