Last updated: August 2026
4Rewards is committed to protecting your personal data. This policy explains what data we collect, how we use it, and what your rights are under the General Data Protection Regulation (GDPR).
The data controller is:
4Rewards (legal entity: 4MAT PC MON. IKE)
Tax ID (ΑΦΜ): 801810997 — Tax Office (Δ.Ο.Υ.): Corfu — Reg. No. (Γ.Ε.ΜΗ.): 163785633000
Alykes Potamou, Corfu 49100, Greece
Email: privacy@4rewards.app
Phone: +30 2104400002
4Rewards acts in a dual role depending on the type of data:
| Data | Purpose | Legal Basis |
|---|---|---|
| First and Last Name | Identification and personalization | Contract performance |
| Phone number | Login and communication | Contract performance |
| Password | Account security (stored encrypted) | Contract performance |
| Date of birth (optional) | Special birthday offers | Consent |
Important: The application collects location data (GPS) for:
Location is updated periodically (every 30 minutes) when the application is active. You can disable location services from your device settings.
| Data | Purpose |
|---|---|
| FCM Token (Firebase) | Sending push notifications |
| Device type and OS | Technical support and optimization |
If you have enabled Analytics in your Privacy Settings, we record when a business appears in search/map results (impression) and when you visit its page (click), so the business can see engagement statistics for its store. Each business sees exclusively its own statistics, never cross-referenced with other businesses. If you disable Analytics, this tracking stops immediately.
Through a participating business's public "Add to Wallet" page, you can create an account without installing the app, by providing your phone number (and optionally your name) and verifying it with an SMS code — the same process as regular registration. If you add a card to Apple Wallet or Google Wallet, the card includes: the business's name, logo, and colors, your current points/stamps balance, the reward description, and your phone number in QR code form (for scanning in-store).
Apple Wallet / Google Wallet difference: For Google Wallet, the above data is sent to and stored on Google's servers via the Google Wallet API, so the card can function and update (see Section 6.1, Sub-Processors). For Apple Wallet, the card file is generated by our own servers and stored on your device — the card's data (phone number, balance, branding) is never sent to Apple. Apple acts as a sub-processor only for relaying an anonymous device notification token, so you receive a notification when your card updates (see Section 6.1, Sub-Processors) — not for your personal data. If you have iCloud enabled, Apple additionally syncs the card between your own devices via your account — which is governed by Apple's own privacy policy, not ours.
We use your information to provide the rewards program service and to ensure the smooth operation of related application features, including for:
With your explicit consent, your contact details are also used to send promotional offers (see Section 5.2). We do not use your data for any processing other than the purposes listed above.
We use Firebase Cloud Messaging to send push notifications. Notifications are divided into two categories:
These notifications are necessary for the operation of the loyalty program and are sent without requiring separate consent:
Legal basis: Contract performance (Article 6(1)(b) GDPR)
These notifications are sent only if you have enabled marketing notifications in your privacy settings:
Legal basis: Consent (Article 6(1)(a) GDPR)
Your control: You can enable or disable marketing notifications at any time from the Privacy Settings in your profile. Disabling marketing notifications does not affect transactional notifications.
Your data may be transferred to:
We do not sell your data to third parties for advertising purposes.
We use the following sub-processors to provide the service:
| Sub-Processor | Purpose | Location |
|---|---|---|
| Firebase Cloud Messaging (Google Ireland Ltd.) | Push notifications | EU / USA |
| Amazon Web Services (S3) | Image/file storage | Frankfurt, Germany (eu-central-1) |
| EasySMS.gr | SMS gateway (phone verification) | Greece |
| Email service (SMTP) | Sending email notifications | Germany |
| Google Wallet API (Google Ireland Ltd. / Google LLC) | Storage and operation of digital loyalty cards (only if you add a card to Google Wallet) | EU / USA |
| Apple Push Notification service — APNs (Apple Inc.) | Sending anonymous card-update notifications (only if you add a card to Apple Wallet) — not your phone number, balance, or card details | EU / USA |
We will notify you of any material change to our sub-processors. Detailed information is available upon request at privacy@4rewards.app.
In the event of a merger, acquisition, sale of assets, or other corporate restructuring of 4Rewards, your data may be transferred to the successor entity as part of the transaction. The successor entity will be bound by this Privacy Policy, unless we notify you in advance of a material change, in accordance with Section 13 (Policy Changes).
We implement technical and organizational measures to protect your data:
If we become aware of a personal data breach that is likely to pose a risk to your rights or freedoms, 4Rewards:
We retain your data:
If a partner business does not renew its subscription, its profile is deactivated (e.g. no longer shown in Discover) but your transaction data with that business is not deleted — it remains available in your history, so you don't lose points/stamps if the business reconnects. Only if the business itself permanently deletes its account (see Section 10) is the related transaction data permanently deleted.
You have the following rights:
You can request an immediate export of your data directly within the application, without needing to send an email request:
You have the right to delete your account at any time directly through the application. To delete your account:
Please note that some data may be retained for legal compliance purposes as described in Section 9 (Data Retention).
From Privacy Settings you can manage your consent separately at any time for the Terms of Service, marketing notifications, and Analytics (Discover tracking), and withdraw any one of them without affecting the others.
For rectification or restriction of processing rights not covered above, contact us at privacy@4rewards.app.
The application uses local storage for:
We do not use third-party cookies for tracking or advertising.
The application is not intended for children under 18 years of age. We do not knowingly collect data from minors. If we discover such data, we will delete it immediately.
We may update this policy periodically. For non-material changes, the updated policy takes effect immediately upon posting. For material changes (e.g. a new category of processing, a new sub-processor affecting your rights, or a change to the legal bases for processing), we will notify you via email or push notification at least fifteen (15) days before they take effect. Continued use of the application after the notification constitutes acceptance of the changes.
If you believe your rights are being violated, you can file a complaint with:
Hellenic Data Protection Authority
Website: www.dpa.gr
For questions regarding data protection:
Email: privacy@4rewards.app
Phone: +30 2104400002