Privacy Policy

This Privacy Policy explains how personal data is processed when you use Loyalius. That covers our website loyalius.com, the merchant dashboard at app.loyalius.com, and the loyalty cards, join pages and web cards that businesses issue through Loyalius. We follow the General Data Protection Regulation (EU) 2016/679 ("GDPR"), Slovak data protection law and, for people in Ukraine, the Law of Ukraine "On Personal Data Protection".

1. Who is responsible

Two different situations apply:

• We are the controller for data about visitors to our website, the businesses that use Loyalius ("merchants") and their staff, and people who contact us. The controller is Oleksii Andriiuk (details in the box above). Contact: [email protected].
• The merchant is the controller for data about its customers who join its loyalty programme ("cardholders"). If you hold a loyalty card from a café, shop or salon, that business decides how your data is used. We process it only on its behalf, as its processor. Section 4 explains this in more detail.

2. Website visitors

Data	Purpose	Legal basis	How long
Technical data: IP address, browser and device type, pages requested, time, referring page	Delivering the website, security, preventing abuse, fixing errors	Our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR)	Server logs up to 30 days, longer only when needed to investigate an incident
Usage data: pages viewed, clicks, device and browser, approximate location, session recordings with form inputs masked	Understanding how the website is used and improving it	Legitimate interest (Art. 6(1)(f)); analytics cookies only with your consent (section 9)	Up to 12 months
Your language choice	Showing the site in your language	Legitimate interest (Art. 6(1)(f))	As long as the cookie (section 9)
What you send us, for example by email, the chat or a form	Answering you	Steps before a contract, or legitimate interest (Art. 6(1)(b) or (f))	Up to 3 years after the last contact
Email address, if you subscribe to news	Sending news about Loyalius	Your consent (Art. 6(1)(a)), which you can withdraw at any time	Until you unsubscribe

3. Merchants and their staff

Data	Purpose	Legal basis	How long
Account data: name, email, phone, password (stored hashed), role, language	Creating and running your account, logging in, security	Contract (Art. 6(1)(b))	While the account exists, then as section 7 says
Business data: business name, address, locations, VAT and registration numbers, logo	Providing the Service, issuing cards in your name	Contract (Art. 6(1)(b))	While the account exists, then as section 7 says
Billing data: plan, invoices, payment status. Card details are handled by our payment provider; we see only limited data such as card brand and last 4 digits	Billing, accounting, tax	Contract and legal obligation (Art. 6(1)(b), (c))	Invoices and accounting records for 10 years, as the Slovak Accounting Act requires
Usage and security data: logins, actions in the dashboard, session recordings with form inputs masked, IP address, device, error logs	Security, fraud prevention, support, improving the Service	Legitimate interest (Art. 6(1)(f))	Up to 12 months, unless needed for an incident or claim
Support conversations	Helping you, improving support	Contract and legitimate interest (Art. 6(1)(b), (f))	Up to 3 years after the conversation
Service emails: security notices, billing, changes to the Service or Terms	Running the contract	Contract and legal obligation (Art. 6(1)(b), (c))	As above
Product news to existing customers	Telling you about similar Loyalius services	Legitimate interest (Art. 6(1)(f)). You can opt out at any time with the link in each email	Until you opt out

4. Cardholders (customers of businesses that use Loyalius)

Who decides. The business that gave you the loyalty card is the controller of your data. Loyalius is the platform it uses, and we process your data only on its instructions, under a data processing agreement (Annex A to our Terms of Service). The business's own privacy notice tells you more about how it uses your data.

What is processed. It depends on how the business set up its programme:

• name, email address, phone number, date of birth and city;
• your card number and its QR or barcode;
• visits, purchases and amounts recorded at the till, points, stamps, rewards and the location visited;
• your marketing consents and messages sent to you;
• data needed to keep your Apple Wallet or Google Wallet card updated, such as device and push identifiers;
• technical data when you open the join page or web card, such as IP address and browser.

Why. To issue and update your card, record visits and rewards, show your balance and send you the messages the business sets up. You get marketing messages only if you agreed to them. You can withdraw that consent at any time from the card or through the unsubscribe link in the message.

Apple Wallet and Google Wallet. If you add the card to Apple Wallet or Google Wallet, Apple or Google stores and processes the card on your device and in its services under its own privacy policy. You can remove the card from your wallet at any time.

Your rights. Contact the business that issued your card to exercise your rights. If you contact us instead, we will pass your request to that business and help it respond.

