GoLoyal Privacy Policy

1. Types of data we collect

We may collect and process the following categories of personal data.

Website and setup enquiries

If you use the "Get Your Loyalty Card Set Up" enquiry form on our website, we may collect:

• business name;
• contact name;
• business type;
• town or area;
• email address;
• phone number, if you choose to provide one;
• the loyalty objective you select;
• any additional message you choose to send us; and
• your marketing preference where an optional marketing checkbox is presented.

The current homepage enquiry form sends the enquiry to GoLoyal through our configured email system. It does not automatically create a customer account or write the enquiry into a separate CRM or GoLoyal customer database.

We also use security information associated with the form, such as WordPress security nonces, a short-lived signed form token and temporary rate-limiting information, to help protect the form from misuse. These security controls are not used for marketing.

Data about Merchants and account users

Depending on the account or onboarding process you use, we may collect:

• name and contact details, such as your email address;
• business name;
• login credentials, with passwords stored in hashed form rather than readable plain text;
• account, subscription and entitlement information;
• usage information about how you access and use the GoLoyal dashboard;
• records relating to acceptance of applicable GoLoyal terms, where such acceptance is required; and
• marketing preference, consent, unsubscribe or suppression information where an applicable optional marketing process is used.

Data about loyalty customers

When a Merchant uses GoLoyal, we may process data about that Merchant's loyalty customers on the Merchant's behalf, including:

• loyalty card or customer-card-instance identifiers;
• Google Wallet and Apple Wallet pass or object references where applicable;
• stamps, points, reward history and milestone or redemption information;
• expiry dates and loyalty-card status;
• basic contact details if collected by the Merchant, such as a name or email address, subject to the particular loyalty programme and configuration; and
• security or access identifiers used to identify and protect access to a customer's loyalty card.

GoLoyal may send service-related access, verification or other operational communications to loyalty customers where these are required for the operation of an applicable loyalty programme.

Billing and payment data

GoLoyal uses Stripe to process subscription billing and payments. Payment-card information entered into Stripe's payment services is handled by Stripe rather than being stored directly by GoLoyal.

GoLoyal may store limited structured billing and subscription information required to manage account entitlement, billing status and audit history. This may include Stripe customer or subscription identifiers, event identifiers, billing status and cryptographic hashes used for audit or verification purposes.

GoLoyal does not intentionally store payment card numbers, CVCs, raw payment-method data, raw Stripe webhook payloads or Stripe-Signature headers in its application records.

Billing-related communications, such as receipts, invoices or payment-failure notices, may be provided by Stripe depending on the configuration of the relevant Stripe services.

Analytics, technical and usage data

When you use our websites or dashboard, we may process technical information required to operate, measure and secure the service, including:

• browser and device information;
• server and security logs;
• session, login and security cookies or similar identifiers;
• security nonces and temporary security-state information;
• pages visited and referral information;
• general engagement information, such as session activity, scrolling and interactions with website forms; and
• approximate geographic information made available through analytics services.

We use Google Analytics 4 ("GA4") on the GoLoyal marketing website to help us understand how the website is being used. GA4 is deployed through Google Site Kit and is subject to the visitor's applicable cookie and analytics-consent choices.

We do not intentionally send the contents of the GoLoyal setup-enquiry form, such as your name, email address, phone number or message, to Google Analytics.

2. How we use personal data

We use personal data for purposes including the following.

Website and setup enquiries

If you submit a GoLoyal setup enquiry, we use the information you provide to:

• receive and review your enquiry;
• contact you about what you would like your loyalty programme to achieve;
• recommend an appropriate GoLoyal setup;
• provide the assisted setup or onboarding support you have requested;
• send a confirmation that we have received your enquiry; and
• maintain reasonable records of our discussions and business relationship.

A successful homepage enquiry is treated as received only after our internal notification email has been accepted by the configured WordPress email system. A separate confirmation email may then be sent to the email address you provided.

