Privacy Policy

1. Introduction and Definitions

This Privacy Policy explains how Bengologic Ltd, a company registered in England and Wales under company number 16797011, trading as LoyaltiesHub ("Bengologic", "we", "us", or "our"), collects, uses, shares, and protects personal data when individuals ("you", "your", or "user") use the LoyaltiesHub User mobile application and related services (the "App" or "Service").

We are committed to protecting your privacy and handling your data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other applicable data protection laws.

By registering for or using the App, you acknowledge that you have read and understood this Privacy Policy. We encourage you to review it regularly, as it may be updated from time to time.

Key terms used in this Privacy Policy

• "Personal Data" means any information relating to an identified or identifiable natural person, such as your name, email, phone number, or location.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, or deletion.
• "Participating Business" means a third-party merchant, restaurant, or venue that has joined the LoyaltiesHub platform to provide loyalty rewards to customers.
• "Reward Transaction" means any instance where a user earns or redeems loyalty points by presenting their unique QR code to the participating business. The participating business then scans the QR code to process the transaction.

2. Scope of Policy and Data Controller Information

This Privacy Policy applies to all personal data collected through the LoyaltiesHub App, including information collected from both users and Participating Businesses.

LoyaltiesHub acts as the data controller for the processing of personal data described in this policy. This means we determine the purposes and lawful bases for which personal data is processed.

Each Participating Business that uses LoyaltiesHub to operate its own loyalty programme acts as an independent data controller in relation to the customer data it receives through the platform. Each such business is responsible for ensuring its own compliance with data protection laws and should provide its own privacy notice to users.

3. Information We Collect

We only collect the personal data necessary to operate the App and deliver our loyalty rewards service.

When you register for an account or use the App, we may collect the following categories of information:

Identification and Contact Data

Your name, email address, phone number, and home address.

Account Information

Your username, password, and account preferences.

Transaction Data

Records of your loyalty activity with Participating Businesses, including the amount spent, the date and time of the transaction, and the employee name associated with the sale.

Location Data

Your GPS location is used temporarily to show nearby Participating Businesses and your distance from stores. This location data is not stored, logged, or retained after use.

Business Account Data

For Participating Businesses, we may collect representative names, business contact details, and transaction records necessary to administer loyalty rewards.

We do not collect or possess sensitive personal data (special category data) such as information about your health, political opinions, or religious beliefs.

The App does not use third-party analytics, tracking technologies, targeted advertising, or social media integrations.

We do not knowingly collect personal data from individuals under the age of 13. If you believe a minor has provided us with personal data, please contact us, and we will remove that data promptly.

All categories of data described above are processed only where we have a lawful basis as set out in Section 4.

4. How We Use Your Personal Data

We use your personal data only for the purposes described below and in accordance with UK GDPR.

The lawful bases for our processing are contractual necessity, legitimate interests, and, where applicable, consent.

Specifically, we use your data to:

• Provide and maintain the App: to enable account creation, login, and participation in loyalty programmes.
• Facilitate reward transactions: to record points earned and redeemed at Participating Businesses and display your progress toward rewards.
• Show nearby businesses: to display a map of available locations using your device's real-time location (without storing that data).
• Manage business relationships: to allow Participating Businesses to verify loyalty transactions, view customer activity, and issue rewards.
• Communicate with you: to send service notifications, respond to support requests, or update you about technical or security issues.
• Ensure security and prevent misuse: to detect fraudulent activity or violations of our Terms.
• Comply with legal obligations: to meet requirements under applicable law, accounting, and tax regulations.

We will not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.

5. Sharing Your Data

We do not sell or rent your personal data. We only share it in the limited circumstances described below and always in accordance with UK GDPR.

With Participating Businesses

• When you scan a QR code or earn or redeem a reward, the relevant Participating Business receives the transaction details necessary to verify and credit your loyalty points.
• This includes your name, date and time, and the name of the employee processing the transaction.
• Each Participating Business acts as an independent data controller and is responsible for its own handling of that data under its own privacy policy.

With Service Providers

• We use trusted third-party service providers, such as Amazon Web Services (AWS), solely to host and maintain the App infrastructure.
• These providers act as data processors and process data only on our documented instructions.
• All third-party processors are bound by written agreements meeting Article 28 UK GDPR requirements.

