Loyalty.360 app privacy policy

Who we are

The Loyalty.360 app is operated by Dot.360 (“we”, “us”). This policy explains what data we collect when you use the app, why, who we share it with and what rights you have. For merchants and our website, the general privacy policy applies.

Who is responsible

• For your app account (email, name, mobile number, date of birth, photo, settings, devices), Dot.360 is the controller.
• For the program data at each merchant you join (points, visits, purchases, rewards, marketing consent), the merchant is the controller. Dot.360 processes it on the merchant’s behalf as a processor.

Data we collect

• Email: to log you in with a one-time code and for messages about your account.
• First and last name: the last name is optional.
• Mobile number: so merchants can recognise you and so each person has one account. The app does not send you SMS. A merchant you joined can send you SMS only if you accepted its offers.
• Date of birth: to check that you are at least 15 years old and for merchants’ birthday rewards.
• Profile photo: optional.
• Program data per merchant: points, tier, visits (store, date and time), purchases and amounts recorded by the merchant, rewards you redeemed.
• Device: the push notification token, whether the device runs iOS or Android, the language and when you last opened the app. For security we also keep IP addresses in our logs.
• Camera: used only to scan QR codes and, if you choose to, to take a profile photo. Scanning happens only on your device. We do not store or send camera images.

We do not collect your location or contacts, and we do not use advertising or tracking tools.

Why we use it and on what legal basis

• Your account, cards, points and redeeming rewards: performance of a contract, the terms of use (GDPR Art. 6(1)(b)).
• Age check, one account per mobile number, fraud prevention and security: legitimate interest (Art. 6(1)(f)).
• Notifications about points and rewards: part of the service. You can turn them off in Profile at any time.
• Offers from merchants (notifications, email, SMS): only with your consent (Art. 6(1)(a)). You can withdraw it at any time on the merchant’s card or in Profile.
• Tax and accounting duties: legal obligation (Art. 6(1)(c)).

Who we share it with

• Merchants you join: they see your name, mobile number, email, date of birth and your activity in their own program. A merchant cannot see your cards at other merchants.
• Service providers (processors), and only what they need:
  • server and database hosting in the European Union,
  • Images.360, to store and serve profile photos and logos,
  • Expo (650 Industries, USA), to deliver push notifications through Apple and Google,
  • an email provider, to send login codes.

When data leaves the EU (for example for push notifications), the transfer relies on the European Commission’s standard contractual clauses or another lawful safeguard. We do not sell your data.

How long we keep it

• Your account, while it is active. When you delete it, it is deleted straight away.
• Program data, while you are a member and the merchant runs its program. After deletion, transactions are kept only in anonymous form, as long as tax law requires.
• Login codes for 10 minutes, push tokens until you log out, and security logs for a limited period.

Your rights

You have the right to access, correct, delete and port your data, to restrict or object to processing, and to withdraw consent. In the app you can:

• correct your details in Profile,
• download all your data from Profile → Export my data,
• delete your account from Profile → Delete account.

For anything else, write to us. For a merchant’s program data you can also contact the merchant, and we will help them reply. You can also complain to the Hellenic Data Protection Authority (www.dpa.gr).

Security

Connections to our servers are encrypted (HTTPS). Each merchant’s data is kept in a separate database. The app’s login key is stored in your device’s secure storage.

Minors

The app is for people aged 15 and over. If we learn that an account belongs to a younger child, we delete it.

Changes

If we change this policy materially, we will tell you in the app and ask you to accept it again.

Contact

For privacy questions, write to support@loyalty360.app. See also the app terms of use.