Privacy policy
Last updated: October 2026
This policy explains how your personal data is handled when you join a loyalty program run by a business using Loyalty. It is written to comply with the EU and UK GDPR, the Saudi Personal Data Protection Law (PDPL) and Tunisian Organic Law 2004-63.
Who is responsible
The business whose card you joined (café, salon, shop…) is the data controller. Loyalty acts as its processor: we host the program and generate your wallet card on its behalf and only on its instructions.
Data we collect
Your first name; your mobile number or email address; optionally your birthday (day and month only); your preferred language; your consent choices; your card balance and visit history (date, location, staff member). To prevent abuse we also record technical data such as an anonymous device hash and IP address. Phone numbers and emails are encrypted at rest.
Why we use it
To create and update your loyalty card in Apple Wallet or Google Wallet, to find your card at the counter, to grant rewards, to send you service messages about your card and — only if you agreed — offers and news, and to detect fraud.
Legal basis
Running your card is necessary to provide the program you asked to join (contract). Marketing messages rely on your consent, which you can withdraw at any time. Fraud prevention relies on the business’s legitimate interest.
How long we keep it
As long as your card is active, then only for the period the business needs to keep it. When you delete your card, your data is anonymised immediately. Anonymous statistics may be kept.
Who receives it
Only the business and its staff, and the subcontractors needed to run the service: hosting, Apple and Google (to deliver your wallet card), and email or WhatsApp providers when messages are sent. Your data is never sold.
International transfers
When data is processed outside your country, appropriate safeguards required by the GDPR or the PDPL (such as standard contractual clauses) are applied.
Your rights
You can access, correct, export or delete your data, object to its use and withdraw your consent at any time. You can also complain to your data protection authority (CNIL in France, ICO in the UK, SDAIA in Saudi Arabia, INPDP in Tunisia).
Delete your card
Open your card in your wallet, show its details (“i” or “⋯”) and tap “Delete my card and my data”. Your card is invalidated and your data anonymised immediately.
Contact
For any request, contact the business where you joined the program. It can forward your request to Loyalty if needed.