Privacy Policy

This Privacy Policy explains how Loyalty Club PLC (“we”, “us”) collects, uses, stores, and shares personal data when you use our websites, mobile applications, and the Loyalty Club platform. We are a UK-registered company (No. 14580450).

1. Who we are

Loyalty Club PLC is the data controller for personal data collected through loyaltyclubplc.com and our partner and member portals. You can contact us at hello@loyaltyclubplc.com.

2. Data we collect

• Account data — name, email, postcode, business details if you register as a partner.
• Loyalty activity — stamps earned, campaigns joined, reward balances and transaction history.
• Orders— when you order from a business through Loyalty Club: your name, email and phone number, what you ordered and when you want it, and for a delivery the address, the name of the person it is for and any card message. Payment is taken by the business’s own payment provider; we never see your card details.
• Saved details — a phone number and delivery addresses you ask us to remember for your next order. These can include the name and address of someone you send an order to.
• Enquiries & communications — your name, email, company and any details you provide (such as a region or postcode) via our contact, enquiry and support forms, plus the messages you send us.
• Technical data — IP address, device type, browser, and usage analytics about how you interact with the site.
• Session-interaction data — with your consent, Microsoft Clarity records heatmaps and replays of how you use our pages (clicks, scrolling, navigation) to help us diagnose usability problems. Text inputs and sensitive content are masked by default.

3. How we use your data

We process personal data to:

• operate the platform — track stamps, campaigns and reward balances;
• pass your order to the business you are buying from, and send you its confirmation and updates;
• fill in your details at checkout, when you have asked us to remember them;
• provide partner reports and customer insights;
• route affiliate and equity-partner commissions;
• respond to support requests and contact form submissions;
• send transactional and (with consent) marketing communications;
• with your consent, measure our advertising — successful form submissions and outbound checkout clicks generate conversion-measurement events shared with our advertising partners (see §5 and §8).

4. Lawful basis

We rely on a combination of contract (to deliver the platform you signed up for), legitimate interest (for fraud prevention and security), and consent (for marketing). Consent is opt-in and can be withdrawn at any time. For non-essential cookies and similar technologies — analytics and advertising (see §8) — our lawful basis is your consent, given via our cookie banner and withdrawable at any time through “Cookie settings”.

Orders, and the details you ask us to remember, are processed to provide the service you asked for (contract). When you send an order to someone else, we process their name and address in our legitimate interest in delivering the order you placed for them.

5. Sharing

We do not sell personal data. We share data with vetted processors who act on our instructions — payment providers (Square and Revolut), email infrastructure (Resend), and hosting (Vercel) — under data-protection terms.

When you order from a business, that business receives what it needs to fulfil your order: your name, email and phone number, what you ordered, and for a delivery the address, recipient and card message. The business is the seller and is responsible for how it uses them. Businesses never see your saved details, only what you send with an order.

With your consent, we also share analytics and advertising data with the partners below, who may act as independent or joint controllers for their own measurement and audience purposes:

• Google — Google Analytics 4 and Google Ads.
• Microsoft — Clarity (heatmaps and session replays).
• Meta Platforms — the Facebook/Instagram Pixel.

These partners only receive data once you accept non-essential cookies (see §8).

6. Retention

Account data is retained while your account is active. After deletion, residual backups are purged within 30 days. Tax-relevant transaction records are retained for the period required by HMRC.

Orders are kept as the business’s record of the sale for that same period, including after you delete your account. Saved phone numbers and addresses are kept until you delete them in the app (Settings → Addresses) or delete your account.

7. Your rights

Under UK GDPR you have the right to:

• access the data we hold about you;
• correct inaccuracies;
• request deletion of your account and associated data;
• restrict processing while a query is resolved;
• object to processing, including to direct marketing or ad personalisation;
• request portability of your data;
• withdraw consent at any time — including via “Cookie settings” in the footer for analytics and advertising.

Members can delete their account, and their saved phone number and addresses, directly in the Loyalty Club app. To exercise other rights, email hello@loyaltyclubplc.com.

8. Cookies

We use one strictly necessary cookie, lc_consent, to remember your cookie choice (kept for up to 180 days). Your theme preference is stored in your browser’s local storage, not a cookie. These essentials don’t require consent.

Only after you accept in our cookie banner do we set non-essential cookies for analytics and advertising measurement:

• Google Analytics 4 — how visitors use the site (e.g. the _ga cookie, typically up to 2 years). See Google’s privacy policy.
• Microsoft Clarity — heatmaps and session replays (e.g. _clck, _clsk). See Microsoft’s privacy statement.
• Google Ads — advertising performance and audiences (e.g. _gcl_au). See Google’s advertising policy.
• Meta Pixel (Facebook/Instagram) — advertising performance and audiences (e.g. _fbp). See Meta’s privacy policy.

These are blocked by default — via Google Consent Mode for the Google tags, and the equivalent consent controls for Microsoft Clarity and the Meta Pixel — until you opt in. You can change or withdraw your choice at any time using “Cookie settings” in the footer.

9. International transfers

Some of our partners — notably Google and Meta — process data in the United States. Where we transfer personal data outside the UK, we rely on the UK Extension to the EU–US Data Privacy Framework (where the recipient is certified) or, otherwise, the UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment. Contact us for details.

10. Changes

We’ll publish material changes here and notify account holders by email at least 14 days before they take effect.

11. Complaints

If you’re unhappy with how we handle your data, you can complain to the UK Information Commissioner’s Office at ico.org.uk.