> Refericon is a referral and affiliate tracking platform for online stores: which cookies it sets on merchant sites and when GDPR consent is required. > > Canonical: https://www.flowconsent.com/en/services/advertising/refericon Advertising # Refericon Marketing · [Official website](https://refericon.pl/) Referral and affiliate tracking platform for ecommerce. It drops first party tracking cookies on merchant websites and sends click and conversion events to its backend so that referring partners can be rewarded. [Block Refericon until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=advertising) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Advertising](https://www.flowconsent.com/en/services/advertising) - Consent Marketing - Prior consent Required - Documented cookies 4 - Third-party domains 3 - Servers United States (vendor infrastructure) Overview ## What does Refericon do? ## **What is Refericon** Refericon is a referral and affiliate tracking platform aimed at ecommerce brands. Merchants embed a small JavaScript snippet on their storefront and a dedicated tag on their thank you page, so that every visitor who arrives through a partner link can be attributed to the right publisher and a commission can be paid when the visitor places an order. The product is delivered as a software as a service, with dashboards for merchants, publishers and customers. ## **What data and cookies Refericon collects** Refericon sets a first party referral cookie that stores the identifier of the publisher that brought the visitor, a session cookie used to deduplicate clicks and a persistent visitor identifier used to recognise returning users during the attribution window. On the server it logs the IP address, the user agent, the referring URL, the click and conversion events, the basket value, the order identifier and, when shared by the merchant, a hashed email or customer identifier. ## **GDPR and ePrivacy implications** Referral cookies are not strictly necessary to deliver the storefront, so Article 5(3) of the ePrivacy Directive requires prior informed consent before they are written. The server side attribution of orders is a personal data processing under the GDPR, with Refericon acting as a processor for the merchant on the storefront side, and often as a controller for the publisher network and the reward marketplace it operates. National regulators (CNIL, BfDI, AEPD, Garante) treat affiliate trackers as marketing cookies that require an opt in cookie banner. ## **Consent and user controls** The Refericon script and conversion tag should be blocked by the consent management platform until the visitor has accepted a marketing or affiliate category. Refusal must be as easy as acceptance, the banner must name Refericon and indicate the US transfer, and the cookie policy must list each Refericon cookie with its purpose and duration. Customers must be able to exercise their access, erasure and objection rights under Articles 15 to 21 GDPR. ## **Data transfers and hosting** Refericon servers are located in the United States, so referral, click and conversion events leave the European Economic Area as soon as they are sent. This transfer relies on standard contractual clauses and, when Refericon self certifies under the EU US Data Privacy Framework, on the framework adequacy decision. A transfer impact assessment is required from the merchant, taking into account the categories of data, the volume, the sensitivity and the possibility of access by US public authorities under FISA 702 and Executive Order 12333. ## **Practical compliance steps** Sign a data processing agreement with Refericon including the EU standard contractual clauses, gate the script behind opt in consent, configure short retention windows for attribution data, hash any customer identifier before sending it, document the processing in the Article 30 records, run a documented TIA, train the marketing team on cookie compliance and update the privacy and cookie policy with a clear mention of Refericon, the US transfer, the cookies set and the retention. Compliance ## Refericon and the GDPR Refericon is classified as “Marketing”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Consent (Article 5(3) ePrivacy Directive and Article 6(1)(a) GDPR) for the referral tracking cookies on the public site. Legitimate interest (Article 6(1)(f) GDPR) can apply to the server side reconciliation of attributed conversions for the merchant fraud prevention purposes. - Risk level high - Applicable regulations GDPR, ePrivacy Directive (Cookie Law), national implementations such as the French Data Protection Act, the German TDDDG and the Spanish LSSI, plus the Digital Services Act and the Digital Markets Act for affiliate intermediaries. ### Impact assessment (DPIA) A DPIA is recommended whenever Refericon is deployed at scale, because the referral identifiers combined with order data, IP address and user agent allow systematic tracking of customer journeys across publishers and reward campaigns, which qualifies as profiling under Article 22 GDPR. Document the categories of data, the retention of attribution logs, the sharing with publishers and the legitimate interest balancing test for fraud prevention. ### Sample text for your banner > We use Refericon to credit our referral and affiliate partners when a purchase comes from their link. This drops a first party tracking cookie and sends your click and conversion data to Refericon, hosted in the United States. We need your consent to activate referral tracking. You can accept, refuse or withdraw your consent at any time. Cookies and trackers ## What Refericon sets and contacts - Tracking method JavaScript tracking pixel with first party cookies and server side conversion events - Server location United States (vendor infrastructure) - Data transferred outside the EU Refericon is operated from the United States, so referral identifiers, click and conversion events are transferred to US based servers. The transfer relies on standard contractual clauses and the EU US Data Privacy Framework when the vendor self certifies under it, with a documented transfer impact assessment by the website operator. ### Cookies set (4) | Name | Type | Duration | Purpose | | -------- | ---------------- | -------- | ---------------------------------------------------------------------------------------------------- | | rfc\_ref | http\_persistent | 30 days | Stores the publisher referral identifier used to attribute a future conversion to the right partner. | | rfc\_sid | http\_session | Session | Session identifier used to deduplicate clicks and link the same visit to a single attribution event. | | rfc\_vid | http\_persistent | 1 year | Persistent visitor identifier used to recognise returning users during the attribution window. | | rfc\_utm | http\_persistent | 30 days | Stores the marketing parameters of the entry URL for multi touch attribution reports. | ### Third-party domains contacted (3) - `refericon.com` - `track.refericon.com` - `cdn.refericon.com` Questions ## Frequently asked questions about Refericon Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Which cookies does Refericon set? Refericon sets a first party referral cookie holding the publisher identifier, a session cookie for click deduplication and a persistent visitor identifier used during the attribution window. The conversion tag on the thank you page sends order data to Refericon servers without writing additional cookies. ### Is consent required for Refericon? Yes. Affiliate and referral cookies are marketing cookies under Article 5(3) ePrivacy Directive and need explicit opt in. The script must remain blocked until the visitor has accepted a referral or marketing category, with refusal as easy as acceptance. ### What is the legal basis for processing? Consent under Article 6(1)(a) GDPR for the public side cookies and conversion events. Legitimate interest under Article 6(1)(f) GDPR can apply to the server side reconciliation of attributed orders for fraud prevention, provided that a balancing test is documented. ### Are data transferred to the United States? Yes, Refericon hosts its tracking and reporting infrastructure in the United States, so click and conversion data are transferred there. The transfer relies on standard contractual clauses and, when Refericon self certifies, on the EU US Data Privacy Framework, with a documented transfer impact assessment. ### Do I need a DPIA for Refericon? A DPIA is recommended whenever Refericon is used at scale, because the combination of referral identifier, IP, user agent and order data enables systematic monitoring and profiling of customers across publishers, which meets the criteria of Article 35 GDPR for high risk processing. ### How do I implement Refericon in a compliant way? Sign a data processing agreement with EU SCCs, gate the script behind a consent management platform, set short attribution windows, hash any customer identifier before sending, minimise data shared with publishers, run a transfer impact assessment and document the processing in the Article 30 records. ### Are there alternatives to Refericon? Comparable referral and affiliate platforms include Awin, Rakuten Advertising, Impact, Partnerize, Tradedoubler, Tapfiliate and Referral Candy. Some are EU based or offer EU hosting options, which simplify transfer compliance. The choice depends on hosting, contractual terms and the audience footprint. ### How do I update my cookie policy for Refericon? Add a dedicated entry that names Refericon, lists each cookie with purpose and duration, identifies Refericon as the recipient, mentions the US transfer and the safeguards in place, links to the Refericon privacy notice and explains how visitors can refuse or withdraw their consent. Same category ## More services: Advertising [See the whole category](https://www.flowconsent.com/en/services/advertising) ### [Dakno](https://www.flowconsent.com/en/services/advertising/dakno) [Dakno is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Dakno enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Dakno empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/advertising/dakno) [Marketing](https://www.flowconsent.com/en/services/advertising/dakno) · ### [Promo AI](https://www.flowconsent.com/en/services/advertising/promo-ai) [Promo AI is an AI-powered platform that leverages artificial intelligence and machine learning to help businesses automate processes, generate insights, and enhance digital experiences. It provides intelligent automation, natural language processing, and predictive analytics. Promo AI integrates with existing workflows and tools to deliver AI-driven optimization across marketing, customer service, and operations. With scalable infrastructure, Promo AI makes advanced AI accessible to all teams.](https://www.flowconsent.com/en/services/advertising/promo-ai) [Marketing](https://www.flowconsent.com/en/services/advertising/promo-ai) · ### [Admitad](https://www.flowconsent.com/en/services/advertising/admitad) [Admitad is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Admitad integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Admitad helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/advertising/admitad) [Marketing](https://www.flowconsent.com/en/services/advertising/admitad) · ### [ACCESSTRADE](https://www.flowconsent.com/en/services/advertising/accesstrade) [AccessTrade is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. AccessTrade supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, AccessTrade ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/advertising/accesstrade) [Marketing](https://www.flowconsent.com/en/services/advertising/accesstrade) · ### [Media.net](https://www.flowconsent.com/en/services/advertising/media-net) [Media.net is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Media.net enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Media.net empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/advertising/media-net) [Marketing](https://www.flowconsent.com/en/services/advertising/media-net) · ### [Affiliatly](https://www.flowconsent.com/en/services/advertising/affiliatly) [Affiliatly is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Affiliatly supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Affiliatly ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/advertising/affiliatly) [Marketing](https://www.flowconsent.com/en/services/advertising/affiliatly) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)