With Marketing Partners

• With your consent, we may share limited personal data (such as your name, email address, or phone number) with trusted, GDPR-compliant third-party companies for the purpose of delivering marketing, promotional, or advertising content relating to LoyaltiesHub or Participating Businesses.
• These marketing activities may include joint promotions, reward campaigns, or special offers run in collaboration with Participating Businesses.
• All such third parties act under written agreements that ensure compliance with UK GDPR and restrict the processing of your data to these specified purposes only.
• You can withdraw your consent or opt out of receiving marketing communications at any time by following the unsubscribe link in our emails or by contacting us at [email protected].

For Legal and Compliance Reasons: We may disclose personal data if required by law, court order, or regulatory authority, or if necessary to protect our rights, investigate suspected misuse, or ensure the security of our systems.

Business Transfers: If Bengologic Ltd is involved in a merger, acquisition, or sale of assets, user data may be transferred as part of that transaction. You will be notified before any change in data control takes effect.

We do not share personal data with advertisers, analytics companies, or social-media platforms.

6. Data Retention

We retain personal data only for as long as necessary to provide the Service, fulfil the purposes described in this Privacy Policy, and meet our legal or regulatory obligations.

Specifically:

• User Account Data: retained while your account remains active. If you request deletion or your account becomes inactive, we will delete or anonymise your data within 12 months, unless a longer period is required by law (for example, to comply with tax or accounting requirements).
• Transaction Data: retained for the same period or longer if required to meet financial or legal obligations.
• Business Account Data: retained while the business remains active on the platform and for up to 12 months following termination unless deletion is requested earlier.
• Location Data: used in real time only and not stored or logged.

When data is no longer required, it is securely deleted or anonymised in accordance with industry standards. Users and businesses may request deletion of their data at any time, and we will comply unless retention is legally required.

We periodically review stored data to ensure that it remains necessary for the purposes for which it was collected.

7. Data Security

We take data security seriously and implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction.

These measures include encryption in transit and at rest, restricted administrative access, secure password requirements, and regular security monitoring.

While we strive to use commercially acceptable standards to safeguard data, no method of electronic transmission or storage is completely secure. You acknowledge this inherent risk when using online services.

If we become aware of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you and the Information Commissioner's Office (ICO) in accordance with our legal obligations.

8. International Data Transfers

We primarily store and process personal data on servers located in the United Kingdom.

However, our cloud hosting provider, Amazon Web Services (AWS), may process or store data in other jurisdictions, including within the European Economic Area (EEA) or other regions offering adequate protection.

Where data is transferred outside the UK and EEA, we ensure that appropriate safeguards are in place, such as the UK Addendum to the EU Standard Contractual Clauses (SCCs) or other approved transfer mechanisms.

By using the App, you acknowledge that such transfers may occur and that they are necessary for the performance of our services.

9. Your Data Protection Rights

You have the following rights under the UK GDPR regarding your personal data:

• Access: to request a copy of the personal data we hold about you.
• Rectification: to request correction of inaccurate or incomplete data.
• Erasure: to request deletion of your data where there is no lawful reason for us to keep it.
• Restriction: to limit how we process your data in certain circumstances.
• Data Portability: to receive your data in a structured, machine-readable format and transfer it to another controller.
• Objection: to object to processing based on legitimate interests.
• Withdrawal of Consent: where processing is based on consent, such consent can be withdrawn at any time.

You can exercise these rights by contacting us at [email protected]

We may need to verify your identity before fulfilling a rights request and will respond within one month, as required by law.

Complaints: If you believe we have not handled your data in accordance with the law, you have the right to complain to the Information Commissioner's Office (www.ico.org.uk) or your local supervisory authority.

10. Updates to This Policy

We may update or modify this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons.

When we make updates, we will post the revised version within the App and modify the "Last Updated" date shown at the top of this policy.

You are encouraged to review this Privacy Policy periodically to stay informed about how we protect your personal data. Continued use of the App after changes are posted will constitute your acknowledgement and acceptance of those changes.