Privacy Policy for the Digital Loyalty Program

The merchant named below operates the loyalty program and is responsible for ensuring this policy accurately reflects its practices.

Last updated: [Date]
Version: [Version]

This Privacy Policy explains how personal data is collected, used, disclosed and otherwise processed when you join or use the digital loyalty program offered by [Business Name] through the Loya digital loyalty solution.

Who this notice is from. This is primarily the privacy policy of the Business named below, which operates the loyalty program you are joining. Loya is the Business's technology provider: it supplies and operates the platform on the Business's behalf and, only for the limited platform purposes described in §1, acts as an independent controller. For most questions about your data — points, offers, account corrections, marketing choices, and deletion of your loyalty account — the Business is your first and main point of contact.

Meaning of "we", "us" and "our". Where this notice uses "we", "us" or "our", it refers to the Business and/or Loya as applicable to the specific activity described. Where a statement concerns only one of them, this notice says so by naming "the Business" or "Loya".

Scope. This notice applies when you register for the Program, use your Loyalty Card in Apple Wallet or Google Wallet, open web pages linked from your pass (such as the join page or pass information page), or otherwise interact with the Program as an end customer. It does not govern merchants who create a Loya business account or use the merchant dashboard — those users are covered by separate Loya merchant documents.

Voluntary provision. You are not legally required to provide personal data to us. However, if you choose not to provide information requested for registration or operation of the Program, we may not be able to enroll you, issue your Loyalty Card, credit points, send loyalty-related communications, or provide the full Program experience.

Summary of key points

This summary highlights key topics below. See the relevant section for full detail.

Questions? Contact the Business or Loya using the details in §18 before using the Program if you do not agree with this policy.

1. Who Is Responsible for Your Data

The loyalty program is offered commercially by:

Loya provides the digital technology used to create, operate and manage the Loyalty Card, including the digital pass, merchant dashboard, analytics tools and related technical infrastructure.

Depending on the specific processing activity and subject to applicable law:

• The Business generally decides whether to operate the loyalty program, which rewards, benefits or offers to provide, and how Program customer data is used for customer relationship management, loyalty operations, segmentation and, where permitted, marketing. For those activities, the Business is generally the primary party responsible for the relevant processing of personal data.
• Loya generally provides and operates the technical platform, including the standard registration fields and Program data structures, and may process personal data on behalf of the Business in order to provide the Service.
• Loya may also process certain personal data for its own independent purposes where necessary to maintain the security, integrity and reliability of the Service, prevent fraud, abuse or technical misuse, troubleshoot and improve the platform, comply with legal obligations, enforce legal or contractual rights, and produce anonymized or aggregated insights, benchmarks and reports that do not identify you personally or identify a specific business.

Accordingly, the privacy roles of the Business and Loya may differ depending on the relevant processing activity, the applicable law and the contractual arrangements between them.

If you have a question about the Business's use of your data in connection with the loyalty program, you should contact the Business first. If your request specifically relates to the operation of the Loya platform or to processing carried out by Loya, you may also contact Loya using the contact details set out below.

Database controller (Israel). For personal data held about you in connection with the loyalty program operated by the Business, the Business is generally the database controller (ba'al ma'arechet ha'meida) under the Israeli Protection of Privacy Law, 5741-1981, and determines the main purposes of processing your customer relationship data. Loya generally processes such data as a processor (menahel ma'arechet) on the Business's instructions, except for the limited independent processing activities described above.

