GDPR & Security

We only process personal data where we have a lawful basis under Article 6 of the UK GDPR. For member data processed on behalf of clients, the lawful basis is determined by the client (typically contract or consent), and we act on the client’s instructions. For our own activities:

• Contract — to deliver the service you have engaged us to provide and to manage your subscription.
• Consent — for marketing communications and for any optional data collection, such as analytics. Consent can be withdrawn at any time.
• Legal obligation — where we must keep records for tax, accounting, or regulatory purposes.
• Legitimate interests — for limited, proportionate activities such as service security, fraud prevention, and limited business communications, balanced against your rights.

We collect only the personal data we need to provide, manage, and improve the Service, and we use it only for the purposes we describe. Member data captured through a loyalty pass (such as name, contact details, stamps, points, and visit history) is used solely to run the loyalty programme you have designed — issuing rewards, sending notifications you approve, and producing the reporting you receive.

We do not sell personal data, and we do not use member data for our own marketing or commercial purposes. Any aggregated, anonymised statistics we may use internally cannot identify an individual.

We use a layered approach to protect data in transit and at rest, appropriate to the risk it presents:

• Encryption in transit. All data sent between a customer’s device, our servers, and the wallet platforms is transmitted over TLS (HTTPS) with modern cipher suites.
• Encryption at rest. Personal data stored in our systems is encrypted at rest using industry-standard encryption.
• Secure hosting. Our infrastructure runs on reputable cloud providers with strong physical and environmental security, and data is hosted within the UK/European Economic Area wherever possible.
• Wallet pass security. Apple Wallet and Google Wallet passes are signed and delivered through the platforms’ own secure distribution channels. Passes cannot be tampered with once issued, and access tokens are rotated.
• Scanner App access. The Scanner App authenticates staff per session, and all stamp, redemption, and campaign actions are logged with the user and timestamp.
• Backups & resilience. Data is backed up regularly with encrypted backups, and we maintain recovery procedures to restore service promptly in the event of an incident.

• Access controls. Access to personal data is strictly role-based and limited to staff who need it to do their job. Permissions are reviewed regularly and revoked promptly when no longer needed.
• Staff training. Our team receives data protection training appropriate to their role, and confidentiality obligations form part of their terms of engagement.
• Client-side permissions. Within the Scanner App, you control which staff can stamp, redeem, run campaigns, or view reporting, and you can segment access by location or role.
• Vendor due diligence. We assess our sub-processors for security and data protection before engaging them and put written terms in place that meet UK GDPR requirements.
• Incident response. We maintain a process for detecting, investigating, and responding to security incidents, including notifying affected clients and the ICO where legally required (see clause 7).

We use a small number of trusted sub-processors to deliver the Service, including cloud hosting, the Apple Wallet and Google Wallet platforms, email and notification delivery, and analytics. Each sub-processor is bound by written terms that require them to protect personal data to a standard no less protective than this policy and the UK GDPR.

We will give clients reasonable notice of any new or replacement sub-processor that processes member data, and you may object on data-protection grounds in accordance with the DPA. A current list of sub-processors is available on request.

Where a sub-processors operates outside the UK, we rely only on transfer mechanisms permitted under the UK GDPR — such as adequacy regulations or the International Data Transfer Agreement (IDTA) / UK Addendum to the EU Standard Contractual Clauses — and we carry out a transfer risk assessment. We do not transfer member data outside the UK without an appropriate safeguard in place.

If a personal data breach occurs that is likely to result in a risk to people’s rights and freedoms, we will notify the affected client without undue delay and, where required, assist the client in notifying the Information Commissioner’s Office (ICO) within 72 hours of becoming aware of it. As the data controller for member data, the client is responsible for notifying affected members where the breach is likely to result in a high risk to them.

We keep personal data only for as long as we need it for the purpose it was collected. Member data is retained for the duration of your subscription, plus a short wind-down period so you can export it, after which it is deleted or fully anonymised on your instruction. Business client data (such as billing and contract records) is retained for the duration of the relationship and for the period required by tax and accounting law (typically six years).

Individuals have rights over their personal data under the UK GDPR. For member data, these rights are exercised through the business client (as controller); for our own business data, you can exercise them directly with us. The rights are:

• To be informed about how your data is used.
• Of access to the personal data we hold about you.
• To have inaccurate data rectified.
• To have personal data erased in certain circumstances.
• To restrict or object to processing.
• To data portability.
• To withdraw consent at any time (where processing relies on consent).
• To lodge a complaint with the ICO.

To exercise any of these rights, email us at hello@smarterloyalty.co.uk. We respond within one month, free of charge.

Our website uses a minimal set of cookies and similar technologies for essential functionality and to understand how the site is used so we can improve it. We only set non-essential cookies with your consent, which you can manage or withdraw at any time through your browser settings. Full details are in our Privacy Policy.

Push notifications and campaigns sent to loyalty members are sent on the instructions of the business client, who is responsible for ensuring they have the necessary consent or other lawful basis under PECR and the UK GDPR. We provide tools to honour opt-outs and do not send electronic marketing to members on our own behalf without consent.

As part of our accountability obligations, we maintain records of our processing activities, keep this page under review, and carry out Data Protection Impact Assessments (DPIAs) where processing is likely to result in a high risk to individuals’ rights — for example when introducing significant new features that process member data.

You can contact us about data protection or security at the details below. If you are not satisfied with our response, you have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator.