Privacy Policy

PRIVACYPOLICY FOR LOIALE USER SERVICES

Through this Privacy Policy, CELERITYSOFTWARE S.L. ("LOIALE", "we", "us", and"our") aims to inform you about the processing of your Personal Datawhile using our User Services. Below, you will find information about what PersonalData we collect about you, how we use it, for what purposes we use it, withwhom we share it, and what rights you have concerning the processing of yourPersonal Data. Additionally, you will find information about data processing bythe Business you are visiting, as indicated during registration.

As described below, for some dataprocessing activities, we act as joint controllers with the Business. Wedetermine our respective responsibilities in a joint controller agreement asestablished in Article 26 of Regulation 679/2016/EC of the European Parliamentand Council of 27 April 2016 (“GDPR”).

If you have any questions, concerns, orcomments about this Privacy Policy or any request regarding the processing ofyour Personal Data by LOIALE, please contact our Data Protection Officer at support@loiale.com (start email with “DPO:”).

For questions related to the processingof your Personal Data by the Business you visit, please contact LOIALE usingthe contact details provided during registration if you cannot contact theBusiness directly.

1. Definitions

• Personal     Data: means any information relating to an identified     or identifiable natural person, particularly by reference to an identifier     such as a name, identification number, or location data.
• Basic     Profile Information: means the Personal Data     you provide to us during the registration process and while using our     Services, which will include, among other things: your name, date of     birth, age, gender, photographic material, city and/or country of     residence and/or birth, postal code, email address, phone number,     credentials to access part or all of this information in your social media     profiles (Facebook or LinkedIn), as well as information that is publicly     available on those profiles.
• Business-Specific     Information: means Personal Data collected through surveys     and during your visit to a Business's premises or website, including,     among other things: date, time, duration, and frequency of your visits,     your presence at a Business's premises, your preferences observed by the     Business, as well as information we collect when you visit our Website or     use our mobile applications such as, among other things: the full     clickstream of Uniform Resource Locators (URLs) to, through, and from our     Services (including date and time), page response times on websites,     download errors, duration of visits to certain areas, page and mobile     application interaction information (such as scrolling, clicks, and mouse     movements), and the methods you are using to navigate away from the pages.
• Business-Specific     Transaction Information: means Personal Data     collected when you shop online at a Business through the Websites or the     Business's website or as a result of using loyalty cards or coupons at a     Business Premises or on our Website. This includes, among other things:     products purchased, their quantity and price, date and time of     transactions, coupons used, tips given, full postal address.
• Device     Information: means Personal Data relating to technical     information automatically collected to provide you with the service, such     as the Internet Protocol (IP) address used to connect to the Internet,     login information, browser type and version, time zone settings, browser     plug-in types and versions, device model, operating system and platform,     as well as the MAC (Media Access Control) address of your device, which is     a unique identifier assigned by the device manufacturer.
• Processing: means any operation performed on Personal Data, such as     collection, recording, organization, structuring, storage, adaptation, or     any kind of disclosure or other use.
• Businesses: means the Businesses that have subscribed to the Loiale Service     for Businesses.
• Affiliate     Businesses: means any entity that controls, is controlled     by, or is under common control with the Business, any entity operating     under the same brand as the Business, or the owner of the visited     location.
• Sponsor: means any entity that pays in whole or in part for the Businesses'     subscriptions to the Loiale Service for Businesses.
• Website     or Websites: means web pages that allow the registration     and/or access to Loiale Services for Users by the End Users.

2. INFORMATIONABOUT HOW LOIALE USES YOUR PERSONAL DATA

2.1.Purpose of Processing

In this section, we have outlinedinformation about the Personal Data we process, the purposes for which we usethe Personal Data, and the legal basis for the Processing of your PersonalData.

2.1.1. If you want to use our Services,you must register with a Business by connecting with a Wi-Fi device (e.g., asmartphone, tablet, or computer) to the Wi-Fi Network owned by each visitedBusiness or by registering on the Business's website. During the registrationprocess and while using our Services, you provide us with your Basic ProfileInformation, certain Business-Specific Information, and certainBusiness-Specific Transaction Information. The legal basis for this Processingof your Personal Data is the performance of the Terms and Conditions.

2.1.2. When you visit our Websites oruse our mobile applications, we additionally and automatically collect furtherBusiness-Specific Information and Business-Specific Transaction Information toconduct analyses on the use of the Services. The legal basis for thisProcessing is the performance of the Terms and Conditions, as well as ourlegitimate interests in analyzing the use of our Services and improving youruser experience.

2.1.3. Additionally, LOIALE will collectany phone number used to call our customer service, as it is necessary toprocess your request. The legal basis for this Processing of your Personal Datais the performance of the Terms and Conditions, as well as our legitimateinterest in providing you with adequate customer support.

2.1.4. While using our Services, we mayautomatically collect Device Information to provide you with the Services. Thelegal basis for this Processing is the performance of the Terms and Conditions.