Providing the GoLoyal Service

• To create and manage Merchant accounts
• To create and manage digital loyalty programmes and individual customer loyalty cards
• To generate and manage Google Wallet and Apple Wallet passes where those options are used
• To process loyalty activity such as stamps, points, rewards, redemptions and milestones
• To manage subscription billing and entitlement through Stripe
• To respond to support requests and communicate about the Service
• To monitor, secure, maintain and improve the Service
• To diagnose faults and prevent misuse or unauthorised activity
• To comply with legal and regulatory obligations

Terms and account records

Where an account or onboarding flow requires you to accept GoLoyal's Terms of Service, we may retain limited evidence of that acceptance. Depending on the applicable flow, this may include information such as the acceptance date or time, the Terms version or URL and the source of the acceptance event.

Such information is used to administer our contractual relationship and to provide evidence of the terms agreed. It is not used as marketing consent.

Marketing communications

Where GoLoyal presents an optional marketing checkbox, marketing consent is separate from accepting our Terms or submitting an enquiry for service.

On the current homepage setup-enquiry form, your marketing choice is recorded with the enquiry. Submitting the enquiry does not itself require you to agree to marketing.

Where GoLoyal uses a business-owner email-marketing process, MailPoet may be used to manage the relevant subscription, confirmation, unsubscribe and suppression state. Where double opt-in applies, marketing emails are only sent after the required confirmation has been completed.

You can withdraw marketing consent or unsubscribe from marketing communications at any time using the unsubscribe method provided in the communication or by contacting us.

We may retain limited suppression information after an unsubscribe so that we can respect your request and avoid unwanted re-subscription.

Transactional and service communications

We may send emails or other communications that are necessary to provide or administer the Service, such as enquiry confirmations, account information, access or verification messages, operational notices and billing-related communications.

These service communications are separate from optional direct marketing.

Website analytics

Where the required consent has been provided, we use Google Analytics 4 to understand matters such as website usage, visitor engagement, traffic sources and how visitors interact with the GoLoyal marketing website.

We use this information to understand whether the website is working effectively, identify areas that may need improvement and measure the general effectiveness of our marketing activity.

Loyalty customer data

We generally process information relating to GoLoyal's own business relationships, website enquiries and Merchant accounts as a data controller.

When a Merchant uses GoLoyal to process information about that Merchant's own loyalty customers, GoLoyal will generally process that information as a data processor acting on the Merchant's instructions. The Merchant remains responsible for its own relationship with those customers, including providing any privacy information and identifying an appropriate lawful basis for its processing.

3. Legal bases for processing

Where the UK GDPR or EU GDPR applies, we rely on one or more of the following legal bases depending on the particular processing activity:

• Contract - where processing is necessary to provide the Service, administer an account or take steps you have requested before entering into a contract.
• Legitimate interests - for example to respond to business enquiries, operate and secure our services, prevent misuse, improve our services, maintain appropriate business and billing records, and communicate necessary non-marketing information.
• Consent - for optional direct marketing and for non-essential cookies, analytics or similar technologies where consent is required. You may withdraw consent at any time.
• Legal obligation - where processing is necessary to comply with applicable laws or regulatory requirements.

Where we rely on legitimate interests, those interests include operating a secure and effective loyalty service, responding to people who ask about GoLoyal, managing our commercial relationships, understanding and improving our services, and protecting GoLoyal and its users from misuse.

Where Merchants collect or use personal data about their own loyalty customers, Merchants are responsible for identifying an appropriate lawful basis and for providing any privacy information required for their own processing.

4. Sharing your information

We may share or make personal data available to service providers where this is necessary to operate GoLoyal. Depending on the service being used, these may include:

• website hosting, infrastructure, security and technical service providers;
• email and transactional-message delivery providers;
• Stripe for subscription billing and payment services;
• Google in connection with Google Analytics, Google Site Kit and Google Wallet where applicable;
• Apple in connection with Apple Wallet where a user chooses to use that service;
• CookieYes in connection with the management of website cookie and consent preferences;
• MailPoet where an applicable GoLoyal business-owner marketing process uses it;
• professional advisers such as lawyers, accountants and auditors;
• regulators, law enforcement agencies, courts or other authorities where disclosure is required or permitted by law; and
• another organisation in connection with a sale, merger, restructuring or similar business transaction.

