Legal


Terms and Conditions

Last updated: 28 October 2026

1. Who we are and what these terms cover

The CreditLadder Cashback website at https://cashback.creditladder.co.uk (the "Rewards Site") is operated by Spendstream Ltd ("Spendstream", "we", "us" or "our"), a company registered in England and Wales under company number 16056707. Our registered office is at 167-169 Great Portland Street, 5th Floor, London W1W 5PF.

Credit Ladder Limited, trading as CreditLadder, operates the main website at https://creditladder.co.uk/ (the "Partner"). The Partner provides the CreditLadder Cashback branding, decides who is eligible to access the programme and controls its own website and customer accounts, which are governed by its separate terms. Spendstream operates and controls the Rewards Site and the separate Rewards accounts created on it. Spendstream controls checkout, payment processing, gift-card fulfilment, Cashback calculation and administration, support and all activity that takes place on the Rewards Site.

These terms apply when you access the Rewards Site, use a Rewards account, buy a digital gift card or earn, hold or redeem Cashback through it. When you select the CreditLadder Cashback link while signed in to the main CreditLadder website, you are automatically enrolled and a separate Rewards account is created for you. If you do not want to join, do not select that link. If an account has already been created, you can opt out and close your Rewards access at any time by contacting either CreditLadder or the CreditLadder Cashback Help Centre.

2. Eligibility and your account

You may use the Rewards Site only if you:

  • are at least 18 years old;

  • live in the United Kingdom and access the service from the United Kingdom;

  • use the service for personal, non-commercial purposes;

  • provide accurate, complete and current information; and

  • use a supported UK bank account or payment card in your own name, with payment in pounds sterling, and complete any checks required by your bank or payment provider.

Only one Rewards account is permitted per person unless we agree otherwise. You access the Rewards Site through single sign-on from your account on the main CreditLadder website. When you select the CreditLadder Cashback link, CreditLadder sends us your email address and the tier attribute assigned to your CreditLadder account. We use that information to create and identify your separate Rewards account automatically and to apply the Cashback rates available to your tier; you do not need to complete a registration form. After the handoff, Spendstream controls the Rewards account and all processing arising from your use of the Rewards Site. You remain responsible for keeping your CreditLadder account credentials secure and for telling us promptly if you suspect unauthorised use.

We may ask for information or carry out checks to verify identity, age, location, payment ownership, transaction legitimacy or compliance with these terms. You must not allow another person to use your account or create accounts to avoid limits or controls.

3. The service

The Rewards Site lets eligible users buy digital gift cards issued by participating retailers and earn Cashback on qualifying purchases. The available retailers, gift-card face values, prices payable, Cashback rates or amounts, purchase limits, delivery methods and eligibility conditions are shown before purchase and may change. Cashback offers can differ depending on whether you choose Pay by Bank, debit or credit card, Apple Pay or Google Pay, as well as your CreditLadder tier and the selected retailer.

A digital gift card is issued by the relevant retailer or its authorised programme provider. Spendstream is responsible for checkout and Cashback administration through the Rewards Site, arranges payments through its payment providers and arranges digital gift-card fulfilment. The retailer is responsible for accepting the gift card and for the goods or services you buy with it.

Each brand's gift card may have different purchase and redemption terms. The applicable terms are displayed on that brand's page on the Rewards Site and are incorporated into your order. They may cover activation, denominations, purchase limits, redemption channels, expiry, exclusions, geographic limits, balance rules and restrictions on resale or cash exchange. Review the relevant brand page before ordering. The initial service does not include affiliate offers, tracked links or coupons: Cashback is earned only on eligible digital gift cards bought through the Rewards Site.

4. Orders and formation of the contract

The order page will show the retailer, gift-card face value, price payable, the Cashback rate or amount applicable to your chosen payment method and any limits or conditions. If you change the payment method, the applicable Cashback rate or amount may change. Check the rate and the final order details shown for your selected method before authorising payment. The Cashback offer applicable when your order is accepted forms part of your order.

Submitting an order is an offer to buy. An automated acknowledgement does not mean that we have accepted it. A binding contract is formed when we send an order-acceptance or fulfilment confirmation. We may reject or cancel an order before acceptance where, for example, the gift card is unavailable, a limit is exceeded, payment is not authorised, information cannot be verified, the order appears fraudulent or unlawful, or there is an obvious pricing, Cashback or display error.

