Privacy Policy

Last updated: 28 October 2026

1. Who we are

Spendstream Ltd operates the CreditLadder Cashback website at https://cashback.creditladder.co.uk (the "Rewards Site"). Spendstream is a company registered in England and Wales under number 16056707, with registered office at 167-169 Great Portland Street, 5th Floor, London W1W 5PF.

Credit Ladder Limited, trading as CreditLadder, company number 10074481, is the controller for personal data used in connection with the main website at https://creditladder.co.uk/, its customer accounts, rent-reporting and other services, marketing and customer relationship. CreditLadder's own privacy policy applies to that processing. Spendstream does not receive or use banking, rent-payment, credit-reporting or credit-reference information collected by CreditLadder for its main services to operate the Rewards Site. This is separate from the limited payment information processed when you personally choose Pay by Bank at checkout through Salt Edge.

When a signed-in customer selects the CreditLadder Cashback link, CreditLadder sends Spendstream the customer's email address and CreditLadder tier attribute. At that point Spendstream creates a separate Rewards account automatically and becomes the controller for that Rewards account and all personal data generated by the customer's activity on the Rewards Site. Spendstream determines how and why data is used to operate the Rewards Site, apply tier-specific Cashback rates, calculate and administer Cashback, process and fulfil gift-card orders, provide BACS withdrawals, provide support, secure the service and maintain its records.

Opting out of or closing the Rewards account affects only CreditLadder Cashback. It does not close, restrict or otherwise affect the customer's account on the main CreditLadder website.

2. What this notice covers

This notice explains how Spendstream collects and uses personal data when you join CreditLadder Cashback automatically through CreditLadder single sign-on, access or use the Rewards Site, buy digital gift cards, earn or redeem Cashback, contact support or otherwise interact with the Rewards Site. It does not cover how a retailer, CreditLadder or another third party uses data for its own purposes.

The Rewards Site is intended for adults aged 18 or over. We do not knowingly offer accounts to children.

3. Personal data we collect

Account and identity data

Email address, CreditLadder tier attribute, internal Rewards account identifier, account status and any record that you have opted out, closed the Rewards account or later asked to rejoin. CreditLadder provides your email address and tier attribute; it does not provide us with other profile information.

Contact data

Your email address and any additional contact information you choose to provide directly to Spendstream when you contact support. We receive your email address and tier attribute from CreditLadder when you first access the Rewards Site through single sign-on.

Order and Cashback data

Brand, gift-card denomination and face value, price payable, payment method selected, Cashback rate and amount applicable to that method, Cashback status and balance, applicable brand-page terms, order time, status, fulfilment and delivery record, redemption or payment record, dormancy activity, any legally required remedy or chargeback information, and related Rewards-account activity. Spendstream creates and controls these records.

Payment and withdrawal data

We record the payment method selected, the applicable Cashback offer, amount, status, timestamps and transaction references. For payment card, Apple Pay and Google Pay transactions, Trust Payments and the relevant card or wallet providers process the payment. We receive payment tokens, processor references, authorisation results and limited masked-card or transaction information where supplied; we do not receive or store full card numbers or card security codes.

For Pay by Bank, Salt Edge facilitates payment initiation with your chosen bank. We send Salt Edge the information needed to set up the payment, including your email address, selected bank, order reference, payment amount, device and IP information. Salt Edge and the bank handle your bank authorisation, and we receive payment references, status and other limited information needed to reconcile, investigate and fulfil the order, which may include bank or payer-account details where supplied. We do not ask you to provide online banking passwords to Spendstream, and selecting Pay by Bank for a purchase does not give us ongoing access to your account balance or transaction history.

If you request a BACS withdrawal of Cashback, we also collect the account holder name, sort code, account number, withdrawal amount, payment status and reference, together with security or identity-check information where reasonably required.

Technical, usage and security data

IP address, device and browser information, operating system, timestamps, pages and actions, session identifiers, cookie choices, approximate location derived from IP address, referral information, security logs, fraud signals and diagnostic data.

Communications and preference data

Support requests, complaints, feedback, survey responses, marketing preferences and records of messages sent or received.

Derived and aggregated data

We may derive risk indicators, eligibility status and service insights from the data above. We use the tier attribute supplied by CreditLadder and your chosen payment method to determine the Cashback rate applicable to a purchase, without receiving CreditLadder's underlying rent, bank, credit-reference or credit-reporting data. We create aggregated statistics that do not identify individuals. Anonymous information is not personal data, but we will treat it as personal data if it can be linked back to you.

4. Where we get your data

We collect personal data:

from you, when you use the Rewards Site, order a gift card or contact support;
from CreditLadder, which sends us your email address and tier attribute when you select the CreditLadder Cashback link;
from Trust Payments and applicable card or wallet providers, which send us limited payment status and transaction metadata; from Salt Edge and the selected bank in connection with payment initiation and status when you choose Pay by Bank; and from our bank or payment provider when we send a BACS withdrawal;
from activity generated when you use the Rewards Site, including orders, fulfilment, Cashback calculation, validation, redemption and withdrawal, support and security events; and
automatically from your device through logs, cookies and similar technologies, subject to your cookie choices.

