Your customers trust you with their details, and we take looking after them seriously. Loyaltify is GDPR compliant, and this guide explains how your customers' data is handled, who is responsible for what, and how to deal with requests from your customers.
💡 Good to know: All our legal documents, including the Data Processing Agreement, are in one place in our Legal Hub.
Who is responsible for what
You are the data controller for your customers' data. You decide what your sign-up form collects and how you use it.
Loyaltify OÜ is the data processor. We process your customers' data only on your instructions and only to provide the service.
For your own account details, such as your name and billing information, Loyaltify is the controller. Our Privacy Policy explains how we handle them.
Our Data Processing Agreement
Our Data Processing Agreement (DPA) forms part of your agreement with Loyaltify and applies whenever we process personal data for you. There's nothing you need to sign: the online version is the binding one.
Read it online: Data Processing Agreement
Need a signed copy for your records? Download the signed DPA (PDF).
The DPA covers:
Purpose: providing loyalty and customer engagement services
Whose data: your end customers
What data: identifiers, contact details, transaction and loyalty activity, and communications metadata
Where the data is stored
Your customers' data is primarily stored and processed within the European Union, on Amazon Web Services (AWS) in Frankfurt, Germany. If any data is ever processed outside the EU or EEA, we use the safeguards the GDPR requires, such as Standard Contractual Clauses or adequacy decisions.
Who helps us run the service
These sub-processors help us run the service, and they only process data for that purpose:
AWS (Frankfurt, EU): hosting and data storage
Stripe: payment processing
SendGrid: transactional emails
Intercom: customer support
How we protect it
We use technical and organisational security measures in line with Article 32 of the GDPR, and everyone who handles personal data at Loyaltify is bound by confidentiality.
Integrations you connect
When you connect another service, such as Mailchimp or Brevo, Loyaltify sends your customers' data to it based on how you've set it up. That service handles the data under its own terms and privacy policy, and you're responsible for making sure your use of it complies with data protection law and that your customers are told about it. See Integrations overview.
Marketing consent
Your sign-up form includes a marketing consent box, and only customers who tick it receive your marketing messages. Accepting your Terms of Service isn't the same as agreeing to marketing. You can edit the consent wording to explain what customers will get. See Sign-up Forms.
⚠️ The consent box helps you collect consent, but it doesn't make your marketing compliant on its own. You're responsible for your wording and for how you use your customers' data. Loyaltify can't give legal advice, so check with your own adviser if you're unsure.
Handling your customers' requests
As the controller, you respond to your customers when they ask about their data. Here's how to handle the most common requests:
See their data: open the customer's profile, or export your customers and transactions. See How to export your customer and transaction data.
Correct their details: use Edit Customer on the Customers tab.
Delete their data: click the bin icon on the customer's row on the Customers tab. Deleting a customer is permanent. See How to manage your customers.
Need to delete many customers at once? Contact us through live chat and we'll help. We support you with your customers' requests wherever it's technically possible.
Deleting your account and data
Cancelling your subscription doesn't delete your data, so everything is still there if you come back. See Plans and billing.
To delete your account and all its data:
The account Owner deletes the store under Store Settings → Delete Store.
Contact us through live chat and ask us to delete your account.
We'll confirm once it's done. Deletion can take up to 48 hours. Running several stores? Delete each one. See How to run several locations or brands.
Our legal documents
Need a hand?
We're here to help!
For questions about the DPA or data protection, email our data protection team at [email protected].
For anything else, reach out to us via live chat inside Loyaltify, or use the chat button at the bottom right of this page. Our team will be happy to help.