Privacy notice

This Notice explains how personal data is processed when a person uses LoyalPass, joins a Merchant loyalty programme or contacts LoyalPass. It applies together with the Merchant-specific information shown at enrolment.

1. Who processes data

For data used to operate a loyalty programme, the Merchant identified on the enrolment page is normally the controller. LoyalPass processes that data for the Merchant as processor.

Daniel Yilong Keye, with registered address at C/ de Felipe Sanclemente, 8, Esc 1ª, 4º, Casco Antiguo, 50001 Zaragoza and NIF/VAT X4264005N, is an independent controller for data needed to administer Merchant relationships, billing, security, support, fraud prevention and legal compliance.

2. Data processed

• Enrolment and contact data: name, email address and/or phone number when provided.
• Pass and activity data: pass identifier, stamps, points, rewards, redemptions, visits and timestamps.
• Necessary technical data: Wallet identifiers, pass-delivery data, security logs and limited request data.
• Preferences: marketing acceptance or withdrawal and, where applicable, the optional analytics decision.

LoyalPass does not request payment-card data, identity documents or real-time location in standard enrolment.

3. Purposes and legal bases

• Operate the Programme, issue and update the pass, record activity and enable redemption: performance of the Member’s relationship with the Merchant or pre-contractual steps, as determined by the Merchant.
• Prevent fraud, secure the platform, resolve incidents and defend claims: legitimate interests, legal obligation or another applicable basis.
• Send Merchant marketing: consent where required. Participation is not conditional on marketing consent.
• Manage Merchant accounts, billing and LoyalPass compliance: contract performance, legal obligation and LoyalPass legitimate interests, as applicable.

4. Recipients and transfers

The Merchant can access data from its own Programme. LoyalPass uses providers for hosting and database services, Wallet-pass issuance, communications, abuse prevention and, if accepted, optional analytics. Those providers receive only data necessary for their service and are subject to contractual confidentiality and data-protection obligations.

If processing involves a transfer outside the European Economic Area or the United Kingdom, LoyalPass and the Merchant will apply the applicable mechanism, such as an adequacy decision, standard contractual clauses and, where appropriate, supplementary measures. You can request additional information at dkylabs@gmail.com.

5. Retention

Each Programme's specific notice determines retention. Under the standard model, Member data is retained while the pass remains active or until the Member requests cancellation; it is then erased or irreversibly anonymised, except for data that must remain blocked for legal obligations or potential claims. LoyalPass retains its own data only as long as needed for its contractual relationship, security, accounting, legal duties and claims.

6. Your rights

Subject to applicable law, you can request access, rectification, erasure, restriction, objection and portability, and withdraw consent without affecting prior processing. For Programme data, contact the Merchant identified at enrolment first. LoyalPass will assist the Merchant when acting as processor. For LoyalPass’s own processing, write to dkylabs@gmail.com.

You can also lodge a complaint with the Spanish Data Protection Agency or another competent authority.

7. Cookies and storage

LoyalPass uses cookies or storage necessary for authentication, security, session continuity, language preferences, enrolment recovery and user-requested editing. Optional browser analytics is not loaded before acceptance, uses in-memory session state, and keeps autocapture, session replay and person profiles disabled. Server monitoring is separate and must be verified against its purpose, configuration and contract before launch.

8. Children

The Programme is available only to people aged 18 or over. Enrolment requires an adult-age affirmation but does not verify identity documents. Merchants must not enrol, or provide LoyalPass with, a minor's data for this Programme.

9. Changes to this Notice

We will update this Notice when the service, processing or law changes. We will publish the new version and communicate material changes through appropriate means where required.