If we reject an order after placing a payment authorisation, we will release or reverse the authorisation as soon as reasonably practicable. Your bank may take additional time to show the released funds.

5. Price and payment

Prices are stated in pounds sterling. You pay the price shown at checkout for the stated gift-card face value. Cashback is a separate reward and does not reduce the amount charged unless checkout expressly says otherwise. You can choose from the payment methods made available at checkout: Pay by Bank, payment card, Apple Pay or Google Pay. Availability may depend on your device, bank, card or payment provider.

Pay by Bank is provided through Salt Edge, which initiates a bank payment after you select your bank and authorise the payment through your bank's secure process. Your bank decides whether to approve it. Card payments, including payments using Apple Pay or Google Pay, are processed through Trust Payments and the relevant card or wallet providers. Trust Payments handles card details; Spendstream does not receive or store your full card number or card security code.

The Cashback rate or amount may be different for Pay by Bank and for card or wallet payments. The applicable rate or amount will be advertised in the purchase journey for the payment method selected. If you switch method before completing payment, review the updated offer and final order details. We do not add a fee unless it is clearly disclosed before you order.

Your bank or card issuer may apply its own charges. We are not responsible for those charges. Never send payment-card details, online banking credentials or one-time security codes through email or the CreditLadder Cashback Help Centre.

6. Delivery and protecting your gift card

We normally deliver a digital gift card to your Rewards account and/or the email address associated with your account shortly after acceptance. If it has not arrived within four hours, check your account and spam folder, then contact the CreditLadder Cashback Help Centre.

Treat a gift-card code like cash. Do not share it with anyone you do not trust. Once a code has been displayed, delivered or redeemed, we may be unable to replace it. Tell us promptly if an email address is incorrect or you believe a code has been intercepted. We will investigate, but replacement may not be possible where the code has been used and the problem was not caused by us.

7. Cancellation, no-refund policy and statutory remedies

Digital gift cards are supplied for immediate use and a strict no-refund policy applies. Before submitting an order, you must expressly request immediate supply and acknowledge that, once supply begins, any 14-day statutory cancellation right will be lost. We will not begin supply until that request and acknowledgement have been given.

Once a digital gift card has been supplied, all sales are final. Spendstream does not offer voluntary, discretionary or change-of-mind refunds, exchanges or account credit under any circumstances.

Nothing in these terms excludes or limits a remedy that applicable consumer law does not allow us to exclude. If the digital gift card is faulty, misdescribed or not supplied as agreed, contact the CreditLadder Cashback Help Centre with the order details and error information. Spendstream will investigate and, where the law requires a remedy, provide the remedy required by law. This may include re-delivery, replacement, repair, price reduction or, only where legally required, a refund.

Any refund that Spendstream is legally required to provide will normally be returned to the original payment method where supported. For a Pay by Bank purchase, we may need to arrange a bank transfer or another suitable refund method after completing reasonable verification. We may reject a request where evidence shows that a valid gift card was supplied and redeemed, except where the law requires otherwise.

8. Cashback

The Cashback rate or amount offered for an eligible gift-card purchase will be shown before you order. It may vary by retailer, denomination, your CreditLadder eligibility or tier, selected payment method (Pay by Bank, card, Apple Pay or Google Pay), campaign, transaction conditions and other criteria disclosed before purchase. The displayed offer forms part of your order, but Cashback remains subject to payment approval, validation, fraud controls and the conditions in this section.

We aim to add Cashback to your Rewards account within a few hours after an accepted qualifying purchase, but this is not guaranteed. Cashback does not become available to use until the purchase has been validated and the corresponding retailer margin or commission has been confirmed or received. A transaction may remain pending while we complete fraud, payment, fulfilment or upstream checks.

The Rewards Site will show the Cashback that is pending and available. Once your available Cashback balance reaches £10, you may request withdrawal by BACS using the withdrawal process shown in your account. You must provide complete and accurate bank-account details and may be asked to complete reasonable security or identity checks. Spendstream will normally send an approved withdrawal within three working days after receiving a valid request. A working day means Monday to Friday, excluding public holidays in England. The time taken for funds to appear after they are sent may depend on the banking system and your bank. We may delay or refuse a request while investigating suspected fraud, an account-security issue, incorrect details, a legal restriction or Cashback that is not yet available. Where enabled, available Cashback may instead be applied towards a discounted annual CreditLadder membership. Cashback is not interest-bearing, is not a bank deposit and cannot be transferred, sold or exchanged except through an expressly offered redemption method.

