Privacy Policy

1 Who We Are

Data controller: Loyenix Ltd, registered in England and Wales. Website: loyenix.com (loyenix.co.uk redirects to it). Contact: support@loyenix.co.uk

This policy covers three groups of people: merchants (businesses that create and manage loyalty programmes), end customers (people who collect stamps or points), and partners (businesses or individuals in the Loyenix Partner Programme).

2 Data We Collect

Merchants & business users

• Account: name, email, business name, phone number (registration & profile)
• Shop configuration: shop name, address, loyalty card type (stamp card / points card), reward rules, branding assets
• Transaction logs: timestamps, stamps/points awarded, reward redemptions — we do not process customer payment information
• Billing: subscription plan and billing cycle; payment card details are processed and stored exclusively by Stripe — we never see your full card number or CVV
• Technical: IP address, browser type, device type, login timestamps, and in-dashboard usage patterns (page views, features used)

End customers (loyalty card holders)

• No account creation is required — customers interact via a QR code scan link generated by the merchant
• Data linked to a loyalty card: anonymous session token, current stamp/point count, reward redemption history
• If a customer voluntarily shares their name or email with a merchant through the platform, the merchant becomes the data controller for that data — Loyenix processes it only as a data processor on the merchant's instructions

Partners

• Name, email, company name, phone number (via Google Sign-In to the Partner Portal)
• Merchant portfolio details, commission history, payout records, billing status
• For the full partner-specific privacy policy, visit loyenix.com/partner/privacy

3 Legal Basis for Processing (UK GDPR Art. 6)

• Performance of a contract (Art. 6(1)(b)): creating and operating your account, delivering the loyalty card service, processing payments
• Legitimate interests (Art. 6(1)(f)): fraud prevention, security monitoring, improving the platform using anonymised aggregate data
• Legal obligation (Art. 6(1)(c)): financial record-keeping required by HMRC (7-year retention for billing data)
• Consent (Art. 6(1)(a)): marketing emails, optional analytics cookies — you may withdraw consent at any time without affecting prior processing

4 How We Use Your Data

• Provide, operate and maintain the Loyenix loyalty card platform
• Process subscription payments and manage billing via Stripe
• Send account-critical emails: receipts, plan change confirmations, security alerts
• Display loyalty card analytics, stamp activity and customer retention statistics in your merchant dashboard
• Improve the platform based on aggregate, anonymised usage patterns
• Detect and prevent fraud, account abuse and security incidents
• Respond to support requests and technical queries
• Comply with legal and regulatory obligations
• Send product updates or marketing communications (only where you have given consent)

5 Data Sharing & Subprocessors

We do not sell, rent or trade your personal data. We share data only with the following vetted subprocessors who are contractually bound to process data on our instructions only and to maintain appropriate security standards:

We may also disclose data where required by law, court order, or to protect the rights, property or safety of Loyenix, our users or third parties.

6 International Data Transfers

Several subprocessors (Google, Stripe, Vercel) process data in the United States, which is outside the UK and EEA. We legitimise these transfers using:

• Standard Contractual Clauses (SCCs) — approved by the European Commission under EU GDPR Art. 46
• UK International Data Transfer Agreement (UK IDTA) — for transfers from the UK under UK GDPR

To request copies of the transfer documents or for questions about specific mechanisms, contact us at support@loyenix.co.uk.

7 Data Retention

8 Your Rights

Under UK GDPR and EU GDPR, you have the right to:

• Access (Art. 15): request a copy of all personal data we hold about you
• Rectification (Art. 16): request correction of inaccurate or incomplete data
• Erasure (Art. 17): request deletion — merchants can delete their account directly from the dashboard settings
• Restriction (Art. 18): request we pause processing in certain circumstances
• Portability (Art. 20): receive your data in a structured, machine-readable format
• Object (Art. 21): object to processing based on legitimate interests or direct marketing
• Withdraw consent: for marketing communications or analytics cookies at any time

To exercise any right, email us at support@loyenix.co.uk. We will respond within 1 calendar month (extendable to 3 months for complex requests, with prior notice). No fee will be charged unless the request is manifestly unfounded or excessive.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk or by phone on 0303 123 1113. EU users may contact their national supervisory authority.

9 Cookies & Tracking Technologies

We use cookies and similar technologies to keep you logged in and to understand how the platform is used so we can improve it.

• Essential cookies: session authentication, CSRF protection, login state — always active and cannot be disabled without breaking the service
• Analytics (Vercel Analytics): aggregate, anonymised page-view and performance data — placed only after you provide consent via the cookie banner

You can manage or withdraw cookie consent at any time through the consent banner or your browser settings.

10 Data Security

We implement appropriate technical and organisational measures to protect your data:

• TLS encryption for all data in transit
• Encryption at rest via Google Cloud / Firebase infrastructure
• Role-based access controls — staff access data only as needed for their role
• Automatic session expiry and token rotation after inactivity
• Regular security assessments and vulnerability reviews

In the event of a personal data breach likely to affect your rights and freedoms, we will notify the ICO within 72 hours and inform affected users without undue delay.

11 Children's Privacy

The Loyenix platform is intended for business users and is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected such data, please contact us immediately.

12 Third-Party Links & Integrations

The platform may contain links to third-party websites or integrate with third-party services (for example, Google Play for the merchant app). We are not responsible for the privacy practices or content of those third parties. We encourage you to review their privacy policies.

13 Changes to This Policy

We may update this Privacy Policy to reflect changes in our services, data practices, or applicable law. We will notify you of material changes by email or in-app notification at least 14 days before they take effect where possible. Minor clarifications may be published without prior notice. The "last updated" date at the top of this page always reflects the current version.