FaveCard Privacy Policy

Who this policy is about

This Privacy Policy explains how FaveCard handles personal data. Depending on how you interact with us, different parts of this policy apply to you:

• Part A tells you who we are and how to contact us. It applies to everyone.
• Part B applies if you are a business customer of FaveCard — for example, a café owner, a gym manager, or an employee of a business that has signed up to use the FaveCard platform.
• Part C applies if you are an end customer (cardholder) — that is, a person who received a FaveCard loyalty card from a business (the "Issuer") and whose data we process on that Issuer's behalf.
• Part D applies if you are a website visitor browsing FaveCard pages without creating an account.
• Part E describes data-subject rights and how to exercise them. It applies to everyone.
• Part F sets out international transfers, retention, security, and jurisdiction-specific disclosures. It applies to everyone.

If you are not sure which part applies to you, contact us at privacy@favecard.co and we will help.

Part A — About FaveCard

A.1 Who we are

The controller (or, in some cases, the processor) for the personal data described in this policy is:

Qualityc Łukasz Fryc Kasinka Mała 472, 34-734 Kasinka Mała, Poland NIP: 7372138804 EU VAT: PL7372138804 Email: privacy@favecard.co

We operate the FaveCard service, a software-as-a-service platform that lets businesses design, distribute, and manage digital loyalty cards delivered through Apple Wallet, Google Wallet, and comparable wallet platforms.

Throughout this policy, "we," "us," and "our" refer to the entity above. "You" depends on the part you are reading — see the introduction.

A.2 Data Protection Officer

We have not formally designated a Data Protection Officer under Article 37 GDPR, because the thresholds that would require us to do so do not currently apply to our activities (we do not carry out large-scale systematic monitoring of individuals, we do not process special categories of data on a large scale, and we are not a public authority). For all privacy-related enquiries, the contact point is privacy@favecard.co.

A.3 Scope and relationship to other documents

This Privacy Policy sits alongside our Terms of Service (favecard.co/legal/terms), Data Processing Agreement (favecard.co/legal/dpa), and Sub-processors List (favecard.co/legal/subprocessors). Where this policy describes the general data-protection posture of FaveCard, the DPA governs the specifics of our role as a processor of end-customer data on behalf of Issuers.

If there is a conflict between this policy and the DPA on a matter of processing end-customer data, the DPA prevails.

Part B — For business customers (Issuers)

This part describes the personal data we collect directly from you as a business customer of FaveCard, when you create an account, log in, subscribe to a plan, contact support, or otherwise interact with us as a merchant on the platform.

B.1 What data we collect from Issuers

We collect the following categories of personal data about you as a business customer:

We do not collect any "special categories" of personal data about you under Article 9 GDPR (health, biometrics, religion, political opinions, etc.), and we ask that you do not provide any such data through the platform.

B.2 Payment card numbers

Full payment card numbers (PAN), CVV codes, and expiry dates are handled by our payment processor Stripe. We never see, store, or have access to them. Stripe returns to us only a payment method identifier (a token) that we store to associate the payment method with your account for recurring charges.

B.3 Why we process your data (purposes and lawful bases)

Where we rely on legitimate interests, we have carried out a balancing test and concluded that our interests (operating and improving the Service, preventing fraud, reaching existing customers about relevant updates) are not overridden by your rights and interests. You can ask us for the details of any specific balancing test at privacy@favecard.co, and you have the right to object to processing based on legitimate interests (see Part E).

Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of processing that happened before withdrawal. You can withdraw marketing consent by clicking the unsubscribe link in any marketing email, or by emailing us.

