Privacy Policy

1. Who We Are

Loyalio ("we", "our", "us") is a loyalty and marketing platform for businesses across the UK, operated at loyalio.co.uk. This Privacy Policy explains how we collect, use, and protect personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

For data protection enquiries, contact us at: support@loyalio.co.uk

2. Data We Collect

Business Accounts (our clients)

• Name, email address, phone number
• Business name, address, and type
• Payment information (processed securely via SumUp or PayPal)
• Platform usage data and analytics

End Customers (your loyalty members)

When businesses use Loyalio, they may enter data about their own customers, including:

• Name, email address, mobile number
• Date of birth (for birthday rewards)
• Visit history, spend data, and loyalty points
• Profile preferences and tier information

In this context, the business is the data controller and Loyalio acts as a data processor. Businesses are responsible for ensuring they have lawful grounds to share this data with us.

3. How We Use Your Data

• To provide and operate the Loyalio platform
• To process subscription payments and send receipts
• To send service-related communications (e.g. account updates, support responses)
• To improve our platform through aggregated, anonymised analytics
• To comply with legal obligations

4. Legal Basis for Processing

We rely on the following legal bases under UK GDPR:

• Contract: Processing necessary to fulfil our subscription agreement with you
• Legitimate interests: Improving our services and preventing fraud
• Legal obligation: Complying with applicable laws
• Consent: Where we rely on your explicit consent (e.g. marketing emails)

5. Data Sharing

We do not sell your personal data. We may share data with:

• Payment processors (SumUp, PayPal) to handle subscription payments
• Email providers (Resend) to deliver transactional emails
• SMS providers (Twilio) for marketing messages on behalf of businesses
• Hosting and infrastructure providers for platform operation
• Any party where we are required to do so by law

All third-party processors are required to handle data securely and only as instructed.

6. Data Retention

We retain your data for as long as your account is active or as needed to provide services. After account closure, we retain data for up to 6 years to comply with financial and legal obligations, then securely delete it.

7. Your Rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data ("right to be forgotten")
• Restrict or object to processing
• Data portability
• Withdraw consent at any time

To exercise any of these rights, contact us at support@loyalio.co.uk. We will respond within 30 days.

8. Cookies

Our platform uses essential cookies to maintain your session and preferences. We do not use third-party advertising cookies. By using our platform, you consent to essential cookies.

9. Security

We implement appropriate technical and organisational measures to protect your data, including encryption in transit (TLS), access controls, and regular security reviews. However, no online service can guarantee absolute security.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or via in-app notice. The date at the top of this page indicates when the policy was last revised.

11. Complaints

If you have concerns about how we handle your data, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

12. Contact Us

For any privacy-related questions:

📧 support@loyalio.co.uk