2. Personal Data We May Collect

Through the Loya registration flow, the features used in the Program, and your interactions with the Loyalty Card, the Business and Loya may collect or generate the following categories of personal data:

2.1 Data you provide during registration or use of the Program

• first name
• last name
• phone number
• email address
• date of birth (optional, if provided)
• gender (optional, if provided)
• marketing consent choice
• acceptance of program terms and privacy notice

2.2 Loyalty program and customer account data

• loyalty program membership ID
• Apple Wallet or Google Wallet pass identifiers and installation-related status
• points, rewards, offers and related loyalty activity
• loyalty status tier, where applicable
• customer labels or engagement indicators calculated from Program activity, where applicable
• spend and visit activity recorded through the Program

2.3 Technical and operational data

• technical data necessary to create, operate, maintain and support the Loyalty Card and related services
• wallet scan or identification links associated with your membership
• system and application logs (including error and request logs used for security, reliability and maintenance)
• marketing consent timestamps and preference updates

2.4 Data collected automatically on Program web pages

When you access the Business's join page, pass information page, or other web interfaces linked from the Loyalty Card, certain technical data may appear in our system and application logs, such as:

• Internet Protocol (IP) address
• browser user-agent
• referring URL
• request timestamps and requested URLs
• security tokens used to authenticate pass-information requests

This information does not always reveal your identity by itself but helps operate, secure and troubleshoot the Service. It is not used for third-party advertising profiles on behalf of unrelated advertisers.

Some data is provided directly by you, some is collected from your interaction with the Loyalty Card and the Program, and some is generated by the technical operation of the Service.

Personal data collected through the Program is limited to what is relevant and reasonably necessary for the operation, administration, personalization, analysis, security or improvement of the loyalty program and related services. Optional fields are indicated at the point of collection.

3. Why We Use Your Data

Your personal data may be used, as applicable, for one or more of the following purposes in connection with the loyalty program, the Loyalty Card and the Loya platform:

3.1 Operation and administration of the Program

• creating, issuing, delivering and managing your Loyalty Card
• registering you as a member of the Program and maintaining your customer record
• identifying you within the Program
• tracking visits, loyalty activity, points, rewards, benefits and status tiers
• allowing the Business to add, update or deduct points, benefits or rewards
• managing reward eligibility, redemptions and related customer service activities
• maintaining records of your participation in the Program

3.2 Customer communications

• sending functional and service messages about the Program and your Loyalty Card
• sending promotional or marketing communications, where required consent has been obtained under applicable law

3.3 Analytics and personalization

• analyzing Program activity to operate and improve the loyalty experience
• providing analytics and operational insights to the Business
• personalizing offers or communications where permitted by applicable law

3.4 Service operation, security and compliance

• operating, maintaining, troubleshooting and supporting the Service and related technical systems
• detecting, preventing and investigating fraud, duplicate accounts, abuse, misuse, technical errors or security incidents
• maintaining the security, integrity, availability and reliability of the Service
• enforcing applicable terms, policies and legal rights
• complying with legal obligations and requests from competent authorities

3.5 Loya platform improvement

• improving the Loya platform and related tools
• generating aggregated or anonymized insights that do not identify you personally and do not identify a specific business

Personal data will be used only for purposes that are described in this Privacy Policy, are connected to the operation of the Program or the Service, or are otherwise permitted or required by applicable law.

Where required by applicable law, certain activities, including promotional communications or the collection and use of specific profile data, will be carried out on the basis of your consent or another valid legal basis.

4. Segmentation and Profiling

The Program may assign customer labels or engagement indicators based on your Program activity (for example visits, spend or points). The Business may use these for loyalty operations and, where permitted, offer targeting. They are operational tools only and are not intended to produce legal or similarly significant effects about you. Questions about this use should usually go to the Business first.

Where required by applicable law, you may have the right to obtain information about such processing and to object to or request review of certain automated processing activities.

5. Date of Birth and Gender

Date of birth and gender may be provided on an optional basis during the Loya registration flow. They are not required to join or use the Program.

When provided, they may be used by the Business for Program analytics and personalization, where permitted by applicable law. Optional fields are indicated at the point of collection.

Where required by applicable law, these data fields will be collected and used on the basis of your consent or another valid lawful basis.

6. Communications and location

We may send functional messages needed to operate the Program and your Loyalty Card (for example points, rewards or service updates). These may continue even if you opt out of promotional communications, to the extent permitted by law.