We may withhold or reverse Cashback where the underlying order is rejected, cancelled, refunded, charged back, duplicated, ineligible, obtained through fraud or misuse, or otherwise invalid under these terms or the applicable brand terms. We may correct an obvious display or calculation error before an order is accepted. We will not reduce Cashback already confirmed on a completed qualifying purchase merely because a rate later changes, except for a valid reversal or adjustment under this paragraph or where the law requires it.

If your Rewards account has been dormant for at least 12 consecutive months, we may permanently remove any Cashback remaining in it. An account is dormant where there has been no qualifying purchase, Cashback credit, withdrawal request or other account activity recorded by us during that period. Before removing Cashback, we will send reasonable advance notice to the email address registered to your Rewards account and give you a final opportunity to sign in, make a qualifying use of the account or withdraw any available balance of at least £10. Cashback below the minimum withdrawal amount may be lost if the account remains dormant after that notice period. We will not remove Cashback while a withdrawal, complaint or genuine dispute about that balance is unresolved.

9. Acceptable use

You must not:

  • use the Rewards Site for resale, money transmission, cash extraction or any trade or business purpose;

  • use stolen, unauthorised or third-party payment details;

  • create multiple accounts, use false information, manipulate Cashback offers or eligibility rules, or evade purchase limits;

  • introduce malware, attempt unauthorised access, scrape the service, reverse engineer security controls or interfere with the site;

  • use the service in a way that is unlawful, abusive or infringes another person’s rights; or

  • sell, exchange or publish gift-card codes in breach of retailer conditions.

10. Suspending or closing an account

You may opt out of CreditLadder Cashback and ask for your Rewards access to be closed at any time by contacting either CreditLadder or the CreditLadder Cashback Help Centre. Opting out affects CreditLadder Cashback only and does not close or otherwise affect your CreditLadder account. Before closing access, request withdrawal of any available Cashback balance of at least £10 or contact the Help Centre about the balance. Closing an account does not remove a valid reversal, the £10 minimum withdrawal threshold or another disclosed condition. Cashback below £10 may be lost when the account is closed unless the law requires otherwise. We and CreditLadder will take reasonable steps to record your choice and prevent automatic reactivation unless you later ask to rejoin. Closing Rewards access does not cancel completed orders, remove retailer obligations or prevent us from retaining records we must keep by law or for legitimate fraud, claims and accounting purposes.

We may temporarily restrict an order or account while we carry out proportionate security or fraud checks. We may suspend or close access immediately where we reasonably believe there is fraud, serious misuse, a security risk, unlawful activity, abusive conduct or a material breach of these terms. In other cases, we will give reasonable notice where practicable.

We will provide a reason unless doing so would compromise security, fraud prevention, another person's rights or a legal obligation. You may ask the CreditLadder Cashback Help Centre for a human review of a restriction or closure.

11. Retailers and third-party services

Retailers are independent businesses. A retailer’s terms govern redemption of its gift card and any goods or services bought with it. Questions about those goods or services, including returns, product quality and warranties, should normally be raised with the retailer. This does not remove any separate rights you may have against Spendstream concerning supply of the digital gift card itself.

We are not responsible for a retailer ceasing to trade, refusing a card in accordance with valid retailer terms, or changing its own products or store network, unless the law says we are responsible. We will provide reasonable assistance with a genuine gift-card issue.

12. Availability and changes to the service

We aim to keep the Rewards Site available, but uninterrupted access is not guaranteed. We may maintain, update, secure or change the service, retailer range, future Cashback rates, eligibility rules or redemption methods. We will not retrospectively reduce Cashback already confirmed on a completed qualifying purchase except for a valid reversal or adjustment under section 8 or where the law requires it.

If an event outside our reasonable control delays delivery, we will take reasonable steps to reduce the impact and will contact you where the delay is material.

13. Our responsibility to you

We provide the Rewards Site and digital gift-card service with reasonable care and skill. We do not exclude or limit liability where it would be unlawful, including liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, breach of your statutory rights, or any other liability that cannot lawfully be excluded.

We are responsible for loss or damage that is a foreseeable result of our breach of these terms or failure to use reasonable care and skill. We are not responsible for loss that was not foreseeable, was caused by your breach or failure to follow reasonable instructions, or relates to a business use of this consumer service.

