Last updated: July 30, 2026
1. Who we are
Zamplit is a product-sampling and feedback platform operated by Zamplit Ltd (company number 16948685), registered at 57-61 Mortimer Street, London, England, W1W 8HS.
For most participant data, Zamplit acts as a processor on behalf of the brands that run campaigns on the platform — those brands are the controllers of your data and decide why it is collected. Zamplit acts as a controller for the accounts of brand and portal users (staff logins) and for platform operations data.
2. What data we process, and when
We only process what each step of a campaign needs:
- Campaign sign-up (screener): name, email address, demographic answers (such as age, gender, county), your questionnaire responses, and the consents you give. Technical metadata (browser, device and IP address) is recorded for fraud prevention and is deleted on a rolling schedule (see Retention).
- Sample delivery: postal address, used solely to deliver your sample and cleared automatically afterwards.
- Feedback and reviews: your answers, ratings and free-text feedback about the products you tried.
- Photos and videos (UGC): files you choose to upload, only with your explicit consent.
- Wallet passes: if you add an offer to Apple Wallet or Google Wallet, the pass contains the data shown on it and claim/usage events.
- Competitions: your entry contact details, kept only for winner selection and notification.
- Marketing: your email address and subscription preferences, only where you opted in to hear from a brand.
3. Lawful bases
- Consent (Art. 6(1)(a)) — marketing communications from brands, and any use of your uploaded photos/videos (UGC). You can withdraw consent at any time using the links described in section 6.
- Contract / taking steps at your request (Art. 6(1)(b)) — delivering the sample you signed up for and running the campaign you joined.
- Legitimate interest (Art. 6(1)(f)) — operating and securing the platform: fraud prevention, service emails about your participation, aggregate campaign analytics, and error monitoring.
4. Processors and sub-processors
We use a small, verified set of service providers to run the platform:
- Supabase — database and authentication (all platform data).
- Vercel — hosting and request handling.
- Resend — sending transactional and campaign emails.
- Sentry — error monitoring (EU ingest).
- Google (Wallet) and Apple (Wallet) — only if you add a pass to your wallet.
- AI summarisation provider (via Vercel AI Gateway) — used to summarise aggregate written feedback for brands.
In addition, a brand may connect its own tools (for example Klaviyo, Mailchimp, Salesforce, Google Drive/Ads, Dropbox, or Meta/TikTok/LinkedIn/Microsoft ad platforms). Data only flows to those tools for a campaign you joined with that brand, subject to the consents you gave; ad platforms receive hashed identifiers only. Those connections are the brand's own vendor relationships as controller.
5. How long we keep data
- Delivery addresses — cleared automatically once your latest delivery email is at least 60 days old.
- IP addresses recorded with questionnaire responses — deleted after 90 days (coarse browser/device analytics are retained).
- Competition entry contact details — deleted 90 days after the competition ends.
- Unfinished form drafts — deleted 30 days after they expire.
- Everything else — kept while your participation or subscription is active, and removed immediately when you use the erasure link (section 6).
6. Your rights
You can exercise your GDPR rights yourself. Every campaign email we send includes personal, secure links in the footer that open authenticated pages where you can:
- Access & portability (Art. 15/20) — “Download a copy of my data” gives you a machine-readable file of everything we hold about you.
- Rectification (Art. 16) — “Request a correction” if anything on file is wrong or out of date.
- Erasure (Art. 17) — “Remove my data” deletes your personal data immediately, including from connected brand tools.
- Objection / withdrawal (Art. 21) — “Unsubscribe” stops marketing per campaign or per brand.
Use the “Remove my data” or “Unsubscribe” link in the footer of your most recent campaign email — that personal link proves the request comes from you. If you no longer have those emails, contact support@zamplit.com (section 9). You also have the right to restriction of processing and the right to lodge a complaint with your supervisory authority (in the UK, the ICO).
7. Data security
We apply technical and organisational measures appropriate to the risk: encrypted transport, role-based access with row-level security in the database, signed single-purpose tokens for participant self-service actions, and scheduled deletion jobs that enforce the retention periods above.
8. Changes to this policy
We will post any material changes on this page and update the “Last updated” date above.
9. Contact
For any privacy question or a data subject request you cannot complete with the self-service links above: