FaveCard Acceptable Use Policy

This Acceptable Use Policy (the "AUP") sets out the rules that govern your use of the FaveCard service (the "Service", operated by Qualityc Łukasz Fryc, NIP 7372138804). The AUP is incorporated by reference into the FaveCard Terms of Service under Section 1 of the Terms, and a violation of the AUP is a violation of the Terms.

The AUP exists for two reasons:

1. To protect End Customers from spam, abuse, and unlawful processing of their personal data; and
2. To protect FaveCard's reputation and the deliverability of the email infrastructure that all customers share.

The rules below are not exhaustive — common sense and applicable law apply in addition. If you are unsure whether something is allowed, ask us at privacy@favecard.co before doing it.

1. General principles

• You may use the Service only for lawful business purposes.
• You may use the Service only in a way that respects the rights, dignity, and choices of End Customers.
• You may not use the Service in any way that creates a risk of harm to End Customers, to other FaveCard customers, to FaveCard, or to FaveCard's infrastructure providers.
• You are solely responsible for the content of any communications you send through the Service, the truthfulness of claims you make in them, and the legality of the goods or services you advertise.

2. Marketing communications and consent

2.1 Consent before marketing

You may send marketing communications through the Service only to End Customers who have given valid consent to receive them, in accordance with the GDPR (Article 6(1)(a) and Article 7), the ePrivacy Directive 2002/58/EC, the CAN-SPAM Act, the Australian Spam Act 2003, and any other applicable anti-spam regime.

For End Customers who sign up through the FaveCard signup form, consent is captured by the marketing checkbox on that form, and FaveCard maintains the audit trail (see clause 4.1(d) of Schedule 4 to the DPA). Your responsibility is to ensure that the marketing checkbox is configured truthfully and that any marketing you subsequently send matches the description shown to the End Customer at the moment of consent.

2.2 Imported lists — explicit prohibition without consent provenance

You may not import or upload to the Service:

• email lists obtained from a third party (purchased, scraped, traded, "co-registered," or otherwise sourced from outside your direct relationship with the End Customer);
• email lists collected without an explicit, documented opt-in by the recipient to receive marketing from your business specifically;
• email lists for which you cannot, on FaveCard's request and without unreasonable delay, produce consent provenance — that is, evidence of the source, date, capture mechanism, and exact wording of the consent shown to the recipient at the moment of capture.

Importing your own customer list collected outside FaveCard is permitted only where each entry on that list satisfies the consent-provenance requirement above.

2.3 Suppression and unsubscribes

• You must include a clear, working unsubscribe mechanism in every marketing communication.
• You must process unsubscribe requests within seventy-two (72) hours and never re-add an unsubscribed recipient without fresh, documented consent.
• You must respect manual suppression requests sent by End Customers to FaveCard at privacy@favecard.co as if they had been received by you directly.

2.4 Frequency and content

• Do not send marketing communications at a frequency that would amount to harassment (as a rule of thumb, more than one marketing message per recipient per week is on the high end and should be justified by genuine new value; daily sends are usually unacceptable).
• Do not use deceptive subject lines, misleading sender names, or "from" headers that conceal the sender's identity.
• Do not falsify routing information, headers, or other technical metadata.

3. Prohibited content and categories

3.1 Categories of End Customers you may not communicate with

You may not use the Service to communicate with, or to process the personal data of:

• Children under sixteen (16) years of age;
• Persons subject to comprehensive sanctions imposed by the European Union, the United Nations, the United Kingdom, or the Office of Foreign Assets Control of the United States;
• Persons who have previously withdrawn consent or unsubscribed from your communications, except as expressly permitted by Section 2.3.

3.2 Prohibited categories of personal data

You may not submit to the Service any personal data that is:

• "Special category data" within the meaning of Article 9 GDPR — including health, biometric, genetic, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, sex life, or sexual orientation data;
• Criminal-conviction or offence data within the meaning of Article 10 GDPR;
• Payment card numbers, CVV codes, expiry dates, or any other payment card data beyond what is processed by Stripe directly (Stripe handles payment card data outside the FaveCard data store).

3.3 Prohibited categories of goods, services, or content

You may not use the Service to promote, sell, or facilitate the sale of:

• Regulated financial services for which you are required to hold an authorisation that you do not hold (for example, investment advice, consumer credit, securities, or cryptocurrency services regulated under EU or national law);
• Controlled substances, including pharmaceuticals requiring a prescription, narcotics, and any drug-precursor chemicals;
• Tobacco, e-cigarettes, vaping products, where the marketing of such products to consumers is restricted under applicable law;
• Alcohol, where the marketing of such products to consumers is restricted under applicable law;
• Gambling, betting, or games of chance, except where you are licensed in the jurisdictions of all recipients and the communication is targeted only to lawfully eligible recipients;
• Sexual services, adult content, or escort services;
• Weapons, ammunition, explosives, or military equipment;
• Counterfeit, stolen, or illegal goods of any kind;
• Pyramid schemes, multi-level marketing, or any "get-rich-quick" scheme;
• Hate speech, discrimination, harassment, or content that incites violence;
• Defamatory, obscene, abusive, threatening, or otherwise unlawful content;
• Any other goods, services, or content that are illegal in the End Customer's jurisdiction.

