Privacy Policy

Smarter Loyalty is a trading name of Dryv-AI Ltd (Company No. 16093995), the provider of the done-for-you digital loyalty service accessible at smarterloyalty.co.uk. We act as a data controller for the personal data described in this policy and are responsible for it under the UK data protection laws.

Where we build and manage loyalty passes on behalf of a business client, that client is also a data controller (or a joint controller with us) for the personal data of their own customers, because they decide why and how that data is used — for example, which rewards to offer and which campaigns to run. We act as a data processor on their behalf for that customer data, under a written agreement that sets out our respective responsibilities.

We collect and process the following categories of personal data:

We only process personal data where we have a lawful basis under UK GDPR Article 6. The lawful basis we rely on most often is:

• Consent — for marketing notifications, referral sharing, review requests, and non-essential cookies. You can withdraw consent at any time.
• Contract — to set up and manage your loyalty programme under our service agreement, and to deliver passes and rewards to your customers.
• Legitimate interests — to operate, secure, and improve our service, to prevent fraud, and to analyse aggregated performance. We carry out a balancing test to ensure your rights do not override these interests.
• Legal obligation — where we are required to retain or disclose data to comply with UK law.

For any special category data (such as health-related information a customer might share with a salon or clinic client), we rely on the explicit consent of the individual and process it only on the business client’s instructions under a written agreement.

We use the personal data we collect to:

• Design, build, launch, and manage your branded Apple and Google Wallet passes.
• Provide and operate the Scanner App, including stamping, points, redemptions, and campaign creation.
• Send push notifications, birthday incentives, milestone rewards, “we miss you” win-backs, and geo-fenced reminders to end customers’ wallets.
• Run referral programmes and request reviews at the point of reward redemption.
• Produce monthly reporting, analytics, and per-employee / per-location insights for business clients.
• Provide ongoing account management and customer support.
• Process payments and manage your subscription.
• Communicate with you about your enquiry, your account, and service updates.
• Maintain the security, integrity, and availability of our service and prevent fraud or abuse.
• Comply with our legal, regulatory, and tax obligations in the UK.

We do not sell your personal data to anyone. We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects, except for the standard segmentation features (such as “At Risk” or “Champion” lifecycle groups) used to target marketing campaigns, which you can opt out of.

We share personal data only with the following categories of recipients, and only to the extent necessary to deliver our service:

• Apple Inc. and Google LLC — to issue and update Wallet passes. These providers process pass data under their own privacy policies as independent controllers of the data they hold.
• Cloud hosting and infrastructure providers — to store and process data securely.
• Email and notification delivery providers — to send transactional and marketing messages.
• Payment processors — to handle subscription billing. We do not store full card details ourselves.
• Analytics providers — to help us understand website and app usage in aggregate.
• Our business clients — who act as data controllers of their own customers’ data and receive reporting and analytics about their loyalty programme.
• Professional advisers and authorities — auditors, lawyers, and UK regulatory or law-enforcement bodies where we are legally required to do so.

All processors we use are bound by written contracts that require them to protect your data to a standard equivalent to UK GDPR and to process it only on our instructions.

We are based in the United Kingdom and primarily store and process personal data within the UK. Some of our service providers (for example, Apple, Google, and certain cloud platforms) may process data outside the UK.

Where this happens, we only transfer personal data where one of the following safeguards is in place:

• The destination has been recognised by the UK Government as providing adequate data protection (an adequacy decision).
• Standard contractual clauses approved under UK GDPR are in place with the recipient.
• Another lawful transfer mechanism applies, such as binding corporate rules or a specific UK GDPR derogation.

You can contact us using the details below if you want a copy of the safeguards we rely on for a particular transfer.

We keep personal data only for as long as is necessary for the purposes set out in this policy, and in line with our retention schedule:

• Business client data — kept for the duration of your subscription, plus 12 months after it ends to allow for account closure, reporting handover, and dispute resolution, unless a longer period is required by law.
• Enquiry form data — kept for up to 24 months after your last interaction so we can respond to follow-up questions, then deleted unless you become a client.
• End customer data — kept for the duration of the relevant business client’s programme. When a client leaves our service, we delete or return their customers’ data in line with our agreement with that client, unless we are legally required to retain it.
• Billing and tax records — kept for up to 6 years to comply with UK tax and accounting requirements.
• Technical and server logs — kept for a maximum of 12 months for security and troubleshooting.

We take the security of personal data seriously and use a range of technical and organisational measures appropriate to the risk, including:

• Encryption of data in transit (TLS) and at rest.
• Strict, role-based access controls so that only authorised staff can access personal data, and only where necessary for their role.
• Isolated data stores for each business client, so one client’s customer data is never commingled with another’s.
• Regular security reviews, patching, and monitoring of our infrastructure.
• Staff training on UK data protection obligations and confidentiality.
• Written contracts with all processors requiring equivalent security standards.

Despite our efforts, no system can be guaranteed to be perfectly secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner’s Office (ICO) within 72 hours where required, and notify affected individuals without undue delay where the risk is high.

As a data subject in the UK, you have the following rights over your personal data. To exercise any of them, contact us using the details in Section 1.

• Right to be informed — to be told how your data is used (this policy).
• Right of access — to receive a copy of the personal data we hold about you.
• Right to rectification — to have inaccurate data corrected.
• Right to erasure — to ask us to delete your data in certain circumstances.
• Right to restrict processing — to ask us to limit how we use your data.
• Right to data portability — to receive your data in a structured, machine-readable format and reuse it.
• Right to object — to object to processing based on legitimate interests or for direct marketing.
• Rights around automated decision-making — not to be subject to solely automated decisions with legal or significant effects, and to obtain human intervention where such decisions occur.
• Right to withdraw consent — at any time, where we rely on consent. Withdrawing consent does not affect the lawfulness of processing before withdrawal.

We respond to valid requests within one month. If a request is complex or numerous, we may extend this by a further two months and will explain why. We do not charge a fee unless a request is manifestly unfounded or excessive.

We will only send you marketing communications where you have consented, or where we rely on the “soft opt-in” under PECR for existing customers in respect of similar products and services. You can opt out at any time by clicking the unsubscribe link in any email, replying “STOP” to any SMS, or contacting us directly.

For end customers, push notifications and geo-fenced reminders are sent only where the customer has added the pass to their wallet and has not disabled notifications. The business client controls which campaigns are sent, and we provide the means for customers to mute or remove a pass at any time.

Our website uses cookies and similar technologies to operate the site, remember your preferences, measure performance, and (with your consent) support marketing. You can manage cookies through your browser settings and our cookie banner. Essential cookies are set without consent because they are necessary for the site to function.

Our service is designed for businesses and the general consumers who visit them. We do not knowingly collect personal data from children under 13. Where a business client’s loyalty programme may be used by minors, the client is responsible for obtaining any necessary parental consent. If you believe a child has provided us with personal data, please contact us and we will take steps to delete it.

If you have a concern about how we handle your personal data, please contact us first using the details in Section 1 — we will investigate and respond promptly.

You also have the right to complain to the UK’s independent supervisory authority, the Information Commissioner’s Office (ICO), at any time. You can contact the ICO at:

We may update this Privacy Policy from time to time to reflect changes in our service, legal requirements, or best practice. We will update the “last updated” date at the top of this page and, where changes are significant, provide a more prominent notice on our website or contact affected individuals directly.

If you have any questions about this Privacy Policy or how we handle your personal data, please get in touch. For data protection enquiries specifically, you can ask for our Data Protection Lead.

Prefer to send a message? You can also reach us through our contact page.