Privacy policy

This privacy policy explains how ALBA Rewards ("we", "us" or "our") collects and uses personal information through ALBA Rewards at app.albarewards.com, and the choices you have.

Businesses and their customers

Businesses use the service to run loyalty programmes for their own customers. We handle these two groups' information differently:

• Businesses using the service. We decide how this information is used, so we are its data controller. This policy describes what we do with it.
• Customers who join a business's loyalty programme. The business decides what to collect and how to use it, so it is the data controller and we process the information on its behalf. If you are a customer, please contact the business about your information. We will help it with your request.

Information we collect

• Account information: your name, email address and password (stored securely as a one-way hash), and the stores, cards, rewards and locations you set up.
• Billing information: if you pay for the service, the details needed to bill you.
• Messages: anything you send us when you contact us.
• Technical information: such as your IP address, browser and device, collected automatically to keep the service secure and working.

Information we hold for businesses

When a customer joins a business's loyalty programme, we store the details that business's sign up form asks for (such as name, email address, phone number and birthday), their loyalty card, stamps, rewards and redemptions, and what's needed to deliver and update their Apple Wallet or Google Wallet pass. We only use it to run that business's loyalty programme, on its instructions.

How we use it

We use information to provide and run the service, manage your account, send you service messages (such as security, billing and account emails), give you support, keep the service secure and prevent fraud, and meet our legal obligations. We rely on performing our contract with you, our legitimate interests in running and protecting the service, our legal obligations and, where needed, your consent.

Who we share it with

We don't sell personal information or share it for anyone else's marketing. We only share it:

• with trusted providers that host and run parts of the service for us, who may only use it to provide their service to us;
• with Apple and Google, to deliver the wallet passes customers add;
• with integrations you connect, on your instructions;
• where the law requires it, or to protect the rights and safety of others;
• with a buyer or successor if our business is sold or reorganised.

Cookies

We use essential cookies to keep you signed in, keep the service secure and remember your preferences. The service can't work without them. You can block or delete cookies in your browser, but parts of the service may stop working.

How long we keep it

We keep account information while your account is open. When you delete your account, we delete your information and your customers' information from our live systems, and copies in our encrypted backups are removed as those backups expire. We may keep limited records for longer where the law requires it, such as billing records.

Keeping it safe

We use appropriate technical and organisational measures to protect personal information, including encrypting it in transit. No system is completely secure, but we work hard to protect your information and will tell you if a breach affects you where the law requires it.

International transfers

Some of our providers are based outside your country. Where information is transferred abroad, we make sure appropriate safeguards are in place, such as the European Commission's standard contractual clauses.

Your rights

Depending on where you live, you may have the right to access, correct or delete your personal information, to restrict or object to how we use it, to receive a copy of it and to withdraw any consent you have given. To make a request, contact us at [email protected]. You also have the right to complain to your local data protection authority.

Children

You must be 18 or over to create an account for a business. We don't knowingly collect information from children for our own purposes. If you think a child has given us their information, contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. If we make significant changes, we will let you know, for example by email or with a notice in the service.

Contact us

If you have questions about this policy or how we use your information, contact ALBA Rewards at [email protected].