Privacy Policy

1. Who we are

SponsorSheep is a newsletter sponsorship marketplace and intelligence service operated by Revbox Ltd, a company registered in England and Wales (company no. 15434276) with its registered office at 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom ("SponsorSheep", "we", "us"). Revbox Ltd is the data controller for the personal data described in this policy.

This policy explains what personal data we collect, why, how we use and share it, how long we keep it, and the rights you have. It applies to:

• the website at sponsorsheep.com (the "Website");
• the SponsorSheep platform, including publisher accounts, sponsor (advertiser) accounts and the Bellwether Intel tool (together the "Platform");
• the tracking elements we supply for sponsored newsletter placements;
• our sales, marketing and partnership outreach; and
• our dealings with publishers, sponsors and their staff.

If you are a reader of a newsletter that carries a sponsorship arranged through SponsorSheep, section 6 explains the limited data we receive about you.

2. Personal data we collect

We collect different data depending on how you interact with us.

2.1 Publishers, sponsors and their staff

When you create an account, request access, book a call or transact with us, we collect:

• Identity and contact data — name, business email address, job title or role, phone number (optional), business name and website, and the name of the newsletter(s) you operate.
• Account data — login credentials (passwords are stored hashed), account settings, the newsletters, placement types, packages and prices you list, and your activity on the Platform.
• Commercial and billing data — booking details, invoices, VAT or tax identifiers, bank account details for payouts to publishers, and payment records for sponsors. Card payments are processed by Stripe: card details are entered directly into Stripe's secure payment form and go to Stripe, not to our servers. We receive only a payment token, the card brand, the last four digits and the expiry date, and never store full card numbers. Stripe acts as an independent controller for the data it needs to process payments and prevent fraud; see Stripe's privacy policy at stripe.com/privacy. Bank transfers are made to the account details shown on our invoices.
• Communications — emails, messages, call notes and support requests exchanged with us.

We obtain this data directly from you, from your colleagues who use the Platform on your organisation's behalf, and from the public sources and providers described in sections 2.3 and 2.4. If you do not provide the identity, contact and billing data we ask for, we cannot open or approve an account, arrange bookings or make payments.

2.2 Website visitors

When you visit the Website we collect technical data (IP address, browser and device type, pages visited, referring page, approximate location) through cookies and analytics tools, as described in section 9.

2.3 Newsletter intelligence data (Bellwether Intel)

SponsorSheep subscribes to publicly available newsletters and analyses the issues we receive to identify sponsorship placements. From this we build intelligence about newsletters and the companies that sponsor them: the newsletter's name, website, category, audience size, cadence and sponsorship history, and each sponsor's company name, website, category, size and location, together with generic company channels such as a partnerships@ address or a website contact form. Bellwether Intel shows company-level information only; it does not show the names or contact details of individual employees.

In collecting and checking this data we may incidentally process some personal data, such as the sender name of a newsletter, or the name and role of a founder or editor where these appear in a published issue or on the newsletter's own website. We keep this for our internal records and for outreach (section 2.4); we do not publish it in Bellwether Intel.

We source this data from the published issues themselves and from public web sources, and supplement company information (size, location, category) from public sources and reputable business-data providers. We do not process newsletter subscriber lists and we do not receive subscriber data from publishers.

2.4 Prospect and partnership outreach data

To offer SponsorSheep to publishers and sponsors we process business contact data about people who work at those organisations — name, role, business email, company, LinkedIn profile URL — obtained from public sources, from the newsletters we track, and from business-data providers. We use this data to contact you about SponsorSheep and to keep records of our outreach. You can opt out at any time (section 10).

2.5 Newsletter readers (tracking elements)

Where a sponsorship is arranged through SponsorSheep, the publisher embeds tracking elements we supply (such as tracking links or measurement pixels) in the sponsored placement. When the issue is opened, the pixel is loaded (an impression) or the placement is clicked, we receive:

• the IP address of the device (used for approximate, country- or city-level geolocation, for fraud detection and as part of the delivery record);
• browser and device information (user agent);
• the time of the event and which placement it relates to.