B.4 Who receives your data

We share your data with the following categories of recipients, each bound by appropriate confidentiality and data-protection obligations:

• Sub-processors — see favecard.co/legal/subprocessors for the full, up-to-date list. Categories include: cloud infrastructure (Google Cloud), email delivery (Resend, Loops), payments (Stripe), error monitoring (Sentry), product analytics (PostHog), bot protection on the sign-up forms (Cloudflare), review invitations (Trustpilot), marketing automation, and customer support tools.
• Trustpilot (Trustpilot A/S, Denmark) — after you buy a paid plan, our founder's thank-you email to you is also sent as a blind copy (BCC) to Trustpilot's invitation address, so that Trustpilot can invite you to review FaveCard. Trustpilot receives that email: your email address, your first name (if we have it), your business name and the language of the email. It uses them on our behalf, under its Data Processing Agreement (version 8.0), to send you the invitation. Trustpilot states that it transfers data outside the EEA and the UK only with the measures data protection law requires. If you write a review, Trustpilot handles the review and your Trustpilot account under its own privacy policy.
• Professional advisers — accountants, auditors, and lawyers, bound by professional confidentiality.
• Authorities — where required by law, court order, or legitimate government request.
• Business successors — in connection with a merger, acquisition, reorganisation, or change of legal form (such as the conversion of the FaveCard sole proprietorship into a limited liability company), in which case we will transfer data to the successor together with the obligation to honour this policy.

We do not sell your personal data to third parties. We do not share your data with advertising networks or data brokers.

B.5 Automated decisions and profiling

We do not use your data to make automated decisions that produce legal effects on you or significantly affect you in a similar way (Article 22 GDPR). Dashboard personalisation and feature recommendations, where they exist, are not "automated decisions" for these purposes.

Part C — For end customers (cardholders)

This part is for you if a business issued you a FaveCard loyalty card — for example, a café gave you a stamp card that you added to your Apple Wallet or Google Wallet. The short version: the business that issued your card (the "Issuer") is legally the data controller, but FaveCard handles most of the day-to-day privacy operations on the Issuer's behalf. That means in practice you can contact us directly at privacy@favecard.co and get a substantive answer.

C.1 Who is the data controller?

The Issuer (the business whose logo appears on your card) is the data controller for the personal data collected in connection with your loyalty card. They decided to collect your data, they decide how to use it, and they are legally responsible for compliance with data protection law.

FaveCard is the data processor. We store, transmit, and process your data on the Issuer's behalf and according to their instructions, under a Data Processing Agreement.

In recognition of the fact that small businesses do not always have the resources to handle privacy operations themselves, the Issuer has instructed FaveCard, in the Data Processing Agreement, to perform a number of compliance activities on the Issuer's behalf, including:

• publishing the privacy notice that applies to your card (with the Issuer's identifying details inserted);
• receiving and resolving your data subject rights requests;
• preparing and dispatching breach notifications where required;
• maintaining a record of any marketing consent you provided.

This is described in more detail in C.7 below. The legal responsibility for compliance still rests with the Issuer; FaveCard simply does the operational work, on documented instructions, in its capacity as processor.

We do not use your data for our own purposes except as described in Part C.5 below.

C.2 What data we process about you on behalf of the Issuer

When you sign up for a card through a form hosted on FaveCard (for example, via a QR-code link or a link on the Issuer's business page), the following categories are typically collected. Exact fields depend on how the Issuer has configured their form:

• First name
• Email address
• Birthday (day and month only — no year)
• The Issuer you signed up with and when
• Whether you opted in to receive marketing messages from the Issuer (checkbox state)
• Your stamp count, rewards earned, and transaction history on the Issuer's loyalty program
• Your Apple Wallet or Google Wallet pass identifier (a technical token used to deliver updates to your card)
• Basic device and browser information when you interacted with the signup page

The Issuer may instruct us to collect additional or different fields. Consult the Issuer's own privacy notice for the complete picture.

C.3 Why we process your data (on behalf of the Issuer)

We process your data for the purposes the Issuer has told us, which typically include:

• Creating and delivering your loyalty card to your wallet app
• Updating the card as you earn stamps and claim rewards
• Sending the card and related communications to your email
• Delivering push notifications to your wallet pass (where you have added it)
• Where you opted in to marketing: sending you promotional messages from the Issuer
• Preventing fraud and abuse of the loyalty program

The legal basis for each of these is the Issuer's responsibility to establish. Typically it is either performance of a contract (delivering the loyalty card you asked for), legitimate interest (operating the loyalty program), or consent (for optional marketing messages). If you want to understand the exact legal basis for a specific processing activity, contact the Issuer — they are the controller and must answer.