The Rewards Site is for personal use. We are not responsible for business losses such as lost profit, revenue, opportunity or goodwill. Nothing in these terms affects rights you have under consumer law.

14. Intellectual property

The Rewards Site, its software, content and branding are owned by or licensed to Spendstream, CreditLadder or their licensors. You may use them only as needed for personal use of the service. No intellectual-property rights are transferred to you.

15. Changes to these terms

We may update these terms for legal, regulatory, security, operational or service reasons. The current version and effective date will be posted on the Rewards Site. If a change materially affects an existing account, we will give reasonable notice where practicable. The terms in force when an order is accepted continue to govern that order.

16. Privacy

Our Privacy Policy explains how Spendstream uses personal data. CreditLadder's privacy policy separately explains its use of personal data, including data used for its main customer account and services. Cookie use on the Rewards Site is described in our Cookie Policy.

17. Complaints and contact

If you have a problem with an order or the Rewards Site, contact us through the CreditLadder Cashback Help Centre at https://cashback.creditladder.co.uk/help. Please include your order reference but never send a full card number or gift-card code unless our support team provides a secure method.

We will try to resolve complaints fairly and promptly. This clause does not limit your right to use any court or alternative dispute process available to you.

18. General legal terms

We may transfer our rights and obligations under these terms to another organisation, but we will tell you if this happens and the transfer will not reduce your rights. You may transfer your rights only where we agree or the law permits.

These terms are between you and Spendstream. No other person may enforce them, except that this does not prevent Credit Ladder Limited enforcing provisions that expressly protect its rights. If a court finds part of these terms unlawful, the remaining parts will continue. A delay in enforcing a right is not a waiver of it.

English law applies. You may bring proceedings in the courts of England and Wales. If you live in Scotland or Northern Ireland, you may also bring proceedings in your local courts.

Privacy Policy

Last updated: 28 October 2026

1. Who we are

Spendstream Ltd operates the CreditLadder Cashback website at https://cashback.creditladder.co.uk (the "Rewards Site"). Spendstream is a company registered in England and Wales under number 16056707, with registered office at 167-169 Great Portland Street, 5th Floor, London W1W 5PF.

Credit Ladder Limited, trading as CreditLadder, company number 10074481, is the controller for personal data used in connection with the main website at https://creditladder.co.uk/, its customer accounts, rent-reporting and other services, marketing and customer relationship. CreditLadder's own privacy policy applies to that processing. Spendstream does not receive or use banking, rent-payment, credit-reporting or credit-reference information collected by CreditLadder for its main services to operate the Rewards Site. This is separate from the limited payment information processed when you personally choose Pay by Bank at checkout through Salt Edge.

When a signed-in customer selects the CreditLadder Cashback link, CreditLadder sends Spendstream the customer's email address and CreditLadder tier attribute. At that point Spendstream creates a separate Rewards account automatically and becomes the controller for that Rewards account and all personal data generated by the customer's activity on the Rewards Site. Spendstream determines how and why data is used to operate the Rewards Site, apply tier-specific Cashback rates, calculate and administer Cashback, process and fulfil gift-card orders, provide BACS withdrawals, provide support, secure the service and maintain its records.

Opting out of or closing the Rewards account affects only CreditLadder Cashback. It does not close, restrict or otherwise affect the customer's account on the main CreditLadder website.

2. What this notice covers

This notice explains how Spendstream collects and uses personal data when you join CreditLadder Cashback automatically through CreditLadder single sign-on, access or use the Rewards Site, buy digital gift cards, earn or redeem Cashback, contact support or otherwise interact with the Rewards Site. It does not cover how a retailer, CreditLadder or another third party uses data for its own purposes.

The Rewards Site is intended for adults aged 18 or over. We do not knowingly offer accounts to children.

3. Personal data we collect

Account and identity data

Email address, CreditLadder tier attribute, internal Rewards account identifier, account status and any record that you have opted out, closed the Rewards account or later asked to rejoin. CreditLadder provides your email address and tier attribute; it does not provide us with other profile information.

Contact data

Your email address and any additional contact information you choose to provide directly to Spendstream when you contact support. We receive your email address and tier attribute from CreditLadder when you first access the Rewards Site through single sign-on.