5. Why we use your data and our lawful bases

Create your Rewards access, fulfil orders and administer Cashback — steps at your request and contract

When you select the CreditLadder Cashback link in your CreditLadder account, we use the email address and tier attribute supplied by CreditLadder to register you automatically, provide the separate Rewards access you requested and apply the Cashback rates available to your tier and payment method. This processing is necessary to take steps at your request before entering into a contract and to perform our contract with you. Spendstream controls all subsequent activity on the Rewards Site and uses account, order, Cashback, payment-method and payment-reference, fulfilment, delivery, withdrawal and redemption data to show offers, calculate and validate Cashback, accept payment, fulfil digital gift cards, administer available rewards, process BACS withdrawals, communicate about orders and provide customer support.

Prevent fraud and keep the service secure — legitimate interests and legal obligation

We use identity, payment-reference, technical, usage and security data to authenticate users, enforce limits, detect fraud or misuse, investigate incidents and protect users, Spendstream, CreditLadder, retailers and payment providers. Our legitimate interests are operating a secure and sustainable service and protecting people and property. We may also process data to comply with legal obligations.

Keep business, tax and compliance records — legal obligation and legitimate interests

We retain appropriate transaction, refund, support and audit records to meet accounting, tax, consumer-protection and legal obligations and to establish, exercise or defend legal claims.

Operate and improve the service — legitimate interests

We use limited account, usage, support, Cashback, withdrawal and aggregated data to troubleshoot, measure service performance, improve journeys, forecast demand and manage service providers. We also monitor account activity so that we can administer the 12-month dormancy rule fairly, give advance notice and protect unresolved balances and disputes. Our interests are maintaining and improving the Rewards Site and administering the programme consistently.

With your consent, we use Google Analytics to understand how the Rewards Site is used and to improve performance and customer journeys. Google Analytics is deployed through Google Tag Manager and remains blocked until CookieYes records the required consent. You can withdraw or change your choice at any time through the available CookieYes consent controls. Withdrawing consent does not affect processing that occurred before withdrawal.

Service messages — contract or legitimate interests

We send necessary messages about orders, security, account changes and material service updates. These are not marketing messages.

If Spendstream sends direct marketing, we will use the lawful basis and electronic-marketing rule that applies to the channel and relationship. You can opt out at any time. CreditLadder is responsible for its own marketing and preferences.

Corporate and legal events — legitimate interests and legal obligation

We may use and disclose relevant data for audits, professional advice, corporate transactions, business continuity, regulatory requests and legal proceedings.

6. If you do not provide data

CreditLadder supplies your email address and tier attribute to Spendstream. They are required to create your Rewards account and apply the Cashback rates available to your tier. If you do not want CreditLadder to send them to us or do not want to join, do not select the CreditLadder Cashback link. If you have already joined, you can opt out or close the Rewards account by contacting us or CreditLadder. Other information generated or provided directly on the Rewards Site may be required to process payment, fulfil an order, validate or redeem Cashback, process a BACS withdrawal or investigate a problem. If it is not available, we may be unable to provide the relevant service. Analytics and other non-essential cookies are optional and controlled through the available CookieYes consent controls.

7. Fraud screening and automated decisions

We use rules and risk signals to identify unusual or potentially fraudulent activity. A transaction may be delayed or declined, or an account may be restricted, based on those checks. Where a decision is based solely on automated processing and produces a legal or similarly significant effect, we will provide the information and safeguards required by law, including a way to ask for human review, express your view and challenge the decision.

8. Service providers and who receives data

Spendstream does not sell personal data. We use gift-card suppliers and fulfilment partners to obtain and deliver gift cards. We aim to limit information shared with them to what is necessary for the order, delivery, reconciliation and fraud prevention. Retailers and service providers may receive limited order-related information where necessary. Our operational service providers and other recipients include:

Trust Payments and the applicable card networks and Apple Pay or Google Pay providers, which process card and wallet payments and provide limited payment and transaction metadata;
Salt Edge, which facilitates Pay by Bank payment initiation through your selected bank, and the banks involved in authorising or executing that payment;
gift-card fulfilment and distribution suppliers (including Tillo where used), which help source, issue, reconcile and deliver digital gift cards;
our bank and any BACS or payment-service provider used to send an approved Cashback withdrawal, which receives the payment and bank-account information needed to make, reconcile and protect that payment;
Amazon Web Services (AWS), which hosts the Rewards Site and its core account and order records in a UK region selected by Spendstream;
Postmark and Brevo, which process email addresses and message content to send transactional and service emails;
Freshdesk, which processes the information included in support requests and related correspondence;
Google, which provides Google Analytics and Google Tag Manager and processes consented analytics information such as device, browser, approximate location and usage events;
CookieYes, which records and applies your cookie-consent choices;
CreditLadder, only where needed to action a Rewards-account opt-out or closure, prevent automatic re-enrolment, confirm programme eligibility, apply an agreed membership redemption or resolve a user-requested issue; CreditLadder may also receive aggregated programme reporting that does not identify you;
regulators, law-enforcement bodies, courts and other authorities where required or permitted by law; and
a buyer, investor or successor in connection with a proposed or completed corporate transaction, subject to appropriate safeguards.