C.4 How to exercise your rights

The Issuer is the legal controller, but the Issuer has instructed FaveCard, under the Data Processing Agreement, to receive and resolve your data subject rights requests on the Issuer's behalf. You can therefore exercise your rights in either of two ways, whichever is easier for you:

1. Contact FaveCard directly at privacy@favecard.co. We will acknowledge your request within 72 hours, verify your identity from the information already held in your card record, and respond substantively within the GDPR statutory window of one month (extendable by up to two further months in complex cases per Article 12(3) GDPR). Where your request materially affects your relationship with the Issuer, we will inform the Issuer and, where time permits, give the Issuer a reasonable opportunity to comment before we respond.
2. Contact the Issuer directly. Their contact details are typically in their own communications with you. If they handle your request themselves, FaveCard is not involved.

Either route is valid. You do not need to try one before the other, and we will not redirect you back to the Issuer.

You can also lodge a complaint with a supervisory authority. In Poland this is the Urząd Ochrony Danych Osobowych (UODO) at uodo.gov.pl. If you live in another EU/EEA country, you may instead contact your local supervisory authority.

C.5 When FaveCard acts as its own controller for end-customer data

In a small number of situations we process end-customer data in our own right as a controller, not on behalf of the Issuer. These are:

• Security and abuse prevention — we may analyse signup patterns, IP addresses, and device signals across the platform to detect fraud and abuse. Lawful basis: legitimate interest (protecting the Service and all its users).
• Identity verification — when you verify your identity on a business page (for example, by entering a one-time code), FaveCard processes the verification event and stores a confirmation that you are verified in the unified customer record. This allows you to interact with your loyalty card without repeating the verification on each visit. Lawful basis: performance of a contract (Art. 6(1)(b)).
• Aggregated, de-identified analytics — we may use aggregated usage data that cannot be linked back to you to improve the Service. We take care that aggregated data cannot be re-identified.
• Compliance with our legal obligations — for example, responding to lawful requests from authorities.
• Defending legal claims — where necessary to protect our own legal position.

Where we act as controller for these limited purposes, Parts D and E of this policy apply to you directly.

C.6 We do not contact you directly with marketing

FaveCard itself does not send marketing messages to end customers. Any marketing you receive after signing up for a card comes from the Issuer, not from FaveCard. If you are receiving unwanted marketing from an Issuer, contact the Issuer (their unsubscribe link should be in the email) and, if needed, also let us know at privacy@favecard.co so we can assist the Issuer with enforcement of your request.

C.7 Operational compliance support — what FaveCard does on the Issuer's behalf

Most of the businesses that issue FaveCard loyalty cards are small — single-location cafés, hair salons, gyms — and do not have in-house legal or compliance teams. Rather than asking each Issuer to write its own privacy notice, respond to data subject rights requests, and handle data breaches, the Issuer instructs FaveCard, in the Data Processing Agreement, to perform these activities on the Issuer's behalf.

This is permitted under Article 28(3)(e) and (f) GDPR, which oblige a processor to assist the controller with data subject rights and breach notification "by appropriate technical and organisational measures, insofar as this is possible." FaveCard pushes that assistance to the maximum level possible at the small-merchant tier.

In practice, the things FaveCard does on the Issuer's behalf are:

• Hosting the privacy notice that applies to your card. FaveCard publishes a Customer Privacy Notice at favecard.co/legal/customer-privacy?company={slug}, with the Issuer's identifying details (name, registration number, contact email, address) inserted, and keeps it up to date as the Issuer's details change.
• Receiving and resolving your data subject rights requests. When you write to privacy@favecard.co, we acknowledge within 72 hours, verify your identity, and respond substantively within the GDPR statutory window. See C.4.
• Detecting and notifying personal data breaches. If a breach affects your data, we prepare and dispatch the notifications required under Articles 33 and 34 GDPR (to the supervisory authority and, where the breach is high-risk, to you), on the Issuer's behalf, within the statutory windows.
• Maintaining a marketing-consent audit trail. When you sign up for a card and tick (or do not tick) the marketing-consent checkbox, FaveCard records the timestamp, the IP address, the user agent, the locale, and the exact wording of the consent text shown to you, so that the Issuer can prove the consent state at the moment of signup if asked.
• Enforcing the Acceptable Use Policy on outbound communications. FaveCard polices the Issuer's use of the marketing channel (against imported lists, against sending to non-consenting recipients, against prohibited categories) and suspends Issuers that violate the policy.

