Privacy Policy

This Privacy Policy explains how Loyalty Club PLC (“we”, “us”) collects, uses, stores, and shares personal data when you use our websites, mobile applications, and the Loyalty Club platform. We are a UK-registered company (No. 14580450).

1. Who we are

Loyalty Club PLC is the data controller for personal data collected through loyaltyclubplc.com and our partner and member portals. You can contact us at hello@loyaltyclubplc.com.

2. Data we collect

• Account data — name, email, postcode, business details if you register as a partner.
• Loyalty activity — stamps earned, campaigns joined, TEDS balances and transaction history.
• Enquiries & communications — your name, email, company and any details you provide (such as a region or postcode) via our contact, enquiry and support forms, plus the messages you send us.
• Technical data — IP address, device type, browser, and usage analytics about how you interact with the site.
• Session-interaction data — with your consent, Microsoft Clarity records heatmaps and replays of how you use our pages (clicks, scrolling, navigation) to help us diagnose usability problems. Text inputs and sensitive content are masked by default.

3. How we use your data

We process personal data to:

• operate the platform — track stamps, campaigns and TEDS balances;
• provide partner reports and customer insights;
• route affiliate and equity-partner commissions;
• respond to support requests and contact form submissions;
• send transactional and (with consent) marketing communications;
• with your consent, measure our advertising — successful form submissions and outbound checkout clicks generate conversion-measurement events shared with our advertising partners (see §5 and §8).

4. Lawful basis

We rely on a combination of contract (to deliver the platform you signed up for), legitimate interest (for fraud prevention and security), and consent (for marketing). Consent is opt-in and can be withdrawn at any time. For non-essential cookies and similar technologies — analytics and advertising (see §8) — our lawful basis is your consent, given via our cookie banner and withdrawable at any time through “Cookie settings”.

5. Sharing

We do not sell personal data. We share data with vetted processors who act on our instructions — payment providers (Square), email infrastructure (Resend), and hosting (Vercel) — under data-protection terms.

With your consent, we also share analytics and advertising data with the partners below, who may act as independent or joint controllers for their own measurement and audience purposes:

• Google — Google Analytics 4 and Google Ads.
• Microsoft — Clarity (heatmaps and session replays).
• Meta Platforms — the Facebook/Instagram Pixel.

These partners only receive data once you accept non-essential cookies (see §8).

6. Retention

Account data is retained while your account is active. After deletion, residual backups are purged within 30 days. Tax-relevant transaction records are retained for the period required by HMRC.

7. Your rights

Under UK GDPR you have the right to:

• access the data we hold about you;
• correct inaccuracies;
• request deletion of your account and associated data;
• restrict processing while a query is resolved;
• object to processing, including to direct marketing or ad personalisation;
• request portability of your data;
• withdraw consent at any time — including via “Cookie settings” in the footer for analytics and advertising.

Members can delete their account directly in the Loyalty Club app. To exercise other rights, email hello@loyaltyclubplc.com.

8. Cookies

We use one strictly necessary cookie, lc_consent, to remember your cookie choice (kept for up to 180 days). Your theme preference is stored in your browser’s local storage, not a cookie. These essentials don’t require consent.

Only after you accept in our cookie banner do we set non-essential cookies for analytics and advertising measurement:

• Google Analytics 4 — how visitors use the site (e.g. the _ga cookie, typically up to 2 years). See Google’s privacy policy.
• Microsoft Clarity — heatmaps and session replays (e.g. _clck, _clsk). See Microsoft’s privacy statement.
• Google Ads — advertising performance and audiences (e.g. _gcl_au). See Google’s advertising policy.
• Meta Pixel (Facebook/Instagram) — advertising performance and audiences (e.g. _fbp). See Meta’s privacy policy.

These are blocked by default — via Google Consent Mode for the Google tags, and the equivalent consent controls for Microsoft Clarity and the Meta Pixel — until you opt in. You can change or withdraw your choice at any time using “Cookie settings” in the footer.

9. International transfers

Some of our partners — notably Google and Meta — process data in the United States. Where we transfer personal data outside the UK, we rely on the UK Extension to the EU–US Data Privacy Framework (where the recipient is certified) or, otherwise, the UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment. Contact us for details.

10. Changes

We’ll publish material changes here and notify account holders by email at least 14 days before they take effect.

11. Complaints

If you’re unhappy with how we handle your data, you can complain to the UK Information Commissioner’s Office at ico.org.uk.