Privacy policy
Who we are
Loyalty.360 is a loyalty platform operated by Dot.360 (“we”, “us”). This policy explains how personal data is handled when merchants use Loyalty.360 and when their customers join a merchant’s loyalty program.
Two roles: controller and processor
- For merchant accounts (the business owner and staff who sign up and use the dashboard), Dot.360 is the data controller.
- For loyalty members (the customers of a merchant), the merchant is the data controller and Dot.360 acts as a data processor on the merchant’s behalf, under a Data Processing Agreement (DPA) accepted at sign-up.
If you are a loyalty member and want to exercise your rights, contact the business whose program you joined. We will assist the merchant in responding.
Data we process
- Merchant accounts: business name, type of business, contact name, work email, phone, password (stored hashed), billing details handled by our payment provider, and activity logs.
- Loyalty members: phone or email and first name (required), birthday (optional), points balance, visits, purchases and redemptions recorded by the merchant, and marketing preferences.
- Technical data: IP address, device and browser information, and security logs used to prevent fraud and abuse.
We apply data minimisation: we only ask for what is needed to run the loyalty program.
Purposes and legal bases
- Providing the service to merchants (performance of a contract).
- Running a merchant’s loyalty program for its members (on the merchant’s instructions).
- Marketing messages to members only with separate, explicit consent, independent of loyalty membership.
- Security, fraud prevention and legal obligations such as invoicing (legitimate interest and legal obligation).
Where data is stored
Data is hosted in the European Union (Hetzner data centres in Germany and Finland). Each merchant’s member data is kept in a separate database. We use sub-processors only where needed (for example payment processing and email delivery) and list them in the DPA.
Retention
Merchant account data is kept while the account is active and for the period required by tax law afterwards. Member data is kept for as long as the merchant runs its program, or until the member or merchant deletes it.
Your rights
Under the GDPR you can request access to, correction of, export of, or deletion of your personal data, object to processing, and withdraw consent at any time. Loyalty members can export and delete their data from the app. You can also lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr).
Cookies
This website uses a few cookies. The necessary ones keep the site working and secure and are used without consent, because the site cannot work without them. Statistics cookies and the partner cookie are set only if you agree, and you can withdraw your consent at any time.
| Cookie | Purpose | Type | Cookie lifetime |
|---|---|---|---|
connect.sid | Keeps your visit together: form security, the sign-up steps and, without your consent, the partner code of the current visit. | Necessary | 24 hours |
locale | Remembers the language you chose. | Necessary | 1 year |
l360_consent | Remembers your cookie choice. | Necessary | 6 months |
token, staff_token, aff_token | Keep businesses, staff and partners signed in. Set only when you log in. | Necessary | Until you log out, at most 30 days |
_ga | Google Analytics (Google Ireland Ltd): tells apart visitors to produce statistics on how the site is used. | Statistics, only with your consent | 2 years |
_ga_RQY9C5YB9S | Google Analytics: keeps the state of your visit for the same statistics. | Statistics, only with your consent | 2 years |
_clck | Microsoft Clarity (Microsoft): recognises your browser between visits, so we can see how the site is used. | Statistics, only with your consent | 1 year |
_clsk | Microsoft Clarity: groups the pages you view in one visit. | Statistics, only with your consent | 1 day |
l360_ref | Remembers the partner link you came from, so the partner who recommended Loyalty.360 gets credit if you sign up. | Marketing, only with your consent | 60 days |
Statistics: if you agree, we use these tools to see which pages are visited, how visitors move through the site and where it can be improved. They are not used for advertising, and we do not share them with advertisers.
- Google Analytics 4 (Google Ireland Ltd). GA4 does not log or store IP addresses; Google uses them only briefly to estimate the region. Google signals and ad personalisation are off. Data may be processed by Google in the United States, under the EU-US Data Privacy Framework.
- Microsoft Clarity (Microsoft). It records clicks, scrolling and mouse movement as heatmaps and session recordings, and by default hides the text you type in forms. Data may be processed by Microsoft in the United States, under the EU-US Data Privacy Framework.
On the sign-up and login forms we use Cloudflare Turnstile to keep bots out. It runs from Cloudflare’s own domain and is part of the site’s security.
We do not use advertising cookies. Statistics tools load only after you agree, and nothing is sent to them before that.
To change your choice, use “Cookie settings” at the bottom of every page. If you withdraw consent, we stop the statistics tools and delete their cookies and the partner cookie. You can also delete cookies in your browser settings. Cookie settings
Points have no cash value
Loyalty points are issued by the merchant, have no cash value and are governed by the merchant’s own program terms.
Contact
Questions about this policy: support@loyalty360.app