Order and Cashback data

Brand, gift-card denomination and face value, price payable, payment method selected, Cashback rate and amount applicable to that method, Cashback status and balance, applicable brand-page terms, order time, status, fulfilment and delivery record, redemption or payment record, dormancy activity, any legally required remedy or chargeback information, and related Rewards-account activity. Spendstream creates and controls these records.

Payment and withdrawal data

We record the payment method selected, the applicable Cashback offer, amount, status, timestamps and transaction references. For payment card, Apple Pay and Google Pay transactions, Trust Payments and the relevant card or wallet providers process the payment. We receive payment tokens, processor references, authorisation results and limited masked-card or transaction information where supplied; we do not receive or store full card numbers or card security codes.

For Pay by Bank, Salt Edge facilitates payment initiation with your chosen bank. We send Salt Edge the information needed to set up the payment, including your email address, selected bank, order reference, payment amount, device and IP information. Salt Edge and the bank handle your bank authorisation, and we receive payment references, status and other limited information needed to reconcile, investigate and fulfil the order, which may include bank or payer-account details where supplied. We do not ask you to provide online banking passwords to Spendstream, and selecting Pay by Bank for a purchase does not give us ongoing access to your account balance or transaction history.

If you request a BACS withdrawal of Cashback, we also collect the account holder name, sort code, account number, withdrawal amount, payment status and reference, together with security or identity-check information where reasonably required.

Technical, usage and security data

IP address, device and browser information, operating system, timestamps, pages and actions, session identifiers, cookie choices, approximate location derived from IP address, referral information, security logs, fraud signals and diagnostic data.

Communications and preference data

Support requests, complaints, feedback, survey responses, marketing preferences and records of messages sent or received.

Derived and aggregated data

We may derive risk indicators, eligibility status and service insights from the data above. We use the tier attribute supplied by CreditLadder and your chosen payment method to determine the Cashback rate applicable to a purchase, without receiving CreditLadder's underlying rent, bank, credit-reference or credit-reporting data. We create aggregated statistics that do not identify individuals. Anonymous information is not personal data, but we will treat it as personal data if it can be linked back to you.

4. Where we get your data

We collect personal data:

  • from you, when you use the Rewards Site, order a gift card or contact support;

  • from CreditLadder, which sends us your email address and tier attribute when you select the CreditLadder Cashback link;

  • from Trust Payments and applicable card or wallet providers, which send us limited payment status and transaction metadata; from Salt Edge and the selected bank in connection with payment initiation and status when you choose Pay by Bank; and from our bank or payment provider when we send a BACS withdrawal;

  • from activity generated when you use the Rewards Site, including orders, fulfilment, Cashback calculation, validation, redemption and withdrawal, support and security events; and

  • automatically from your device through logs, cookies and similar technologies, subject to your cookie choices.

5. Why we use your data and our lawful bases

Create your Rewards access, fulfil orders and administer Cashback — steps at your request and contract

When you select the CreditLadder Cashback link in your CreditLadder account, we use the email address and tier attribute supplied by CreditLadder to register you automatically, provide the separate Rewards access you requested and apply the Cashback rates available to your tier and payment method. This processing is necessary to take steps at your request before entering into a contract and to perform our contract with you. Spendstream controls all subsequent activity on the Rewards Site and uses account, order, Cashback, payment-method and payment-reference, fulfilment, delivery, withdrawal and redemption data to show offers, calculate and validate Cashback, accept payment, fulfil digital gift cards, administer available rewards, process BACS withdrawals, communicate about orders and provide customer support.

We use identity, payment-reference, technical, usage and security data to authenticate users, enforce limits, detect fraud or misuse, investigate incidents and protect users, Spendstream, CreditLadder, retailers and payment providers. Our legitimate interests are operating a secure and sustainable service and protecting people and property. We may also process data to comply with legal obligations.

We retain appropriate transaction, refund, support and audit records to meet accounting, tax, consumer-protection and legal obligations and to establish, exercise or defend legal claims.

Operate and improve the service — legitimate interests

We use limited account, usage, support, Cashback, withdrawal and aggregated data to troubleshoot, measure service performance, improve journeys, forecast demand and manage service providers. We also monitor account activity so that we can administer the 12-month dormancy rule fairly, give advance notice and protect unresolved balances and disputes. Our interests are maintaining and improving the Rewards Site and administering the programme consistently.