We do not sell personal data.

Where a provider processes personal data on our behalf, we take appropriate steps to require the provider to protect that information and use it only for authorised purposes.

Some third-party services, including payment, analytics and wallet providers, also process information under their own terms and privacy policies for aspects of their services that they control.

5. International transfers

Some of the third-party services used by GoLoyal may process personal data outside the United Kingdom or European Economic Area.

Where international transfers of personal data require safeguards, we take reasonable steps to ensure an appropriate transfer mechanism is available. Depending on the destination and provider, this may include applicable adequacy regulations, contractual safeguards such as the UK International Data Transfer Agreement or UK Addendum to standard contractual clauses, or another legally recognised transfer mechanism.

If you would like more information about the safeguards relevant to a particular transfer involving your personal data, contact us at info@goloyal.co.uk.

6. Data retention

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected, including providing the Service, responding to enquiries, maintaining appropriate business records, complying with legal obligations, resolving disputes and establishing or defending legal claims.

Website and setup enquiries

We retain setup-enquiry emails and related correspondence for as long as reasonably necessary to respond to the enquiry, provide requested follow-up, administer any resulting business relationship and maintain appropriate business records.

If an enquiry does not lead to an ongoing relationship, we periodically review whether the information is still required and delete or anonymise it when there is no longer a reasonable business or legal need to retain it.

Owner account data

We generally retain account profile, login and service information for as long as the account remains active and for a reasonable period afterwards where this is necessary to handle outstanding matters, maintain appropriate records or comply with legal obligations.

Terms and acceptance evidence

Where we record evidence of acceptance of GoLoyal's Terms, we may retain that evidence for the duration of the relevant relationship and afterwards for so long as it is reasonably required to demonstrate the agreement or establish, exercise or defend legal claims.

Marketing consent and suppression data

Where marketing consent records are maintained, we retain the information needed to demonstrate and manage that consent for as long as it remains relevant.

If you withdraw consent or unsubscribe, we may retain limited suppression information for as long as necessary to ensure that your preference continues to be respected.

Billing and subscription data

We retain billing, subscription and entitlement records for as long as reasonably necessary for account administration, financial record-keeping, billing disputes, fraud prevention and legal or regulatory obligations.

Where applicable, GoLoyal retains structured billing-event information rather than raw payment-card data or raw Stripe webhook payloads.

Customer loyalty data

Customer loyalty data processed on behalf of Merchants is generally retained for as long as required to provide the applicable loyalty service and according to the Merchant relationship, applicable deletion requirements and legal obligations.

Loyalty transaction and reward records may be retained where required as part of the platform's operational or audit history.

Website analytics

Google Analytics data is retained according to the settings configured for GoLoyal's Google Analytics property and Google's applicable service controls. We review analytics information and settings according to our measurement needs and do not intend to keep identifiable or user-level analytics information for longer than it is reasonably required.

Cookie and consent preferences

Information required to remember or manage your cookie and consent choices may be retained for as long as reasonably necessary to apply those preferences and, where applicable, demonstrate or administer consent.

Anonymised information

We may anonymise information so that it can no longer reasonably identify an individual. Anonymised or aggregated information may then be retained and used for analytics, service improvement and business reporting.

7. Cookies and similar technologies

GoLoyal uses cookies and similar browser technologies for essential website functions and, where permitted by your choices, website analytics.

Essential technologies

Essential technologies may include:

• session and login cookies required to keep account users securely signed in;
• security cookies, nonces and other security mechanisms used to protect forms and requests;
• temporary identifiers required for secure account, checkout or application flows; and
• CookieYes preference information required to remember and apply your cookie choices.