We do not set cookies on readers' devices, we do not receive readers' email addresses or names, and we do not attempt to identify individual readers. Section 6 explains the respective roles of SponsorSheep and the publisher.

2.6 Data we do not collect

We do not knowingly collect special-category data (such as health, political or religious data), data about children, or government identifiers.

3. How we use personal data and our legal bases

Where we rely on legitimate interests we have assessed that our interests are not overridden by your rights and freedoms. For publishers, sponsors and business contacts, the data is business-related and you would reasonably expect a marketplace to use it in this way. For newsletter readers, the data is limited to technical event data, we do not identify you, and measuring whether a sponsored placement was delivered is what makes sponsored newsletters possible. You can object at any time (section 11).

4. Sharing personal data

We share personal data only as follows:

• Between publishers and sponsors — SponsorSheep acts as the intermediary in every booking, so publishers and sponsors do not receive each other's personal contact details. To arrange and deliver a booking we show each side business information only: the sponsor's company name, website and creative to the publisher, and the newsletter's name, website, audience size and placement details to the sponsor, together with booking details and delivery and performance reports. Performance reports are aggregated event counts; they do not identify individual readers.
• Platform users — the company-level newsletter and sponsor intelligence described in section 2.3 is made available to publishers and sponsors who use Bellwether Intel. It contains business information about newsletters and sponsoring companies and generic company contact channels; it does not contain the names or contact details of individuals.
• Service providers acting on our instructions under written contracts, by category: cloud hosting and infrastructure (Amazon Web Services); email delivery, CRM and outreach tools; business-data providers; payment service providers (Stripe) and banks; analytics providers; customer-support and e-signature tools; and professional advisers (accountants, lawyers, auditors).
• Other Revbox platforms — Revbox Ltd operates SponsorSheep alongside its other platforms (including Plusclix) as a single legal entity, so personal data may be processed by shared systems and staff within Revbox Ltd for the purposes in this policy; it is not shared with those platforms' customers.
• Legal and safety — where required by law, regulation, court order or a competent authority, or to protect the rights, property or safety of SponsorSheep, our users or others.
• Business transfers — if Revbox Ltd or the SponsorSheep business is sold, merged or reorganised, personal data may be transferred to the acquirer under confidentiality obligations, and this policy will continue to apply.

We do not rent or sell personal data to third parties for their own independent use.

5. International transfers

We are based in the United Kingdom, and some of our team members, contractors and service providers are located outside the UK, including in the European Economic Area, the United States and other countries. Where personal data is transferred outside the UK or EEA we rely on the UK International Data Transfer Agreement or Addendum, the EU Standard Contractual Clauses, adequacy regulations or decisions (including the EU–US Data Privacy Framework and its UK Extension where the recipient is certified), and supplementary measures where appropriate. Team members and contractors outside the UK and EEA who have access to our systems are bound by written data-protection and transfer terms. You can ask us for details of the safeguards in place.

6. Publishers, readers and our respective roles

Publishers who partner with SponsorSheep remain responsible for their own subscriber lists, for the lawful basis of their sends and for their own privacy notices, which should cover sponsored content and the tracking elements embedded in it. SponsorSheep never receives subscriber lists.

For the limited data collected through tracking elements (section 2.5), SponsorSheep and the publisher each act as an independent controller: the publisher for its newsletter and subscriber relationship, SponsorSheep for the measurement data it collects. We use that data only to measure, report on and bill placements, to detect fraud, for performance analysis and benchmarking, and to improve our services.

If you are a newsletter reader and have questions about a newsletter you receive, please contact the publisher directly. You may also contact us (section 13) about the measurement data we hold, but note that we cannot link event data to you unless you give us information that lets us do so (for example your IP address and the time of the event).