Where a provider acts as our processor, it may use personal data only under our documented instructions and contract. Trust Payments, Salt Edge, banks and other recipients may also have independent legal duties for payment, fraud-prevention or regulatory purposes and are responsible for those uses under their own privacy information.

We do not sell personal data.

9. International transfers

Spendstream hosts its core Rewards-account and order database in an AWS UK region and does not itself move that database outside the United Kingdom. Limited personal data may be processed outside the United Kingdom by an operational provider. Where UK data-protection law restricts a transfer, Spendstream uses an approved safeguard, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses or the UK Extension to the EU-US Data Privacy Framework, together with supplementary measures where appropriate. You can request further information about the safeguards used, including how to obtain a copy where available, through the CreditLadder Cashback Help Centre.

10. How long we keep data

We keep personal data only for as long as needed for the purpose collected, including legal, accounting, fraud-prevention and claims requirements. We consider the nature and sensitivity of the data, risk of harm, legal requirements and whether the purpose can be achieved another way.

account profile and Cashback balance: while the account is active, then up to 24 months unless a longer period is needed to complete a redemption, resolve a dispute, prevent fraud or comply with law;
orders, payments, BACS withdrawals, refunds and accounting records: six years after the end of the relevant financial year or transaction relationship;
support and complaint records: up to three years after closure, or longer where a claim is reasonably anticipated;
security and access logs: normally 12 months, with longer retention for a live incident or investigation;
fraud and abuse records: for a proportionate period based on risk and limitation periods;
account-closure and marketing suppression records: as long as needed to respect the relevant opt-out and prevent unwanted re-enrolment or marketing; and
analytics and consent data: retained according to the periods configured in Google Analytics and CookieYes, or until consent is withdrawn or the data is no longer needed, subject to applicable legal limits;

11. Security

We use proportionate technical and organisational measures designed to protect personal data, including access controls, encryption in transit, supplier due diligence, logging, monitoring and incident-response procedures. No service can guarantee absolute security. You should use strong credentials on your CreditLadder account and tell us promptly about suspected misuse.

12. Your rights

Depending on the circumstances, UK data-protection law gives you rights to:

ask for access to your personal data;
ask us to correct inaccurate or incomplete data;
ask us to erase data;
ask us to restrict use of data;
receive certain data in a portable format or ask us to send it to another controller;
withdraw consent at any time, without affecting processing before withdrawal; and
ask for safeguards relating to qualifying solely automated decisions.

Your right to object. You may object to processing based on our legitimate interests. You may object at any time to the use of your personal data for direct marketing, and we will stop using it for that purpose.

These rights are not absolute. We may need to verify your identity and may keep information where law permits or requires it. We normally respond within one month, subject to lawful extensions for complex or multiple requests.

13. Rewards access and marketing choices

You can opt out of CreditLadder Cashback and ask for your Rewards access to be closed at any time by contacting either the CreditLadder Cashback Help Centre or CreditLadder. This does not close or otherwise affect your CreditLadder account. We and CreditLadder will take reasonable steps to record your choice and prevent automatic reactivation unless you later ask to rejoin. We may retain a limited suppression record, together with transaction or compliance records that law permits or requires us to keep.

Closing Rewards access is separate from changing marketing preferences. Before asking us to close access, request withdrawal of any available Cashback balance of at least £10 or contact the Help Centre about the balance. Cashback below £10 may be lost when the account is closed unless the law requires otherwise. We may retain Cashback and withdrawal records where law, fraud prevention, accounting or claims requirements permit or require it. You can opt out of Spendstream marketing using the unsubscribe link in a message or by contacting us. Service and security messages will still be sent where needed while your Rewards account is active or where a message remains necessary. To change CreditLadder marketing choices, use CreditLadder's preference controls or contact CreditLadder directly.

14. Cookies

Our Cookie Policy explains the cookies and similar technologies used on the Rewards Site. CookieYes manages consent choices. Google Analytics and other non-essential technologies are blocked until the required consent is recorded, and you can change your choice using the available CookieYes consent controls.

15. Links and retailer sites

The Rewards Site may link to CreditLadder, retailers and other websites. Those organisations control their own sites and privacy practices. Review their notices before providing personal data.

16. Changes to this notice

We may update this notice when our service, suppliers or legal obligations change. We will publish the current version and update the date above. We will give additional notice where a change is material and the law requires it.

17. Contact us and complain

To ask a privacy question or exercise a right, contact the CreditLadder Cashback Help Centre at https://cashback.creditladder.co.uk/help or write to: Privacy, Spendstream Ltd, 167-169 Great Portland Street, 5th Floor, London W1W 5PF.

If you make a data-protection complaint to us, we will acknowledge it within 30 days, take appropriate steps to investigate and respond without undue delay, and keep you informed about its progress and outcome.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data-protection regulator. Visit https://ico.org.uk/make-a-complaint/ or call 0303 123 1113. We would appreciate the opportunity to address your concern first, but you do not have to contact us before complaining to the ICO.