These technologies are used where they are necessary to provide, secure or remember choices relating to the service. Blocking essential technologies may prevent parts of the website, dashboard or loyalty-card experience from working correctly.

Google Analytics

GoLoyal uses Google Analytics 4 to understand how visitors use the marketing website.

Analytics may process information such as pages viewed, referral source, browser or device information, general engagement activity, approximate location and interactions such as scrolling or use of website forms.

Google Analytics is deployed through Google Site Kit. Google Consent Mode is used with the site's consent-management setup so that Google's measurement behaviour can respond to the visitor's applicable consent choices.

For visitors for whom consent is required, non-essential analytics is subject to the choice made through the site's cookie-consent controls.

Google states that Google Analytics does not log or store individual IP addresses in Google Analytics. IP information may be processed during collection for purposes such as routing and deriving coarse geographic information before being discarded in accordance with Google's applicable Analytics processes.

CookieYes and your preferences

GoLoyal uses CookieYes as its visible cookie and consent-management platform. CookieYes allows visitors to make choices about non-essential cookies and technologies.

You can reject non-essential cookies where that option is presented, and you can change or withdraw your cookie choices later using the CookieYes cookie-preference control available on the website.

You can also manage or remove cookies through your browser settings. Browser settings are separate from the consent preferences managed through the website.

8. Your rights

Depending on the circumstances and applicable law, you may have rights in relation to your personal data, including:

• the right to ask for access to personal data we hold about you;
• the right to ask us to correct inaccurate or incomplete information;
• the right to ask us to erase personal data in certain circumstances;
• the right to ask us to restrict processing in certain circumstances;
• the right to object to certain processing based on legitimate interests;
• the right to object to direct marketing at any time;
• the right to data portability where applicable; and
• the right to withdraw consent where our processing relies on consent.

Withdrawing consent does not affect processing that was lawful before the withdrawal.

If you have opted in to GoLoyal marketing emails, you can unsubscribe using the method provided in the email or contact us directly.

You can change or withdraw applicable cookie and analytics choices through the CookieYes cookie-preference controls on the website.

To exercise a data-protection right, contact us at info@goloyal.co.uk. We may need to verify your identity before responding to a request.

If you are a loyalty customer of a Merchant using GoLoyal, please normally contact that Merchant first in relation to data the Merchant controls. Where GoLoyal processes that information on the Merchant's behalf, we may refer or assist with your request in accordance with the Merchant's instructions.

You also have the right to complain to the relevant data-protection authority. In the United Kingdom this is the Information Commissioner's Office (ICO).

GoLoyal Ltd is registered with the Information Commissioner's Office under registration number ZC102295.

9. Google Wallet, Apple Wallet and third-party services

GoLoyal supports Google Wallet and Apple Wallet as part of its current loyalty-card service.

Where you choose to add or use a loyalty card through Google Wallet or Apple Wallet, information required to provide that wallet functionality may be exchanged with the relevant wallet provider.

Your use of Google Wallet or Apple Wallet is also subject to the relevant provider's own terms and privacy policy. GoLoyal does not control how Google or Apple processes information within their own wallet services.

Similarly, where you use third-party services such as Stripe or interact with links to websites or services operated by another organisation, the third party may process information under its own privacy policy and terms.

10. Security

We use technical and organisational measures intended to protect personal data and reduce the risk of unauthorised access, alteration, disclosure or loss.

Measures used within the GoLoyal service include access controls, validation and sanitisation of submitted information, secure tokens and nonces, restricted administrative functions, encrypted connections, hashed or cryptographic identifiers where appropriate, and security controls around loyalty-card and billing operations.

No internet or electronic-storage system can be guaranteed to be completely secure. We therefore review and improve our safeguards as the service develops.

11. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes to GoLoyal, the technologies or providers we use, or applicable legal and regulatory requirements.

The latest version will be available at https://goloyal.co.uk/privacy/ and will show the date it was last updated.

If we make a significant change to how we use personal data, we will take reasonable steps to bring that change to the attention of affected individuals where appropriate.