How long. For as long as the business keeps you in its programme. If the business closes its Loyalius account, we delete its data as our Terms of Service describe, normally within 90 days of the end of the contract.

5. Who receives data

We do not sell personal data. We share it only as follows:

• Service providers (sub-processors) that help us run Loyalius, under contracts that protect the data:
  • infrastructure providers that host the Service: servers, databases, storage and backups;
  • Resend (email delivery);
  • PostHog (website and product analytics, hosted in the EU);
  • Google (Google Analytics on our website);
  • Crisp (support chat);
  • Apple (Apple Wallet passes and their updates);
  • Google (Google Wallet passes and their updates);
  • our payment provider, for subscription payments.
• The merchant, for its cardholders' data, and integrations the merchant connects, such as its till system.
• Professional advisers, such as accountants and lawyers, bound by confidentiality.
• Authorities and courts, when the law requires it, or to establish, exercise or defend legal claims.
• A successor business, if Loyalius or its business is transferred, for example to a company set up to run it. The successor must keep protecting the data as this Privacy Policy describes.

6. Transfers outside the EEA

Some providers, for example Resend, Apple and Google, may process data outside the European Economic Area, including in the USA. We make sure such transfers are protected. We rely on an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework, or on the European Commission's Standard Contractual Clauses. You can ask us for more information.

7. How long we keep data

We keep data only as long as we need it for the purposes above. The periods are listed in sections 2–4. In addition:

• when a merchant's contract ends, we delete the account and its cardholder data within 90 days, as the Terms of Service describe;
• backups are overwritten in our normal backup cycle;
• we keep data longer only where the law requires it, for example accounting records for 10 years. We also keep it longer where we need it to establish or defend legal claims, until the claim is time-barred.

8. Your rights

Under the GDPR you have the right to:

• access your data and get a copy;
• have it corrected;
• have it deleted;
• restrict its processing;
• data portability;
• object to processing based on legitimate interest, and to direct marketing at any time;
• withdraw consent at any time, without affecting earlier processing.

To use these rights, write to [email protected]. We answer within one month. For complex requests the law lets us extend this by two more months, and we will tell you if we do. We may ask you to confirm your identity.

You may also lodge a complaint with a supervisory authority:

• in Slovakia: the Úrad na ochranu osobných údajov Slovenskej republiky, Hraničná 12, 820 07 Bratislava, dataprotection.gov.sk;
• the authority in the EU country where you live or work;
• in Ukraine: the Ukrainian Parliament Commissioner for Human Rights.

We would appreciate the chance to resolve your concern first.

9. Cookies

Strictly necessary cookies are always on. They need no consent and do not track you across other sites:

• to keep you logged in;
• to protect forms against forgery;
• to remember your language and your cookie choice.

Session cookies expire when you close the browser or log out. The language cookie lasts up to 1 year, and the cookie that stores your choice lasts 6 months.

Optional cookies are set only if you agree:

• Analytics: PostHog (ph_*) and Google Analytics (_ga*) cookies, so we can recognise returning visitors and improve the website and the Service;
• Support chat: Crisp (crisp-client/*) cookies, so the chat keeps your conversation. They are also set when you open the chat yourself.

You can accept, reject or change your choice at any time with Cookie settings in the website footer. Your choice applies to loyalius.com and app.loyalius.com. In the dashboard, the support chat is part of the Service and its cookies are set when you use it. You can also delete or block cookies in your browser settings, but parts of the site may then stop working.

10. Security

We protect personal data with appropriate technical and organisational measures. They include encryption in transit (HTTPS), hashed passwords, access limited to the people who need it, logging, backups and regular updates. No system is completely secure. If a breach affects your data, we will act as the GDPR requires.

11. Children

Loyalius is a service for businesses and is not aimed at children. Merchants must not knowingly enrol children under 16 in their loyalty programmes without the consent of a parent or guardian, where the law requires it.

12. Automated decisions

We make no decisions based solely on automated processing that produce legal or similarly significant effects on you. Merchants can use the Service to group customers and send campaigns automatically, for example a birthday message. These decisions are the merchant's, and they do not have such effects.

13. Changes to this policy

We may update this Privacy Policy. The version and date at the top show the current version. We will tell merchants about material changes by email or in the dashboard before they take effect.

14. Language

This Privacy Policy is written in English. If we provide a translation and it differs from the English version, the English version prevails.