Configuration Guide

<aside> 💡

ℹ️ This guide provides step-by-step instructions for configuring AWIN in different privacy configurations and how these configurations must be reflected in the Consenter Manager when configuring your Consent Banner.

Step 1: Choose which configuration matches your demands and configure AWIN accordingly

Step 2: Configure the Consent Banner in the Consenter Manager accordingly

Step 3: Explain how you use AWIN in your privacy policy

</aside>

AWIN is an affiliate marketing network that connects advertisers (merchants) with publishers (affiliates, such as content sites, voucher-code sites, or cashback platforms) and attributes sales or leads to the publisher who referred the customer, so that the publisher can be paid a commission. Tracking is implemented via a hybrid client-side and server-side suite: the Advertiser MasterTag (a JavaScript library placed sitewide), the Conversion Tag (fired on the order confirmation page), and a server-to-server tracking request. When a consumer clicks a publisher's tracking link, they are briefly redirected via AWIN's domain, which sets a first-party cookie on the advertiser's site recording a click identifier; this identifier is later matched against a conversion to attribute the sale to the referring publisher and calculate their commission. Unlike the analytics and advertising tools covered in earlier guides, AWIN does not build behavioural profiles or personalise content or ads — its processing is limited to attributing transactions to the correct publisher. The configurations below cover the most privacy-relevant settings and their corresponding mappings in the Customer Panel (CP).

Note on legal basis vs. cookie consent: AWIN relies on legitimate interest as its GDPR Article 6 legal basis for its own joint-controller tracking activities, meaning AWIN does not require advertisers or publishers to obtain "data consent" specifically for AWIN's processing. However, this is separate from cookie consent under the ePrivacy rules: if the AWIN cookie is not strictly necessary to deliver a service the consumer has requested, cookie consent must still be obtained before the cookie is set, regardless of AWIN's GDPR legal basis. This means the Consent Banner gate described in row 1 below is an ePrivacy requirement, not a GDPR-consent requirement — but it is mandatory all the same for standard affiliate tracking (see Configuration D for the one documented exception).

Note on data processing without consent: AWIN does offer a genuine configuration in which tracking cookies are processed without prior consent: cookies used for cashback, loyalty, reward, or certain voucher-code activity may, depending on your own assessment, be categorised as "strictly necessary" because they are needed to deliver the service the consumer has actively requested (e.g. receiving cashback). Both the UK ICO and the French CNIL have confirmed this exemption can apply to such cookies. Where this applies, AWIN will set and read the relevant cookie even in the absence of prior cookie consent. This is addressed separately in Configuration D below, since it is not a "higher risk" tier but a distinct, narrower use case.

Note on data retention: AWIN's documented default policy is to delete tracking data after 36 months, via automated deletion routines, unless a longer period is required by law. This is a fixed platform-wide default rather than a per-program configurable setting, so it is not reflected as a separate row in the table below. Separately, the cookie period (commission attribution window) is set per advertiser programme — industry standard, and AWIN's own default, is 30 days, though this can be set differently under your contractual terms.

Step 1 — AWIN Configuration

Configuration A — Low Risk

Use this configuration when AWIN is used solely for standard, single-device affiliate sale or lead tracking, without Cross Device Tracking or Lead Generation data capture. The MasterTag is placed sitewide and reads the AdvertiserConsent property (or the equivalent TCF signal) before setting or reading the AWIN click-identifier cookie; if consent has not been signalled, no cookie is set on the landing page and no first- or third-party cookies are read on the checkout page. Where consent has been signalled, a click identifier set when the consumer followed a publisher's link is matched against the Conversion Tag fired on the order confirmation page, allowing AWIN to attribute the sale to the correct publisher and calculate their commission. No cross-device profile is built, and no consumer name or contact information is captured for lead-generation purposes.

AWIN and the website operator are Joint Controllers (Article 26 GDPR) for this tracking, reporting, and transaction-query processing, as set out in AWIN's Data Processing Addendum. AWIN AG is headquartered and primarily processes data within the EU (Germany), but also relies on cloud infrastructure including AWS's US West region as one of several hosting locations. Where data is processed via this US-based infrastructure, it remains potentially subject to access by US government authorities under the CLOUD Act, since AWS is a US enterprise, even though AWIN AG itself is an EU company. This should be disclosed as a potential US data transfer in the consent banner.

Configuration B — Medium Risk

Use this configuration when AWIN is used for standard affiliate tracking with Cross Device Tracking additionally enabled, allowing sales to be attributed to a publisher even when the consumer clicked the affiliate link on one device and completed the purchase on another. To support this, the advertiser's site passes AWIN an encrypted "user-id" — normally the email address the consumer enters to log in — which AWIN uses, together with device-fingerprint attributes such as screen size and device configuration, to build a pseudonymous profile linking the consumer's devices. As in Configuration A, the cookie is not set or read until consent has been signalled, and no consumer name or contact information is captured.

Cross Device Tracking is explicitly listed in AWIN's Data Processing Addendum as one of the purposes for which AWIN and the website operator act as Joint Controllers, so the same Joint Controller status, EU/US infrastructure split, and CLOUD Act consideration described in Configuration A apply here. This should be disclosed as a potential US data transfer in the consent banner.

Configuration C — Higher Risk

Use this configuration when AWIN is additionally used for Lead Generation tracking — that is, capturing a consumer's name and contact information (such as that submitted via a lead form) on behalf of the advertiser's lead-generation activity, in combination with Cross Device Tracking. As in Configurations A and B, the cookie is not set or read until consent has been signalled.