2.1.5. To improve your experience usingour Services and to provide you with segmented services and information, LOIALEprocesses certain Personal Data to send you information and direct advertisingvia electronic messages about goods or services similar to those you havealready obtained. We may analyze the acceptance of electronic advertising(e.g., by recording whether you have read an electronic message or clicked onthe links). The legal basis for this Processing of your Personal Data is ourlegitimate interest in analyzing and improving our Services. You can object tothis Processing at any time.

2.1.6. Specific Processing operationsduring your visits to a Business's premises include:

2.1.6.1. During your visits to aBusiness's premises, we will collect Business-Specific Information. The legalbasis for this Processing of your Personal Data is the performance of the Termsand Conditions, as well as our legitimate interest in keeping our Servicestailored to specific End Users.

2.1.6.2. If you are browsing theInternet during your visit to a Business's premises, we will never monitor youractivity. Note that a Business may restrict access to certain websites at itsown discretion.

2.1.6.3. To distinguish one End Userfrom another, we may use Device Information to automatically identify you uponyour arrival at a Business's premises and authenticate your device when usingour Services. The legal basis for this Processing is our legitimate interest inincreasing the usability of our Services and providing them more simply.

2.2.Disclosure of Personal Data

In this section, we have outlinedinformation about the parties to whom your Personal Data may be disclosed andthe legal basis for the disclosure.

2.2.1. Note that Basic Profile Information and Device Information will be shared with each visited Businessand its Affiliate Businesses. Business-Specific Information andBusiness-Specific Transaction Information will only be shared with the Businessvisited while this information was collected and with its Affiliate Businesses.

The legal basis for this disclosure ofyour Personal Data to the Businesses and their Affiliate Businesses is theperformance of the Terms and Conditions. To ensure that the transfer does notdisproportionately interfere with your rights and freedoms, and to determinethe respective responsibilities in fulfilling GDPR obligations, an agreementhas been concluded between us and the mentioned parties. This agreementconstitutes a joint controller agreement under Art. 26 GDPR and regulates (i)the transfer of collected Personal Data and the limitation of the use of suchtransferred Personal Data for the provision of our Services, (ii) the technicaland organizational measures that we and the third parties must adopt to protectthe transferred Personal Data, and (iii) your rights regarding the transferredPersonal Data as described below and the fact that such rights can be exercisedagainst us or any of the third parties. In particular, the agreement stipulatesthat each of us will handle data processing activities at our own discretionand, although we are separately responsible for complying with data protectionrequirements, we will assist each other when necessary.

2.2.2. Note that, within the scope ofour mentioned Processing activities, we will disclose your Personal Data toother processors residing in the EU who will help us provide our services andprocess your Personal Data on our behalf and under our control. The legal basisfor this disclosure of your Personal Data is Art. 28 GDPR.

To ensure that your Personal Data isused only to the extent necessary and in accordance with legal requirements andour instructions, we have bound our processors by entering into a DataProcessing Agreement. This way, we ensure that your Personal Data will only beprocessed for the purposes mentioned above.

2.2.3. Note that your Personal Data maybe transferred to a third country outside the European Economic Area. Thosecountries may not provide an adequate level of data protection. LOIALE willensure that such transfer is made to countries that have an adequate level ofdata protection (according to European Commission Adequacy Decisions) or LOIALEwill conclude Standard Contractual Clauses with each recipient residing in acountry not covered by an Adequacy Decision of the European Commission. TheStandard Contractual Clauses can be viewed here: Standard Contractual Clauses.

2.2.4. Finally, note that only if youexplicitly authorize it, we may communicate your Personal Data to the Sponsorof the Businesses you visit so that they can send you commercial communicationsabout their products and services, including newsletters. In such cases, theSponsor will include you in its customer database. Additionally, for the samepurpose, the Sponsor may study and consider your characteristics, tastes, andpreferences, creating profiles according to them and cross-referencing thisinformation with other information such as your browsing information, onlinesearches on services and platforms owned by the Sponsor, your requests made tothe Sponsor, and your contact history. You are free to decide whether toconsent to the data transfer to the Sponsor. You can refuse to provide and(without prejudice to data processing activities that have taken place beforesuch withdrawal or any other existing legal justification for the dataprocessing activity in question) withdraw your consent to transfer personaldata at any time. Refusing to give consent does not affect the use of theServices. Please read the Sponsor's Privacy Policy provided to you when werequest your explicit consent.

2.3.Retention Periods

We strive to limit our processingactivities regarding your Personal Data. Therefore, your Personal Data will beretained only as long as you remain registered for our Services and, ifapplicable, for as long as legal retention requirements demand. If you closeyour account with LOIALE, we will delete all Personal Data we have about you.

2.4.Registration for our Services

To use our Services, you must register.We process the Personal Data mentioned in section 2 of this Privacy Policy toprovide you with our Services. Any additional information is provided by youvoluntarily.

2.5.Data Security

Note that the transmission ofinformation over the Internet is not completely secure. Although we will do ourbest to protect all Personal Data, we cannot guarantee its security whentransmitted through our Services; any transmission is at your own risk.However, once we have received your Personal Data, we will use strictprocedures and security features to prevent unauthorized access.