Prerequisite: completed Issuer legal-identity profile. All of the operational support described above depends on FaveCard knowing who the Issuer actually is. At signup, an Issuer provides only a business display name and the primary contact details of the individual creating the account. Before the Issuer can activate any end-customer feature of the Service (distributing loyalty cards, publishing a public business page, sending marketing to end customers), the Issuer must complete their legal-identity profile in the dashboard settings — registered legal name, business form, tax identification number where applicable, and registered address. Until the profile is complete, no end customer can enrol on the Issuer's loyalty program via FaveCard, no business-specific Customer Privacy Notice is published on the Issuer's behalf, and the support activities in this section have no end-customer data to operate on.

The Issuer remains the legal controller and remains responsible for the content of any communications you receive (truthful claims, lawful product categories, etc.). FaveCard is responsible for the operational machinery of compliance.

Part D — For website visitors

This part applies if you are visiting favecard.co, a FaveCard-hosted business page (for example, a public-profile page for a café using FaveCard), or the FaveCard dashboard without being logged in.

D.1 What we collect

When you visit our websites without creating an account:

• Log data — IP address, browser type and version, operating system, pages you visit, referring URL, timestamps. Used for security and aggregate traffic analysis.
• Essential cookies — used for session management, security, and (where applicable) language preference. These cannot be turned off because the site will not work without them.
• Authentication cookies on business pages — when you verify your identity on a business page (for example, by entering a one-time code sent to your email), the platform sets a cookie so you do not have to re-verify each time you collect a stamp. This cookie identifies you only to the specific business whose page you are visiting. It expires after one year or when you clear your browser data. It contains no marketing data and no information about your activity with other merchants. If you clear the cookie, you simply need to verify your identity again on your next visit.
• Analytics cookies — we use PostHog on the EU instance (eu.posthog.com) for product analytics on the dashboard only. We do not use analytics or advertising cookies on public business pages.
• Error monitoring — we use Sentry (EU region) to capture error traces when something breaks. These traces may incidentally contain your IP address and user agent but are not used to profile you.
• Bot protection on the sign-up forms — the FaveCard sign-up and waitlist forms use Cloudflare Turnstile (Cloudflare, Inc.) to tell a person from an automated script. While the form is open, Turnstile reads your IP address, your browser's user agent and TLS fingerprint and the address of the page with the form, and gives the form a one-time token that our server checks with Cloudflare. Your name, e-mail address and the rest of what you type are never sent to Cloudflare. From the check itself we keep only its result (passed, failed, missing token, error or not checked) and a random attempt identifier, not the signals Turnstile reads; for a sign-up, the result is linked in our product analytics to the account it creates. The sign-up's IP address and user agent are recorded separately (Part B.1, authentication data, recorded when you register). Cloudflare processes these signals on our behalf to run the check and, as an independent controller under its Turnstile Privacy Addendum, to improve its bot detection.

D.2 Lawful basis for website processing

• Essential cookies and security logs: legitimate interest (Art. 6(1)(f)) — operating the website safely.
• Authentication cookies on business pages: the cookie is set only after you actively verify your identity (for example, by entering a one-time code). It is necessary to provide the service you asked for — collecting stamps without re-verifying each visit. Lawful basis: performance of a contract (Art. 6(1)(b)). Under Article 5(3) of the ePrivacy Directive, no separate cookie consent is required because the cookie is strictly necessary for a service you explicitly requested.
• Analytics on the dashboard: legitimate interest (Art. 6(1)(f)) — understanding product usage. We do not use analytics or advertising cookies on public business pages.
• Error monitoring: legitimate interest (Art. 6(1)(f)) — fixing bugs and improving stability.
• Bot protection on the sign-up forms: legitimate interest (Art. 6(1)(f)) — keeping automated sign-ups and abuse out of the Service. The check is strictly necessary for the security of the sign-up or waitlist entry you asked for, so under Article 5(3) of the ePrivacy Directive it needs no separate consent.