7. Retention

We keep personal data for the periods set out below:

• Account and commercial data — for the life of the account and for six years after the last transaction, to meet tax, accounting and legal-claims requirements; thereafter deleted or anonymised.
• Billing records and invoices — six years from the end of the financial year to which they relate.
• Newsletter intelligence data — for as long as the newsletter or sponsor remains relevant to the service; any incidental personal data in it is reviewed at least every 24 months and removed or updated when no longer accurate, and removed on request.
• Prospect and outreach data — up to 24 months from our last contact or your last interaction with us, unless you become a customer or ask us to stop sooner; opt-out records are kept indefinitely so that we honour them.
• Tracking-element event data — the open, impression and click event records described in section 2.5 are kept indefinitely. They are the record of what was delivered and billed for each placement and are used for long-term performance analysis, benchmarking and fraud detection. No cookies, names or email addresses are attached to these records, and we do not attempt to identify individual readers from them.
• Website analytics data — as set by the analytics provider (see section 9), typically no more than 26 months.
• Communications — up to three years after the matter is closed.

8. Security

We protect personal data with encryption in transit (TLS) and at rest, role-based access controls, logging and monitoring, hashed credentials, secure hosting on Amazon Web Services, and staff confidentiality obligations. We maintain incident-response procedures and will notify affected users and regulators of a personal-data breach where the law requires.

9. Cookies and analytics

The Website and Platform use:

• Strictly necessary cookies — to keep you logged in, keep the Platform working during your session and protect against fraud. These do not require consent.
• Analytics cookies — set by our analytics provider to understand how visitors use the Website and Platform (pages viewed, time on page, approximate location, device). These are set only with your consent, which you can give or withdraw through the cookie banner or your browser settings.

We do not use advertising or cross-site tracking cookies. Sponsored placements do not set cookies or store anything on newsletter readers' devices. A tracking link records the request made to our server when you click it. Where a placement includes a measurement pixel, the request your email client makes to load it is recorded when the issue is opened; the publisher is responsible for any consent the law requires for the tracking elements it embeds in its newsletter, and you can prevent pixels from loading by turning off automatic image loading in your email client.

10. Marketing and outreach

We contact publishers and sponsors about SponsorSheep by email and LinkedIn on a business-to-business basis. Every marketing email includes an unsubscribe link, and you can also opt out by replying to any message or using the contact details in section 13. We apply the UK standards (UK GDPR and PECR) to all our outreach wherever you are located. We will honour opt-outs within ten business days and keep a suppression record so that we do not contact you again.

11. Your rights

We apply the UK GDPR standard of rights to everyone whose personal data we hold, wherever you are located. You have the right to:

• access the personal data we hold about you and receive a copy;
• rectify inaccurate or incomplete data;
• erase your data in certain circumstances;
• restrict or object to processing based on legitimate interests — we will stop unless we have compelling legitimate grounds that override your interests; objections to direct marketing are always honoured;
• data portability for data you provided to us under a contract or with consent;
• withdraw consent at any time where processing is based on consent, without affecting processing before withdrawal; and
• complain to the UK Information Commissioner's Office (ico.org.uk), our supervisory authority; if you are in the EEA you may also complain to your national data-protection authority.

We do not sell personal data, and we do not make decisions about you with legal or similarly significant effects solely by automated means (account approvals are reviewed by our team).

To exercise any right, contact us as described in section 13. We may need to verify your identity. We respond within one month of receiving a valid request and may extend this by up to two further months for complex or numerous requests, in which case we will tell you within the first month.

12. Children

The Website and Platform are intended for businesses and are not directed at anyone under 18. We do not knowingly collect personal data from children; if you believe we have, please contact us and we will delete it.

13. Contact

For privacy questions or to exercise your rights, contact our data protection team:

• through the contact form on sponsorsheep.com; or
• by post to Revbox Ltd (Data Protection), 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom.

14. Changes to this policy

We may update this policy from time to time. The date at the top shows when it was last changed. For material changes we will notify account holders by email or through the Platform before they take effect. Continued use of the Website or Platform after that date means the updated policy applies.