With your consent, we use Google Analytics to understand how the Rewards Site is used and to improve performance and customer journeys. Google Analytics is deployed through Google Tag Manager and remains blocked until CookieYes records the required consent. You can withdraw or change your choice at any time through the available CookieYes consent controls. Withdrawing consent does not affect processing that occurred before withdrawal.

Service messages — contract or legitimate interests

We send necessary messages about orders, security, account changes and material service updates. These are not marketing messages.

If Spendstream sends direct marketing, we will use the lawful basis and electronic-marketing rule that applies to the channel and relationship. You can opt out at any time. CreditLadder is responsible for its own marketing and preferences.

We may use and disclose relevant data for audits, professional advice, corporate transactions, business continuity, regulatory requests and legal proceedings.

6. If you do not provide data

CreditLadder supplies your email address and tier attribute to Spendstream. They are required to create your Rewards account and apply the Cashback rates available to your tier. If you do not want CreditLadder to send them to us or do not want to join, do not select the CreditLadder Cashback link. If you have already joined, you can opt out or close the Rewards account by contacting us or CreditLadder. Other information generated or provided directly on the Rewards Site may be required to process payment, fulfil an order, validate or redeem Cashback, process a BACS withdrawal or investigate a problem. If it is not available, we may be unable to provide the relevant service. Analytics and other non-essential cookies are optional and controlled through the available CookieYes consent controls.

7. Fraud screening and automated decisions

We use rules and risk signals to identify unusual or potentially fraudulent activity. A transaction may be delayed or declined, or an account may be restricted, based on those checks. Where a decision is based solely on automated processing and produces a legal or similarly significant effect, we will provide the information and safeguards required by law, including a way to ask for human review, express your view and challenge the decision.

8. Service providers and who receives data

Spendstream does not sell personal data. We use gift-card suppliers and fulfilment partners to obtain and deliver gift cards. We aim to limit information shared with them to what is necessary for the order, delivery, reconciliation and fraud prevention. Retailers and service providers may receive limited order-related information where necessary. Our operational service providers and other recipients include:

  • Trust Payments and the applicable card networks and Apple Pay or Google Pay providers, which process card and wallet payments and provide limited payment and transaction metadata;

  • Salt Edge, which facilitates Pay by Bank payment initiation through your selected bank, and the banks involved in authorising or executing that payment;

  • gift-card fulfilment and distribution suppliers (including Tillo where used), which help source, issue, reconcile and deliver digital gift cards;

  • our bank and any BACS or payment-service provider used to send an approved Cashback withdrawal, which receives the payment and bank-account information needed to make, reconcile and protect that payment;

  • Amazon Web Services (AWS), which hosts the Rewards Site and its core account and order records in a UK region selected by Spendstream;

  • Postmark and Brevo, which process email addresses and message content to send transactional and service emails;

  • Freshdesk, which processes the information included in support requests and related correspondence;

  • Google, which provides Google Analytics and Google Tag Manager and processes consented analytics information such as device, browser, approximate location and usage events;

  • CookieYes, which records and applies your cookie-consent choices;

  • CreditLadder, only where needed to action a Rewards-account opt-out or closure, prevent automatic re-enrolment, confirm programme eligibility, apply an agreed membership redemption or resolve a user-requested issue; CreditLadder may also receive aggregated programme reporting that does not identify you;

  • regulators, law-enforcement bodies, courts and other authorities where required or permitted by law; and

  • a buyer, investor or successor in connection with a proposed or completed corporate transaction, subject to appropriate safeguards.

Where a provider acts as our processor, it may use personal data only under our documented instructions and contract. Trust Payments, Salt Edge, banks and other recipients may also have independent legal duties for payment, fraud-prevention or regulatory purposes and are responsible for those uses under their own privacy information.

We do not sell personal data.

9. International transfers

Spendstream hosts its core Rewards-account and order database in an AWS UK region and does not itself move that database outside the United Kingdom. Limited personal data may be processed outside the United Kingdom by an operational provider. Where UK data-protection law restricts a transfer, Spendstream uses an approved safeguard, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses or the UK Extension to the EU-US Data Privacy Framework, together with supplementary measures where appropriate. You can request further information about the safeguards used, including how to obtain a copy where available, through the CreditLadder Cashback Help Centre.

