This is a courtesy translation. The legally binding version of this document is the Spanish one. In the event of any discrepancy between this English text and the Spanish original, the Spanish version prevails. Read the Spanish version.
1. DATA CONTROLLER
The controller of your personal data in connection with the use of the loyalty programme service operated under the trade name loyalita (hereinafter, the “Service”) is:
Digital Monkey S.L.
Tax ID (CIF/NIF): B19957083
Website: https://loyalita.es
General contact email: hola@loyalita.es
In this Policy we refer to Digital Monkey S.L. as the “Controller”, the “Company” or “we”.
2. SCOPE
This Privacy Policy applies to natural persons who register and use the Service in order to take part in one or more loyalty programmes run by businesses (hereinafter, the “Users”). The Service is not directed at children under 14. If you are under 14, you must not register or provide us with your personal data. We may request reasonable evidence to verify your age.
3. WHO SETS THE TERMS OF THE LOYALTY PROGRAMMES
Each business (restaurant, café or other establishment) that uses the Service (hereinafter, the “Business”) independently sets the terms of its loyalty programme — for example: the number of stamps required for a gift, the discount percentage, the point accrual rules, tiers or categories, restrictions and the validity of rewards. We provide the technical platform for Businesses to manage their programmes, but we do not decide the specific content of those commercial terms and we are not a party to the sales contract between you and the Business (food, drinks, services, discounts, gifts, etc.).
4. PERSONAL DATA WE PROCESS
Depending on how you use the Service, we may process the following categories of personal data:
4.1. Registration and contact data
- First name and surname (or alias).
- Phone number.
- Email address.
- Language, country or city.
4.2. Data related to the use of loyalty programmes
- Programmes and Businesses you have joined.
- Stamps, points, discounts and other rewards accrued or redeemed.
- Loyalty transaction history (date, time, Business, type of transaction and, where applicable, the associated amount when the Business records it).
4.3. Technical and Service usage data
- IP address, device identifiers, operating system, app version.
- Access and usage data (date and time of access, sections viewed, actions carried out within the Service).
- Approximate geolocation data, only where you allow it in your device settings and only where it is necessary for specific features (for example, showing nearby Businesses).
4.4. Communication and marketing preferences
- Your choice as to whether or not to receive commercial communications (email, SMS, push notifications).
- Your preferences regarding types of Businesses or offers, where you expressly indicate them.
4.5. Data arising from your interaction with us
- Enquiries, incidents or complaints you send us.
- Information you choose to include in your communication.
5. PURPOSES AND LEGAL BASES FOR PROCESSING
We process your personal data for the following purposes and on the following legal bases:
5.1. Managing your registration and User account
- Creating and maintaining your account on the Service.
- Allowing you to join loyalty programmes of different Businesses.
- Displaying your balance of points/stamps/benefits and your history.
Legal basis: performance of a contract (art. 6.1.b GDPR).
5.2. Applying the terms of the Businesses' loyalty programmes
- Recording your visits or loyalty transactions at each Business, when the Business reports them through the Service.
- Calculating and managing your points, stamps, discounts and other rewards according to the rules set by each Business.
Legal basis: performance of the contract of participation in the loyalty programme (art. 6.1.b GDPR).
5.3. Communications necessary for the operation of the Service
- Sending notices about changes to the terms of the Service, account security, registration confirmations and other strictly necessary communications.
- Sending notifications about the accrual, redemption or expiry of rewards where these are essential to the operation of the programme.
Legal basis: performance of a contract and legitimate interest in ensuring the correct operation of the Service (art. 6.1.b and 6.1.f GDPR).
5.4. Commercial communications and marketing
- Sending commercial communications (email, SMS, push notifications) about: – the loyalita Service itself; – programmes, promotions and offers from Businesses with which you already have a relationship through the Service.
Legal basis: your consent (art. 6.1.a GDPR) and, where applicable, our legitimate interest in promoting similar services, respecting your rights (art. 6.1.f GDPR). You may withdraw your consent or object at any time.
5.5. Analysis and improvement of the Service
- Obtaining aggregated or pseudonymised statistics on the use of the Service.
- Improving functionality, performance and security.
Legal basis: legitimate interest in improving the Service (art. 6.1.f GDPR), applying appropriate safeguards.
5.6. Fraud prevention and security
- Detecting and preventing abusive or fraudulent use of the Service (for example, creating fake accounts or manipulating stamps or receipts).
- Protecting the security of our systems and of Users' accounts.
Legal basis: legitimate interest in protecting the Service and its Users (art. 6.1.f GDPR) and, where applicable, compliance with legal obligations (art. 6.1.c GDPR).
5.7. Compliance with legal obligations
- Complying with legal obligations in tax, accounting and data protection matters, or with other rules applicable to us.
Legal basis: compliance with legal obligations (art. 6.1.c GDPR).
6. RECIPIENTS AND ACCESS TO DATA
6.1. Businesses
When you join the loyalty programme of a specific Business, we share with that Business the data necessary to manage its programme, for example:
- your identifier as a User within the Service;
- your basic contact details (for example, name, phone number, email address);
- information about your visits and loyalty transactions at that Business.
In relation to this processing:
- we act as the controller for the general management of the platform;
- each Business acts as an independent controller for the purposes it defines (for example, its own customer service or marketing activities within legal limits). Each Business is responsible for complying with data protection law in its own activities. We are not responsible for processing that Businesses carry out outside the Service or for purposes they determine themselves.
6.2. Service providers (processors)
We may give access to your data to third-party providers who supply services necessary for the operation of the Service, such as:
- hosting and IT maintenance services;
- email, SMS or push notification providers;
- analytics and monitoring services;
- payment gateway providers, where necessary.
These third parties act as processors, following our instructions and under contracts that comply with article 28 GDPR.
6.3. International transfers
Some of our providers may be located outside the European Economic Area (EEA). In such cases, we will only carry out international transfers where there is an adequacy decision from the European Commission or where appropriate safeguards apply, such as standard contractual clauses or other mechanisms recognised by the GDPR. You may request further information about these providers and the safeguards applied by contacting us at hola@loyalita.es.
7. DATA RETENTION PERIODS
We will keep your personal data for the following periods, without prejudice to longer periods where these are necessary for bringing or defending claims or for compliance with legal obligations:
- Registration and account data: for as long as you keep your account active on the Service.
- Loyalty programme data: for as long as you are a member of the relevant programmes and, thereafter, for the limitation periods applicable to potential legal liabilities.
- Data used for commercial communications: until you withdraw your consent or object to continuing to receive such communications.
- Usage data and technical logs: for as long as necessary for security, maintenance and improvement of the Service.
- Data relating to legal obligations (for example, invoicing): for the periods required by applicable law.
Once the data are no longer necessary for the stated purposes, they will be blocked for the applicable limitation periods and subsequently deleted or anonymised.
8. USERS' RIGHTS
You may exercise the following data protection rights, on the terms provided for by law:
- Right of access: to know whether we process your data and, if so, to obtain a copy.
- Right to rectification: to correct inaccurate or incomplete data.
- Right to erasure: to request deletion of your data where there is a legal basis for doing so.
- Right to restriction of processing: to request that processing be restricted in certain circumstances.
- Right to data portability: to receive your data in a structured, commonly used and machine-readable format, and to transmit them to another controller where technically feasible.
- Right to object: to object to processing based on legitimate interest or to the receipt of commercial communications.
- Right to withdraw consent: where processing is based on your consent, you may withdraw it at any time.
To exercise these rights against Digital Monkey S.L., you may contact us at:
- Email: hola@loyalita.es
- Postal address: C/ Padre Urbano 16, 19 — 46009 Valencia, España, marked “Data protection” and including, where applicable, a copy of a document proving your identity.
If you wish to exercise your rights against a specific Business (for example, in relation to that Business's own marketing activities), you must contact that Business directly as an independent controller.
You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) if you consider that your data protection rights have been infringed. Further information is available on the AEPD website.
9. DATA SECURITY
We apply appropriate technical and organisational measures to protect your personal data against destruction, loss, alteration or unauthorised access, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing. However, no system is completely secure. If we detect a security breach that may pose a high risk to your rights and freedoms, we will inform you on the terms required by law.
10. AUTOMATED DECISIONS AND PROFILING
We may carry out basic segmentation or simple profiling (for example, based on visit frequency, type of Business or use of certain Programmes) in order to:
- Show you more relevant information within the Service.
- Adapt commercial communications to some extent, provided you have consented to receiving them.
We never take decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you within the meaning of article 22 GDPR, without providing you with additional information and the required safeguards.
11. CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy where necessary to reflect legislative, technical or business changes. The current version will always be available on the Service, stating the date of the last update. Where changes are significant, we will inform you visibly (for example, through a notice in the app or by email). Continued use of the Service after the new Policy takes effect means that you have read and understood its content. If you do not agree with the changes, you must stop using the Service and, where appropriate, request deletion of your account.
Related documents: Privacy Policy · Terms and Conditions · Cookie Policy · Legal Notice