Privacy Notice for Your Loyalty Card

This is the privacy notice for the loyalty card issued to you by {{ISSUER_NAME}} through the FaveCard platform. It tells you who is responsible for your data, what is done with it, and how you can exercise your rights — all in plain language.

If anything here is unclear, you can write to privacy@favecard.co at any time and a real person will reply.

1. Who is responsible for your data

Two organisations handle personal data linked to your loyalty card — and FaveCard plays two distinct roles, depending on what is being done. To be completely transparent, all three are described below.

1a. {{ISSUER_NAME}} — data controller for the loyalty programme

The business that issued your card is the data controller of the personal data tied to its own loyalty programme. This means {{ISSUER_NAME}} is legally responsible under the General Data Protection Regulation (GDPR) for the data that flows from your membership in its programme: your participation, your stamp count, rewards claimed, loyalty-programme transaction history, the emails sent to you in its name, and the marketing-consent state you chose at signup.

• Name: {{ISSUER_NAME}}
• Contact email: {{ISSUER_EMAIL}} {{#IF_NIP}}- Registration number / NIP: {{ISSUER_NIP}}{{/IF_NIP}} {{#IF_ADDRESS}}- Address: {{ISSUER_ADDRESS}}{{/IF_ADDRESS}}

1b. FaveCard — data processor operating the platform on the controller's behalf

Qualityc Łukasz Fryc, operating the FaveCard platform (NIP 7372138804, EU VAT PL7372138804, Kasinka Mała 472, 34-734 Kasinka Mała, Poland), is the data processor for the loyalty-programme data described in Section 1a. FaveCard hosts the platform that runs the loyalty programme, stores the data, generates the wallet pass on your phone, and sends emails on {{ISSUER_NAME}}'s behalf.

To make things easier for everyone, {{ISSUER_NAME}} has instructed FaveCard, in writing, to perform most of the day-to-day privacy operations on its behalf — including publishing this notice, responding to your data subject rights requests, and notifying personal data breaches where required. This is permitted under Articles 28(3)(e) and (f) GDPR. {{ISSUER_NAME}} remains legally responsible; FaveCard acts only on its documented instructions.

In practice, you can contact FaveCard directly at privacy@favecard.co for any matter covered by Sections 1a and 1b and get a substantive answer. You do not need to chase {{ISSUER_NAME}} separately — although you may, if you prefer.

1c. FaveCard — independent controller of a minimal unified customer record

Separately from its processor role in Section 1b, FaveCard acts as an independent controller (Article 4(7) GDPR) of a minimal unified customer record that sits outside the boundaries of any single merchant's loyalty programme.

What this record contains. When you sign up for a loyalty card through FaveCard, the platform creates — or, if you have signed up with another FaveCard merchant before, reuses — a small record indexed by a one-way cryptographic hash of your email address and (if you provided one) your phone number. The record holds only: your first name, your last name (if provided), your email address, your phone number (if provided), your birthday day/month (if provided), and, if you have verified your identity (for example, by entering a one-time code), a secure confirmation that you are verified and the date of your last verification. It holds no marketing history, no transaction history, no stamp counts, no rewards, no notes, no behavioural profile, and no cross-merchant correlation of your activity.

Why it exists. FaveCard maintains this record so that:

• when you sign up with another merchant who also uses FaveCard, the platform can recognise you and save you from re-entering the same details;
• the integrity of the loyalty platform can be maintained (for example, detecting duplicate or fraudulent signups across merchants);
• in the future (see Section 12) you will be able to see all your FaveCard loyalty cards in one place through a customer portal or a mobile app, without having to search for each merchant separately.

On what legal basis. FaveCard processes the minimal unified record on the basis of legitimate interest under Article 6(1)(f) GDPR. The balancing test weighs the benefit to you (recognition across merchants, fraud protection, future portal access) against the minimal privacy impact of a record that holds only identifying data, contains no marketing or profiling, and is technically segregated from per-merchant loyalty data.

Your right to object. Because this processing rests on legitimate interest, you have the right to object under Article 21 GDPR. If you object, FaveCard will, within thirty (30) days of receiving your request at privacy@favecard.co, delete the unified record associated with your email and phone. Your per-merchant loyalty cards are not affected by an objection to the unified record — the data described in Section 1a remains in place unless you separately ask the relevant merchant (or FaveCard on the merchant's behalf) to delete it.

What the unified record is NOT. FaveCard does not use the unified record to send you marketing. FaveCard does not share the unified record with merchants. FaveCard does not use it to build a behavioural profile. FaveCard does not sell or license it to any third party. Its sole purpose is to enable continuity across the merchants you choose to sign up with on the FaveCard platform.