3.4 Truthful representation

You must not misrepresent the goods or services advertised, the nature of your business, the size or location of your operation, or the price or terms of any offer. Loyalty programmes must reflect a genuine commercial relationship and cannot be used as a pretext to capture personal data for an unrelated purpose.

4. Technical use of the Service

You may not, and may not allow any third party to:

• (a) interfere with or disrupt the integrity, performance, or security of the Service;
• (b) probe, scan, or test the vulnerability of any FaveCard system or network without prior written consent;
• (c) circumvent, disable, or attempt to defeat any security or access-control feature;
• (d) use any automated means (bots, scrapers, crawlers) to access the Service or extract data, except through documented APIs within their published rate limits;
• (e) reverse engineer, decompile, disassemble, or attempt to derive the source code of the Service, except where expressly permitted by mandatory law;
• (f) resell, rebrand, or offer the Service to third parties as your own service without our express written authorisation;
• (g) exceed the usage limits of your subscription plan in a way that degrades Service performance for other customers.

5. Notification obligation when you receive a complaint

You must notify FaveCard at privacy@favecard.co within twenty-four (24) hours of receiving any of the following in connection with your use of the Service:

• a complaint from an End Customer alleging that they did not consent to your communications, or that they cannot unsubscribe;
• a notice or inquiry from a data-protection supervisory authority (in Poland: UODO; elsewhere: the local equivalent);
• a court order, subpoena, or other legal process compelling action in respect of personal data processed through the Service;
• a substantiated abuse report from an internet service provider, an email-blocklist operator, or another infrastructure provider;
• a media or press inquiry suggesting that your use of the Service may have caused harm or violated law;
• any other event that, in your reasonable judgment, may give rise to liability for you, for FaveCard, or for End Customers in connection with the Service.

The notification must include enough information to enable FaveCard to assess the situation (a copy of the relevant correspondence is usually sufficient). You must cooperate in good faith with FaveCard's response.

Failure to notify within the 24-hour window is itself a material breach of this AUP.

6. Monitoring and detection

FaveCard does not actively read or screen the substance of customer communications. However, FaveCard monitors aggregate signals that indicate possible AUP violations, including:

• bounce rates above industry-normal thresholds;
• spam-complaint rates above industry-normal thresholds;
• unsubscribe rates above industry-normal thresholds;
• sudden volume spikes that are inconsistent with the customer's previously observed pattern;
• abuse reports received at FaveCard's abuse address;
• supervisory authority correspondence relating to the customer's use of the Service.

When such signals appear, FaveCard may inspect the relevant communications to the extent necessary to investigate.

7. Consequences of violation

7.1 Notice and cure (where appropriate)

For violations that are minor, isolated, or clearly inadvertent, FaveCard will normally notify the customer in writing, identify the violation, request a cure, and (where appropriate) give the customer a reasonable period to cure (typically up to 14 days, shorter if the situation requires).

7.2 Immediate suspension

FaveCard may immediately suspend the customer's account, the affected outbound communication channel, or specific Service features, without prior notice, where:

• the violation creates a material risk of harm to End Customers, to other FaveCard customers, to FaveCard, or to FaveCard's infrastructure providers;
• the violation involves a prohibited category under Section 3 of this AUP;
• the violation involves importation of an email list without consent provenance under Section 2.2;
• the customer has failed to notify FaveCard of a complaint or regulatory inquiry within the 24-hour window required by Section 5;
• a supervisory authority has instructed FaveCard to take action in respect of the customer.

Suspension does not relieve the customer of any payment obligations for the suspension period, except where FaveCard agrees otherwise.

7.3 Termination

FaveCard may terminate the customer's account in cases of:

• repeated violations of this AUP after notice and cure;
• a single violation of an egregious or wilful nature;
• continued violation after suspension under Section 7.2;
• a finding by a court or supervisory authority of unlawful processing materially attributable to the customer's use of the Service.

Termination is governed by Section 10 of the Terms of Service.

7.4 Cooperation with authorities

FaveCard reserves the right to disclose information about a customer's use of the Service to a supervisory authority, court, or law-enforcement body where required by law or where, in FaveCard's reasonable judgment, disclosure is necessary to protect the safety of End Customers, of other FaveCard customers, of FaveCard, or of the public.

8. Updates to this AUP

FaveCard may update this AUP from time to time, including to address new types of abuse, new regulatory guidance, or changes in industry best practice. Updates take effect on the date FaveCard publishes the updated version at favecard.co/legal/acceptable-use. For material changes, FaveCard will give at least thirty (30) days' advance notice by email to the account holder, in accordance with the change-management procedure in Section 14 of the Terms of Service.

9. Contact

Questions about this AUP, or pre-clearance of an unusual use case, can be directed to:

Qualityc Łukasz Fryc Kasinka Mała 472 34-734 Kasinka Mała Poland

NIP: 7372138804 EU VAT: PL7372138804 Email: privacy@favecard.co

To report abuse of the FaveCard service by another customer, write to privacy@favecard.co with the subject line "AUP abuse report".

Version history