Part E — Your rights

Regardless of which part applies to you, you have the rights listed below. Some apply unconditionally; others are subject to conditions and exceptions in applicable law.

• Right of access (Art. 15 GDPR) — you may ask us to confirm whether we are processing your personal data, and to provide a copy of that data together with information about how we use it.
• Right to rectification (Art. 16) — you may ask us to correct inaccurate data or complete incomplete data.
• Right to erasure ("right to be forgotten") (Art. 17) — you may ask us to delete your personal data where we no longer need it, where you withdraw consent, or where the processing was unlawful.
• Right to restriction of processing (Art. 18) — you may ask us to limit how we use your data while we assess a rectification or erasure request.
• Right to data portability (Art. 20) — where we process your data based on consent or contract, and by automated means, you may ask for it in a structured, commonly used, machine-readable format.
• Right to object (Art. 21) — you may object to processing based on legitimate interests; in that case we will stop unless we have compelling legitimate grounds. You may always object to direct marketing.
• Right not to be subject to automated decision-making (Art. 22) — we do not carry out such decisions, as explained in Part B.5.
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of prior processing.
• Right to lodge a complaint — you may lodge a complaint with a supervisory authority. In Poland, this is the Urząd Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl. If you live in another EU/EEA country, you can contact your national authority.

E.1 How to exercise your rights

Send your request to privacy@favecard.co. Include enough information for us to identify you and the relationship (for example, your business email if you are an Issuer, or the Issuer's name and the email you used to sign up for a card if you are an end customer).

We will respond within one month of receiving your request, as required by GDPR Article 12(3). In complex cases we may extend this by up to two further months, in which case we will tell you within the first month.

We do not charge for responding to your request, except where requests are manifestly unfounded or excessive (Art. 12(5)), in which case we may charge a reasonable fee or refuse the request.

We may need to verify your identity before acting on your request, to protect you against unauthorised access.

E.2 If you are an end customer

For loyalty-card data, the Issuer is the legal controller, but the Issuer has instructed FaveCard to receive and resolve your data subject rights requests on the Issuer's behalf. You can therefore send your request directly to privacy@favecard.co and receive a substantive response from FaveCard, or you can contact the Issuer directly. See Part C.4 for the full details.

Part F — International transfers, retention, security, and jurisdiction-specific information

F.1 International transfers

FaveCard is established in Poland and stores most personal data in the European Union (specifically, Google Cloud regions in Europe). However, some of our sub-processors are established outside the EEA, or may store or access data outside the EEA, including in the United States. These include (non-exhaustive, see the Sub-processors List for the complete picture):

• Apple Push Notification Service (Apple Inc., United States) — for delivering Apple Wallet pass updates
• Google Wallet API (Google LLC, United States) — for generating Google Wallet passes
• Stripe Payments Europe, Limited (Ireland) with US parent — for billing
• Resend (Plus Five Five, Inc., United States) — for transactional email delivery
• Loops (Astrodon Corporation, United States) — for FaveCard's own marketing to business customers
• Sentry (Functional Software, Inc., United States) — EU region (Frankfurt), with US control-plane access, for error monitoring
• PostHog (PostHog, Inc., United States / Hiberly Ltd., United Kingdom) — EU instance (eu.posthog.com) for product analytics
• Vercel (Vercel Inc., United States) — for hosting the public business page
• Cloudflare (Cloudflare, Inc., United States) — for bot protection on the sign-up and waitlist forms (Turnstile)

Where a transfer to a non-EEA country takes place, we rely on one of the following safeguards (per Article 46 GDPR):

• Adequacy decision — for transfers to countries the European Commission has found to provide an adequate level of protection. As of this version, the EU–US Data Privacy Framework (DPF) provides an adequacy mechanism for certified US recipients.
• Standard Contractual Clauses (SCCs) — the 2021 EU SCCs (Module 2 for controller-to-processor transfers, Module 3 for processor-to-processor), where no adequacy decision applies.
• UK International Data Transfer Agreement (IDTA) or the UK Addendum to the SCCs, for transfers of UK personal data.
• Swiss FADP equivalent mechanisms, for transfers of Swiss personal data.