Promotional messages (offers, campaigns and similar commercial content) are sent only where required consent has been obtained or another lawful basis applies under applicable law, including Israeli rules on direct marketing. You may withdraw consent or opt out at any time via the pass information page (where available), an unsubscribe mechanism, or by contacting the Business or Loya. Opting out of promotional notifications does not remove the Loyalty Card; offers may still appear on the pass itself.

Where available, the Program may use location or proximity features through your wallet or device (subject to your device settings and platform rules). Promotional proximity messages require marketing consent. Loya and the Business do not continuously track your real-time location independently of your device or the wallet platform.

Consent and opt-out records may be kept as needed to demonstrate compliance.

Where Google APIs are used in connection with the Program, use of information received from those APIs will adhere to the Google API Services User Data Policy, including Limited Use requirements where applicable.

7. Cookies and Similar Technologies

When you use Program web pages, we may use cookies, local storage or similar technologies that are strictly necessary to operate the page securely (for example session security, preferences during a visit, or access authentication).

We do not currently use advertising cookies or third-party marketing analytics on these pages. If that changes, this Privacy Policy will be updated and, where required by law, consent will be requested before non-essential cookies are used.

You can control cookies in your browser settings. Blocking strictly necessary cookies may prevent some features from working.

8. Do Not Track

Some browsers offer a "Do Not Track" (DNT) signal. There is currently no uniform industry standard for responding to DNT signals. Program web pages do not respond to DNT signals in a standardized way. If a recognized standard is adopted and we are required to follow it, we will update this Privacy Policy accordingly.

9. Who May Access or Receive Your Data

Your personal data may be accessed or disclosed, on a need-to-know basis, by:

• the Business and its authorized staff for Program operations and customer service
• Loya and its authorized personnel to provide, operate, support and secure the Service
• service providers engaged by Loya or the Business (for example cloud hosting, databases, authentication, wallet/pass technology, mapping or support)
• Apple, Google and other wallet or platform providers, to the extent used for the Loyalty Card
• professional advisers where reasonably necessary
• authorities where required by law
• successors in a merger, acquisition or similar transaction, subject to applicable law

Not every category receives your data in every case. A current list of key infrastructure providers can be provided on request.

10. Apple Wallet, Google Wallet and Third-Party Platforms

The Loyalty Card may be delivered through Apple Wallet, Google Wallet or similar third-party platforms.

Those platforms may process certain technical or pass-related data under their own terms and privacy policies, independently of the Business and Loya. Loya and the Business do not control those platforms and are not responsible for their practices.

Program pages may also contain links to the Business's website or other third-party sites. Those sites are not controlled by Loya and have their own privacy policies.

11. International Data Transfers

Personal data processed in connection with the Program or the Service may be stored, accessed, transferred or otherwise processed outside Israel, including by cloud providers, infrastructure providers, communications providers, analytics providers, support providers and other service providers used to operate, secure, maintain or improve the Service.

Where personal data is transferred or made accessible outside Israel, the Business and Loya will seek to ensure that the transfer is carried out in accordance with applicable Israeli legal requirements and subject to appropriate measures, safeguards and contractual protections, as required under the circumstances.

You acknowledge that some countries outside Israel may provide a level of privacy or data protection that differs from the level of protection available under Israeli law. Nevertheless, the Business and Loya will take reasonable steps, as applicable, to protect personal data in connection with such transfers and processing activities.

12. Data Retention

Personal data is retained only for as long as reasonably necessary for the purposes described in this Privacy Policy and as required by applicable law.

When identifiable personal data is no longer reasonably needed for those purposes, the Business and Loya will seek to delete, anonymize or de-identify it within a reasonable period, subject to legal requirements, technical limitations, backup processes, evidentiary needs and lawful recordkeeping obligations.

Certain categories of data may be retained for longer limited periods where reasonably necessary, including:

• transaction, redemption, consent or communication records
• system and application logs and operational audit trails
• backup or archived data retained as part of business continuity and disaster recovery processes
• records needed to comply with legal, tax, accounting, regulatory or evidentiary requirements

Loya may retain aggregated or anonymized data for a longer period, including indefinitely, provided that such data does not identify you personally and does not identify a specific business.