2. What data we process about you

When you signed up for your loyalty card, we typically collected:

• your first name (so the card and emails can address you);
• your email address (so the card can be sent to you and so transactional and — if you opted in — marketing messages can reach you);
• your birthday — day and month only, no year (only if you provided it, so the controller can send you a birthday treat);
• the fact that you signed up with {{ISSUER_NAME}} and the date you did so;
• your marketing-consent state — whether you ticked the optional marketing checkbox at signup, and (for our records) the timestamp, IP address, browser information, locale, and the exact text of the consent label that was shown to you at the moment you ticked or did not tick it;
• your stamp count, rewards earned, and loyalty-programme transaction history with {{ISSUER_NAME}};
• your wallet pass identifier (a technical token used by Apple Wallet or Google Wallet to receive updates to your card);
• basic device and browser information captured when you interacted with the signup page (IP address, user agent);
• if you verified your identity (for example, by entering a one-time code sent to your email), a confirmation that you are verified and the date of your last verification, stored in the unified customer record described in Section 1c, so you do not have to re-verify on each visit.

A minimal subset of the fields above — your first name, last name (if provided), email, phone (if provided), and birthday day/month (if provided) — is also held in the minimal unified customer record described in Section 1c. That record is indexed by a one-way cryptographic hash of your email and phone so the platform can recognise you across merchants without holding your email or phone in clear text as the index. It contains no marketing state, no transaction history, and none of the other fields listed above.

We do not collect health data, biometric data, political opinions, religious beliefs, or any other "special categories" of personal data within the meaning of Article 9 GDPR.

3. What we do with your data, and on what legal basis

We do not sell your personal data to third parties. We do not share your data with advertising networks or data brokers. We do not use your data for automated decision-making that produces legal or similarly significant effects on you (Art. 22 GDPR). We do not build behavioural profiles of you across merchants, and FaveCard does not share the data it holds about your card with {{ISSUER_NAME}}'s competitors or with any other merchant on the platform.

4. Marketing emails — how to opt out

You will only receive marketing emails from {{ISSUER_NAME}} if you ticked the optional marketing checkbox at signup. You can stop receiving them at any time, in either of two ways:

• Click "unsubscribe" at the bottom of any marketing email. Your withdrawal takes effect within 24 hours.
• Email privacy@favecard.co asking us to remove you from {{ISSUER_NAME}}'s marketing list. We will action your request within 72 hours.

Withdrawal of marketing consent does not affect the lawfulness of marketing emails sent before you withdrew, and does not stop the transactional emails about your card (such as receipts or important changes). If you want to stop transactional emails as well, you should ask us to delete your card account — see Section 6.

5. Who else sees your data

To run the loyalty programme, FaveCard uses a small number of trusted sub-processors, each bound by data-protection commitments at least as strong as those FaveCard owes to the controller. The full, up-to-date list is published at favecard.co/legal/subprocessors. As of the date of this notice the categories include:

• Cloud infrastructure (Google Cloud, EU regions) — for hosting and storage of the data;
• Apple Wallet and Google Wallet — for delivering the wallet pass to your phone and keeping it up to date;
• Transactional email delivery (Resend) — for sending the card and transactional emails;
• Error monitoring (Sentry, EU region) — for catching technical errors;
• Product analytics (PostHog, EU instance) — for understanding how people use the dashboard, not for advertising;
• Vercel — for hosting the public business page and the signup form.

We do not share your personal data with any party that is not listed in the Sub-processors List, except where required by law (for example, in response to a lawful order from an authority).

6. Your rights and how to exercise them

Under the GDPR, you have the following rights in respect of your personal data:

• Right of access (Art. 15) — ask us what we hold about you and get a copy.
• Right to rectification (Art. 16) — ask us to correct anything inaccurate.
• Right to erasure (Art. 17) — ask us to delete your data ("right to be forgotten").
• Right to restriction of processing (Art. 18) — ask us to limit how we use your data while we resolve another request.
• Right to data portability (Art. 20) — ask us for your data in a structured, machine-readable format.
• Right to object (Art. 21) — object to processing based on legitimate interests; you may always object to direct marketing. If you are objecting specifically to FaveCard's maintenance of the minimal unified customer record described in Section 1c, see that section for the 30-day deletion procedure.
• Right to withdraw consent — where processing is based on consent (e.g., marketing emails), you may withdraw it at any time. Withdrawal does not affect prior processing.
• Right not to be subject to automated decision-making (Art. 22) — we do not make such decisions about you.
• Right to lodge a complaint with a supervisory authority — see Section 9 below.