You may request a copy of the safeguards in place for a specific transfer by emailing privacy@favecard.co.

F.2 Retention

We keep personal data only as long as necessary for the purposes set out in this policy. Typical retention periods:

Where we are legally required to retain data longer, we will continue to do so until the legal obligation expires.

F.3 Security

We apply industry-standard technical and organisational measures to protect personal data, including (non-exhaustive):

• Encryption in transit (TLS 1.2 or higher) for all communications with the platform
• Encryption at rest for sensitive data stored in Google Cloud and Firestore
• Role-based access control within the platform, with the principle of least privilege
• Multi-factor authentication for administrative access
• Audit logs of privileged operations
• Continuous dependency and vulnerability monitoring
• Backup and recovery procedures for Firestore and related data stores
• Personnel training on information security and data protection
• Incident response procedures that include breach notification to Issuers (where we act as processor) without undue delay and within the timeframes set out in the DPA

The full description of our technical and organisational measures is in Schedule 2 of the DPA.

F.4 Data breach notification

If a personal-data breach occurs that is likely to result in a risk to the rights and freedoms of data subjects, we will:

• Notify affected Issuers (where we act as processor) without undue delay and in any event within 72 hours of becoming aware of the breach.
• Where the Issuer has instructed us under the Data Processing Agreement to do so (the standing instruction described in Part C.7), prepare and dispatch on the Issuer's behalf the notifications required under Article 33 GDPR (to the competent supervisory authority, within 72 hours) and Article 34 GDPR (to affected data subjects, where the breach is likely to result in a high risk to their rights and freedoms, without undue delay), keeping the Issuer informed throughout.
• Notify the Urząd Ochrony Danych Osobowych (UODO) and affected data subjects directly (where we act as controller in our own right) in accordance with Articles 33 and 34 GDPR.
• Document the breach, its effects, and the remedial action taken, in our internal incident register.

F.5 Children

The Service is not directed to children under 16 years of age. We do not knowingly collect personal data from children under 16. If you believe that a child under 16 has provided us with personal data (either directly or through an Issuer's loyalty program that you did not authorise), contact us at privacy@favecard.co and we will take steps to delete the data and, where we are the processor, notify the Issuer.

Issuers are required by our Terms of Service not to target children under 16 with loyalty programs collected through the Service.

F.6 Jurisdiction-specific information

F.6.1 If you are in the United Kingdom

The UK GDPR and the Data Protection Act 2018 apply to your data. Your rights mirror those in Part E. The supervisory authority is the Information Commissioner's Office (ICO) at ico.org.uk. Transfers of UK personal data outside the UK are protected by the UK IDTA or the UK Addendum to the EU SCCs, as described in F.1.

F.6.2 If you are in California (United States)

Under the California Consumer Privacy Act (CCPA) as amended by the CPRA, California residents have specific rights, including:

• The right to know what personal information we collect, how we use it, and with whom we share it.
• The right to delete personal information, subject to exceptions.
• The right to correct inaccurate personal information.
• The right to opt out of the "sale" or "sharing" of personal information — we do not sell or share personal information for cross-context behavioural advertising, so there is nothing to opt out of.
• The right to limit the use of sensitive personal information — we do not use sensitive personal information beyond what is necessary to provide the Service.
• The right to non-discrimination for exercising your rights.

Notice of Financial Incentive. The Service may enable businesses to run loyalty programs that reward customers based on their purchases. Where such a program is offered to California residents, the business (the Issuer) is responsible for providing the CCPA Notice of Financial Incentive to participants. FaveCard does not itself offer a financial incentive to California consumers.