13. Aggregated and Anonymized Data

Loya may create and use aggregated, statistical, de-identified or anonymized data from Program and Service information, provided it does not identify you personally and does not identify a specific business.

Such data may be used to improve the Service and for analytics.

Loya does not sell personally identifiable customer data to third parties.

14. Data Security

The Business and Loya will take reasonable organizational, technical and physical measures designed to protect personal data against unauthorized or unlawful access, use, disclosure, alteration, loss, misuse or destruction, taking into account the nature of the data, the scope of the processing, the sensitivity of the information, the applicable legal requirements and the risks involved in operating the Program and the Service.

Despite these efforts, no system, network, platform, transmission method or method of electronic storage can guarantee absolute security. Accordingly, while the Business and Loya seek to protect personal data using reasonable safeguards, they cannot guarantee that personal data will always remain completely secure in all circumstances.

15. Your Rights

Subject to applicable law, including applicable Israeli privacy law, you may have the right to request access to personal data relating to you that is held in a relevant database, and to request that certain information be corrected or deleted where it is inaccurate, incomplete, misleading, outdated, unlawfully processed, or otherwise requires amendment under applicable law.

Depending on the circumstances and the applicable legal framework, you may also have the right to:

• request information about the types of personal data processed about you and the purposes for which it is used
• request correction, update or completion of certain personal data
• request deletion of certain personal data, where deletion is required or permitted by applicable law
• withdraw consent to promotional communications or opt out of such communications at any time
• object to certain uses of your personal data or request limitations on certain processing activities, to the extent such rights apply under applicable law

To exercise your rights, please contact the Business or Loya using the contact details set out below. In general, requests relating to your participation in the loyalty program, points, rewards, offers or customer profile should first be directed to the Business. Requests specifically relating to the operation of the Loya platform or processing carried out independently by Loya may also be directed to Loya.

Any request may be subject to identity verification, reasonable administrative procedures, technical feasibility, legal limitations, protection of the rights of others, database management requirements, and applicable retention, security, fraud-prevention, evidentiary or compliance obligations.

Review, update or delete your data. You may request to review, update or delete personal data we hold about you by contacting the Business or Loya as set out in §18. We will respond in accordance with applicable data protection laws, including the Israeli Protection of Privacy Law. Deleting your loyalty account or removing your pass from your wallet may not immediately delete all historical records where retention is required for legal, fraud-prevention or accounting purposes.

16. Children and Minors

The Program is intended for persons who are legally permitted to join under applicable law.

The Business decides whether minors may join and is responsible for complying with any applicable rules on age, parental or guardian consent, and marketing to minors.

17. Changes to This Privacy Policy

This Privacy Policy may be updated from time to time to reflect changes in the loyalty program, the Service, applicable law, regulatory guidance, technical infrastructure, security practices or the way personal data is processed.

The most current version of this Privacy Policy will be made available through the Loyalty Card, registration page, Business communication channels, or other reasonable means.

If material changes are made to this Privacy Policy, the Business and/or Loya may provide additional notice by appropriate means, taking into account the nature of the change, the communication channels available, and applicable legal requirements.

Non-material clarifications, corrections or formatting updates may be published without separate notice beyond making the updated document available as described above.

You can identify the version of this Privacy Policy you accepted using the version identifier shown on the pass information page.

Unless otherwise stated, the updated version will become effective from the date indicated at the top of the document and will apply from that date onward.

18. Contact Details

For questions about the loyalty program, membership, points, rewards, offers, marketing preferences or the Business's use of your data:

For privacy, security or technical requests relating specifically to the operation of the Loya platform:

In general, if your request relates primarily to your customer relationship with the Business or your participation in the loyalty program, you should contact the Business first. If your request relates specifically to Loya's platform operations or Loya's independent processing activities, you may also contact Loya directly.