LOIALE's mobile applications and Websitemay, from time to time, contain links to and from the mobile applications andwebsites of our partner networks, advertisers, and affiliates. These mobileapplications and websites have their own privacy policies, and we do not acceptany responsibility for these policies. Please check the respective PrivacyPolicies before submitting any Personal Data to these websites and mobileapplications.

3. INFORMATIONABOUT HOW THE BUSINESS USES YOUR PERSONAL DATA

3.1.Purpose of Processing

3.1.1. The Business processes the Basic Profile Information, Device Information, Business-Specific Information, and Business-Specific Transaction Information they receive from us to evaluate customer behavior, as well as the frequency of visits and duration of stay. The Processing serves the Business's legitimate interest in analyzing theircustomers to adapt the service accordingly.

3.1.2. The Business uses the Basic Profile Information, Device Information, Business-Specific Information, andBusiness-Specific Transaction Information they receive from us to evaluatetheir customer profiles and provide the best personalized service during eachvisit. The legal basis is the Business's legitimate interest in tailoring its services to your specific needs and thus increasing your satisfaction.

3.1.3. The Business uses the Basic Profile Information, Device Information, Business-Specific Information, andBusiness-Specific Transaction Information to create and provide you with apersonalized loyalty plan through electronic messages offering rewards, specialoffers, gifts, or information that matches your preferences. The Processing isbased on the Business's legitimate interest in increasing customer loyalty.

3.1.4. Additionally, you may receive personalized messages from the Business with opinion surveys and other surveys. When you access the Services through the Wi-Fi Network at the BusinessPremises, you will only receive surveys if you have given your consent before receiving the message. When you subscribe to the Services on the Business's website, they may use your email address provided on the website to send yousurveys without specific consent based on the Business's legitimate interestsin increasing customer satisfaction. You can object to receiving surveys at anytime.

3.1.5. Loiale does not retain or use personal data obtained through Workspace APIs to develop, improve, or train generalized artificial intelligence or machine learning models.

3.2.Disclosure of Personal Data

3.2.1. For the mentioned purposes, it may be necessary for the Business to share your data with providers supportingthem in providing their services. The provider will process your Personal Dataonly on behalf of the Business. The legal basis for data access is Art. 28 GDPRaccording to the corresponding data processing agreement.

3.2.2. When necessary for the mentioned purposes, the Business may share your Personal Data with its AffiliateBusinesses. The legal basis is the Business's legitimate interest in improvingits service at its Affiliate Businesses.

3.2.3. When a data recipient is located outside the European Economic Area, the Business will take the necessarymeasures to ensure that the transfer is carried out in accordance with GDPRrequirements.

3.3.Retention Periods

The Business will retain your PersonalData only as long as necessary for the mentioned purposes. Legal retentionobligations remain unaffected.

4. YOUR RIGHTS

In this section, we have outlinedinformation about your rights regarding the processing of your Personal Data.Depending on the particularities of the case, you may have the right to exercisesome or all of the following rights. You may:

4.1. Request (i) information aboutwhether your Personal Data is retained and (ii) access to and/or (iii) copiesof your retained Personal Data, including the purposes of Processing, thecategories of data in question, and the recipients or categories of recipientsto whom the data is disclosed, and, where possible, the envisaged period forwhich the Personal Data will be stored or, if not possible, the criteria usedto determine that period;

4.2. Receive your Personal Data in astructured, commonly used, and machine-readable format and transmit it toanother controller without hindrance on our part; where technically feasible,you may have the right to have the Personal Data transmitted directly by us toanother controller;

4.3. Request the rectification, erasure,or restriction of Processing of your Personal Data, for example, because it isincomplete or inaccurate, because it is no longer necessary for the purposesfor which it was collected, because the consent on which the Processing wasbased has been withdrawn, or because you have exercised an existing right toobject to the Processing of the data; where Personal Data is processed by thirdparties, the request for rectification, erasure, or restriction of Processing willalso be forwarded to such third parties unless this proves impossible orinvolves disproportionate effort;

4.4. Refuse to provide and, withoutprejudice to data Processing activities that have taken place before suchwithdrawal or any other existing legal justification for the data Processingactivity in question, withdraw your consent to the Processing of your PersonalData at any time;

4.5. Take legal action in relation toany potential breach of your rights regarding the Processing of your PersonalData, as well as lodge complaints with the competent data protectionauthorities; and/or

4.6. Require not to be subject to anyautomated decision-making, including profiling (automated decisions based ondata Processing by automated means, with the aim of evaluating various personalaspects) that produces legal effects on you or similarly significantly affectsyou.

Additionally, you will have the right toobject to the Processing of your Personal Data at any time if your PersonalData is used for direct marketing purposes; and for reasons related to yourparticular situation, if your Personal Data is processed for other purposes.

To exercise your rights, you can emailLOIALE at the address provided at the beginning of this Privacy Policy.

Finally, we inform you that you can filea complaint with the corresponding supervisory authority if you believe thatthe Processing of your Personal Data violates applicable regulations. Contactdetails for all European Union supervisory authorities are available on thepage: EDPBMembers.

Last update: January, 2025.