FaveCard is established in Poland and does not currently meet the thresholds to qualify as a "business" under California Civil Code §1798.140(d). We nevertheless honour the rights listed above as a matter of policy for any California resident who contacts us. Because we do not sell or share personal information for cross-context behavioural advertising, we do not provide a "Do Not Sell or Share My Personal Information" link; there is nothing to opt out of.

To exercise CCPA rights, email privacy@favecard.co. We will verify your request as required by the CCPA regulations before responding.

F.6.3 If you are in Australia

Our processing is subject to the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) where it relates to Australian individuals or businesses. We comply with APP 1 (openness), APP 5 (notification), APP 6 (use and disclosure), APP 8 (cross-border disclosure), APP 11 (security), APP 12 (access), and APP 13 (correction). Marketing emails sent by Issuers through the platform are subject to the Spam Act 2003, and Issuers are responsible for ensuring they comply with its consent, identification, and unsubscribe requirements.

To exercise your rights under Australian law, email privacy@favecard.co. You may also complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

F.6.4 If you are in Brazil

The Lei Geral de Proteção de Dados (LGPD, Law 13.709/2018) grants Brazilian residents rights similar to those described in Part E, including confirmation of processing, access, correction, anonymisation, portability, deletion, and information about sharing with third parties. Our GDPR-aligned practices — explicit consent, data minimisation, purpose limitation, and retention limits — satisfy the corresponding LGPD principles. Transfers of personal data from Brazil are protected by Standard Contractual Clauses as described in F.1.

To exercise your rights under Brazilian law, email privacy@favecard.co. You may also contact the Autoridade Nacional de Proteção de Dados (ANPD) at gov.br/anpd.

F.6.5 If you are in Canada

Our processing of personal information of Canadian residents complies with the Personal Information Protection and Electronic Documents Act (PIPEDA) and equivalent provincial legislation. You have the right to access, correct, and challenge our handling of your personal information.

Marketing emails sent by Issuers through the platform are subject to Canada's Anti-Spam Legislation (CASL). CASL requires express consent before sending commercial electronic messages, accurate sender identification, and a functioning unsubscribe mechanism in every message. Issuers are responsible for ensuring their communications comply with CASL. FaveCard's consent-capture infrastructure (explicit opt-in checkbox, per-channel audit trail, one-click unsubscribe) is designed to meet CASL's consent and record-keeping requirements.

To exercise your rights under Canadian law, email privacy@favecard.co. You may also contact the Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca.

F.6.6 If you are in Japan

The Act on the Protection of Personal Information (APPI) governs the processing of personal data of Japanese residents. The European Commission has recognised Japan as providing an adequate level of data protection, and Japan has reciprocally recognised the EU. Our GDPR-aligned practices satisfy the corresponding APPI requirements. You have the right to request disclosure, correction, cessation of use, and deletion of your personal data.

To exercise your rights under Japanese law, email privacy@favecard.co. You may also contact the Personal Information Protection Commission (PPC) at ppc.go.jp.

F.6.7 Other jurisdictions

If you are in an EU/EEA member state other than Poland, you can contact either UODO (the Polish supervisory authority) or your own national supervisory authority. We will cooperate with both.

If you are in a jurisdiction not specifically listed above, the rights described in Part E apply to the extent required by your local law. To exercise any right, or to ask a question about how your data is handled, email privacy@favecard.co.

Changes to this policy

We may update this policy from time to time. For minor changes (typographical corrections, clarifications), the updated version takes effect on the date we publish it at favecard.co/legal/privacy. For material changes (new categories of data, new purposes, new recipients, new retention periods), we will give at least 30 days' advance notice by email to business customers and by notice in the dashboard, and for changes that affect end customers, we will ask Issuers to update their own notices accordingly.

We maintain an archive of prior versions of this policy at favecard.co/legal/privacy/archive.

Contact

Questions about this Privacy Policy, or requests to exercise rights, can be directed to:

Qualityc Łukasz Fryc Kasinka Mała 472 34-734 Kasinka Mała Poland

NIP: 7372138804 EU VAT: PL7372138804 Email: privacy@favecard.co

For end customers: remember that your first point of contact for loyalty-card data is the Issuer (the business whose card you received), not FaveCard. See Part C.

Version history