Privacy Policy

1. Introduction

4Loyalty Merchant App is committed to protecting your personal data. This policy explains what data we collect, how we use it, and what your rights are under the General Data Protection Regulation (GDPR).

2. Data Controller

The data controller is:

4Loyalty (legal entity: 4MAT PC MON. IKE)
Tax ID (ΑΦΜ): 801810997 — Tax Office (Δ.Ο.Υ.): Corfu — Reg. No. (Γ.Ε.ΜΗ.): 163785633000
Alykes Potamou, Corfu 49100, Greece
Email: privacy@4rewards.app
Phone: +30 2104400002

2.1 Dual Role: Controller & Processor

4Loyalty acts in a dual role depending on the type of data:

• As Data Controller for your own business account data (business name, email, business details, settings).
• As Data Processor on your behalf for your customers' data collected through the loyalty program — see Section 11 (Your Customer Data) for details.

3. Data We Collect

3.1 Registration Data

Data	Purpose	Legal Basis
Business name	Identification and display to customers	Contract performance
Email	Login, communication, notifications	Contract performance
Password	Account security (stored encrypted)	Contract performance

3.2 Business Data

Data	Purpose
Logo and images	Display in customer application
Address/Location	Display on map for customers
Loyalty program settings	Operation of your program

3.3 Billing Information

To issue invoices for your subscription, we additionally collect:

Data	Purpose
Tax identification number (ΑΦΜ or equivalent international ID)	Issuing invoices
Legal name	Issuing invoices (may differ from your public trading name)
Billing address	Issuing invoices
Business activity (optional)	Displayed on the invoice

3.4 Usage Data

• Transaction history (QR scans, redemptions)
• Application usage statistics
• Technical data (device type, OS version)

4. How We Use Data

• Service provision: For the operation of the application and your loyalty program
• Communication: For sending important updates and support
• Improvement: For improving the application and our services
• Reports: For creating statistics and reports for you
• Security: For protection against fraud and misuse

5. Data Transfer

Your data may be transferred to:

• Cloud service providers: For data storage (with appropriate contractual guarantees)
• Payment providers: For subscription processing

We do not sell or share your data with third parties for advertising purposes.

5.1 Sub-Processors

We use the following sub-processors to provide the service:

Sub-Processor	Purpose	Location
Firebase Cloud Messaging (Google Ireland Ltd.)	Push notifications	EU / USA
Amazon Web Services (S3)	Image/file storage (logo, photos)	Frankfurt, Germany (eu-central-1)
EasySMS.gr	SMS gateway	Greece
Email service (SMTP)	Sending email notifications	Germany
Google Wallet API (Google Ireland Ltd. / Google LLC)	Storage and operation of digital loyalty cards (only for your customers who add a card to Google Wallet)	EU / USA
Apple Push Notification service — APNs (Apple Inc.)	Sending anonymous card-update notifications (only for your customers who add a card to Apple Wallet) — not their phone number, balance, or card details	EU / USA

We will notify you of any material change to our sub-processors. Detailed information is available upon request at privacy@4rewards.app.

5.2 Business Transfer / Corporate Restructuring

In the event of a merger, acquisition, sale of assets, or other corporate restructuring of 4Loyalty, your data may be transferred to the successor entity as part of the transaction. The successor entity will be bound by this Privacy Policy, unless we notify you in advance of a material change, in accordance with Section 12 (Policy Changes).

6. Data Security

We implement technical and organizational measures to protect your data:

• Data encryption during transmission (HTTPS/TLS)
• Secure password storage (hashing)
• Sensitive data stored in Secure Storage
• Restricted access to data

7. Data Breach Notification

If we become aware of a personal data breach that is likely to pose a risk to your rights or freedoms (or those of your customers, where the breach concerns them), 4Loyalty:

• Notifies the competent supervisory authority (Data Protection Authority) within 72 hours of becoming aware of it, as required by the GDPR
• Notifies you without undue delay, if the breach is likely to result in a high risk
• Provides information about the nature of the breach, its likely consequences, and the measures taken or proposed

8. Data Retention

We retain your data:

• Account data: As long as your account is active
• Transaction data: For 5 years for accounting/tax purposes
• Technical data / log files: Up to one (1) year, for security purposes
• After account deletion: Deletion within 30 days, except for legal obligations

8.1 Data of Businesses That Discontinue the Partnership

If your subscription expires without renewal, your account is marked as inactive (and your business profile is no longer shown in consumer apps) but your data is not deleted — it remains stored so you can reactivate your account by renewing your subscription, without losing history, campaigns, or loyalty program settings. Only voluntary account deletion (see Section 9.2) permanently deletes all related data (program settings, campaigns, subscriptions, transactions), retaining only an encrypted (SHA-256 hash) audit record for compliance purposes, without your actual email address.

9. Your Rights (GDPR)

• Access: To receive a copy of your data
• Rectification: To correct inaccurate data
• Erasure: To delete your account directly through the app (see below)
• Restriction: To restrict processing
• Portability: To receive your data in a transferable format (directly through the app, see below)
• Objection: To object to processing

9.1 Data Export (Portability)

You can request an immediate export of your data directly within the application, without needing to send an email request:

• Go to Settings → Privacy Settings
• Under "Data Management", select "Export Data"

9.2 Account Deletion

You have the right to delete your account at any time directly through the application. To delete your account:

• Go to Settings → Privacy Settings
• Under "Data Management", select "Delete Account"
• Enter your password to confirm
• Your account and all associated data will be permanently deleted

Please note that some data may be retained for legal compliance purposes as described in Section 8 (Data Retention).

9.3 Consent Management

From Privacy Settings you can manage your consent separately at any time for the Terms of Service, marketing notifications, and Analytics, and withdraw any one of them without affecting the others.

For rectification or restriction of processing rights not covered above, contact us at privacy@4rewards.app.

10. Cookies and Tracking Technologies

The application uses local storage (GetStorage) for:

• Storing language preferences
• Maintaining login state

We do not use third-party cookies for tracking or advertising.

11. Your Customer Data

• Automatic enforcement of marketing consent: Every campaign you send (manual, scheduled, recurring, or birthday) automatically applies the marketing consent each customer has already set in the 4Rewards app; it is not technically possible to send a marketing notification to a customer who has disabled that consent, regardless of the targeting filters you select.
• Access limited to your own data: You see exclusively the statistics and transaction data of your own customers, never cross-referenced with other businesses.
• Store network (loyalty pool): If you enroll your business in a shared network with other stores you own, loyalty program settings are shared across the network's members; the data for each individual transaction remains recorded at the physical store where it took place.
• Digital Wallet Cards (Apple/Google Wallet): If one of your customers adds your loyalty card to Google Wallet, their phone number (as a QR code), their points/stamps balance, and your business's branding (name, logo, colors) are sent to the Google Wallet API for the card to function (see Section 5.1, Sub-Processors). Apple Wallet does not send the card's data (phone number, balance, branding) to Apple — the card is generated by our own servers and stored on your customer's device; Apple acts as a sub-processor only for relaying anonymous update notifications (see Section 5.1, Sub-Processors).

12. Policy Changes

We may update this policy periodically. For non-material changes, the updated policy takes effect immediately upon posting. For material changes (e.g. a new category of processing, a new sub-processor affecting your rights, or a change to the legal bases for processing), we will notify you via email or in-app notice at least fifteen (15) days before they take effect.

13. Complaints

If you believe your rights are being violated, you can file a complaint with:

Hellenic Data Protection Authority
Website: www.dpa.gr