How to exercise your rights

Write to privacy@favecard.co. Include enough information for us to identify your card record (typically: the name of the controller, {{ISSUER_NAME}}, and the email address you used to sign up).

We will:

1. Acknowledge your request within seventy-two (72) hours of receipt;
2. Verify your identity by reference to information already held in your card record;
3. Respond substantively within the GDPR statutory window of one (1) month from receipt, which we may extend by up to two further months in complex cases per Article 12(3) GDPR (we will tell you if we need to extend, and why);
4. Inform the controller if your request materially affects your relationship with them (for example, an erasure request that would terminate your loyalty membership), and where time permits give the controller a reasonable opportunity to comment before we respond;
5. Keep a record of the request and our response.

You may, alternatively, send your request to {{ISSUER_NAME}} directly at {{ISSUER_EMAIL}}. Either route is valid. You do not need to try one before the other.

We do not charge for responding to your request, except where requests are manifestly unfounded or excessive (Article 12(5) GDPR), in which case we may charge a reasonable fee or refuse the request.

7. Where your data is stored, and international transfers

FaveCard stores most personal data in the European Union, using Google Cloud regions located in Europe (currently europe-west4 for application hosting and eur3 multi-region for the database).

Some sub-processors are established outside the European Economic Area, or may store or access data outside it — in particular, in the United States. For those transfers, FaveCard relies on the safeguards listed in Article 46 GDPR, applying the first available of:

• Adequacy decisions of the European Commission (notably the EU–US Data Privacy Framework adopted on 10 July 2023 for certified US recipients);
• Standard Contractual Clauses (SCCs) as adopted by the European Commission in 2021;
• where neither of the above applies, another transfer mechanism permitted under Article 46 GDPR.

You can request a copy of the safeguards in place for a specific transfer by emailing privacy@favecard.co.

8. How long we keep your data

We keep your personal data only as long as necessary:

• Active loyalty card data — for as long as you are an active member of {{ISSUER_NAME}}'s loyalty programme, and for a reasonable period thereafter to support customer-service queries and dispute resolution;
• Marketing-consent audit trail — for as long as your card record exists, and for a reasonable period thereafter to support proof of consent in the event of a regulatory inquiry or complaint;
• If {{ISSUER_NAME}} stops using FaveCard — your data is deleted within 60 days of termination of the controller's subscription, except where a legal obligation requires longer retention;
• Email delivery logs — 24 months from the last delivery;
• Data needed to defend or exercise legal claims — until the relevant claims are time-barred under applicable law.

You can ask for early deletion at any time using the rights described in Section 6.

9. Lodging a complaint

If you believe your personal data is being processed in violation of the GDPR, you have the right to lodge a complaint with a data-protection supervisory authority. In Poland this is:

Urząd Ochrony Danych Osobowych (UODO) ul. Stawki 2, 00-193 Warsaw, Poland uodo.gov.pl

If you live in another country in the European Economic Area, you may instead contact your local supervisory authority. Either is valid.

We would, of course, prefer that you give us a chance to resolve any concern first by writing to privacy@favecard.co.

10. Changes to this notice

We may update this notice from time to time. The current version is always published at favecard.co/legal/customer-privacy?company={slug} and is dated at the top of this document. For material changes that affect how your data is processed, FaveCard will, where reasonably possible, notify you by email before the change takes effect.

11. Contact summary

12. Future end-customer services

FaveCard is developing additional end-customer services that build on the minimal unified customer record described in Section 1c. In the future, you may be offered:

• a customer portal on the web where you can see all your FaveCard loyalty cards in one place, update your contact details once for all of them, and exercise your data subject rights with a click;
• a FaveCard mobile app that gives you the same overview on your phone, offline access to your pass QR codes, and reminders about offers and rewards — only where you have explicitly opted in;
• discovery features that suggest new loyalty programmes from other FaveCard merchants that match your stated interests — only where you have explicitly opted in, and only on the basis of your own preferences, never on the basis of data shared with FaveCard by merchants.

These services will be launched with a separate, transparent, opt-in process. Until you explicitly enable one of them, FaveCard does not use your data for any of the purposes described in this Section 12. When a service launches, FaveCard will update this notice and — for material changes — make reasonable efforts to notify you by email.

The minimal unified customer record described in Section 1c is a technical prerequisite for these future services, not a substitute for them. FaveCard is disclosing the unified record now, under the transparency requirement of Article 13 GDPR, so that you are informed of the full scope of processing from the moment you sign up, rather than being presented with a surprise later. If you do not want this continuity across merchants, you can object under Article 21 GDPR as described in Section 1c, at any time and without affecting your individual loyalty cards.

Version history