10. How long we keep data

We keep personal data only for as long as needed for the purpose collected, including legal, accounting, fraud-prevention and claims requirements. We consider the nature and sensitivity of the data, risk of harm, legal requirements and whether the purpose can be achieved another way.

  • account profile and Cashback balance: while the account is active, then up to 24 months unless a longer period is needed to complete a redemption, resolve a dispute, prevent fraud or comply with law;

  • orders, payments, BACS withdrawals, refunds and accounting records: six years after the end of the relevant financial year or transaction relationship;

  • support and complaint records: up to three years after closure, or longer where a claim is reasonably anticipated;

  • security and access logs: normally 12 months, with longer retention for a live incident or investigation;

  • fraud and abuse records: for a proportionate period based on risk and limitation periods;

  • account-closure and marketing suppression records: as long as needed to respect the relevant opt-out and prevent unwanted re-enrolment or marketing; and

  • analytics and consent data: retained according to the periods configured in Google Analytics and CookieYes, or until consent is withdrawn or the data is no longer needed, subject to applicable legal limits;

11. Security

We use proportionate technical and organisational measures designed to protect personal data, including access controls, encryption in transit, supplier due diligence, logging, monitoring and incident-response procedures. No service can guarantee absolute security. You should use strong credentials on your CreditLadder account and tell us promptly about suspected misuse.

12. Your rights

Depending on the circumstances, UK data-protection law gives you rights to:

  • ask for access to your personal data;

  • ask us to correct inaccurate or incomplete data;

  • ask us to erase data;

  • ask us to restrict use of data;

  • receive certain data in a portable format or ask us to send it to another controller;

  • withdraw consent at any time, without affecting processing before withdrawal; and

  • ask for safeguards relating to qualifying solely automated decisions.

Your right to object. You may object to processing based on our legitimate interests. You may object at any time to the use of your personal data for direct marketing, and we will stop using it for that purpose.

These rights are not absolute. We may need to verify your identity and may keep information where law permits or requires it. We normally respond within one month, subject to lawful extensions for complex or multiple requests.

13. Rewards access and marketing choices

You can opt out of CreditLadder Cashback and ask for your Rewards access to be closed at any time by contacting either the CreditLadder Cashback Help Centre or CreditLadder. This does not close or otherwise affect your CreditLadder account. We and CreditLadder will take reasonable steps to record your choice and prevent automatic reactivation unless you later ask to rejoin. We may retain a limited suppression record, together with transaction or compliance records that law permits or requires us to keep.

Closing Rewards access is separate from changing marketing preferences. Before asking us to close access, request withdrawal of any available Cashback balance of at least £10 or contact the Help Centre about the balance. Cashback below £10 may be lost when the account is closed unless the law requires otherwise. We may retain Cashback and withdrawal records where law, fraud prevention, accounting or claims requirements permit or require it. You can opt out of Spendstream marketing using the unsubscribe link in a message or by contacting us. Service and security messages will still be sent where needed while your Rewards account is active or where a message remains necessary. To change CreditLadder marketing choices, use CreditLadder's preference controls or contact CreditLadder directly.

14. Cookies

Our Cookie Policy explains the cookies and similar technologies used on the Rewards Site. CookieYes manages consent choices. Google Analytics and other non-essential technologies are blocked until the required consent is recorded, and you can change your choice using the available CookieYes consent controls.

15. Links and retailer sites

The Rewards Site may link to CreditLadder, retailers and other websites. Those organisations control their own sites and privacy practices. Review their notices before providing personal data.

16. Changes to this notice

We may update this notice when our service, suppliers or legal obligations change. We will publish the current version and update the date above. We will give additional notice where a change is material and the law requires it.

17. Contact us and complain

To ask a privacy question or exercise a right, contact the CreditLadder Cashback Help Centre at https://cashback.creditladder.co.uk/help or write to: Privacy, Spendstream Ltd, 167-169 Great Portland Street, 5th Floor, London W1W 5PF.

If you make a data-protection complaint to us, we will acknowledge it within 30 days, take appropriate steps to investigate and respond without undue delay, and keep you informed about its progress and outcome.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data-protection regulator. Visit https://ico.org.uk/make-a-complaint/ or call 0303 123 1113. We would appreciate the opportunity to address your concern first, but you do not have to contact us before complaining to the ICO.

Instantly Start Earning CASHBACK on Every Transaction

Login / Sign Up
Earn rewards at your favourite shops