Loopy Loyalty is a loyalty product operated by PassKit (together, "Loopy Loyalty", "PassKit", "we", "us" or "our").

We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains what we do with your information when you use our websites, products and services.

1. Privacy in Plain English

This is the short version. For full legal details, please read sections 2–14 below.

• Who we are: Loopy Loyalty is a PassKit brand. PassKit runs the Loopy Loyalty platform and is responsible for your personal data when you use our website and platform (except where we act only as a processor for our customers).

• What we collect: things like your name, email, company details, account details and how you use our sites and apps, plus technical data like IP address and browser/device info.

• How we use it: to provide and improve the Loopy Loyalty platform, manage your account and billing, respond to you, secure our systems and comply with the law.

• Cookies: we use cookies and similar technologies (managed via CookieYes) to make the site work, understand usage and, where you consent, for analytics and marketing.

• Who we share with: trusted providers (hosting, analytics, payment, support, marketing), PassKit affiliates, and, where relevant, event or content partners, plus authorities when required by law.

• Where it goes: we may process data in the EEA, UK, US, Hong Kong, Thailand and other places where we or our service providers operate, with appropriate safeguards where required.

• How long we keep it: only as long as needed for the purposes described here and to meet legal requirements, then we delete or anonymise it.

• Your rights: depending on where you live (for example in the EEA/UK or certain US states), you may have rights to access, correct, delete or move your data, object to some uses and opt out of marketing and certain cookies.

• End customers of merchants: if you use a loyalty pass issued by a merchant, they are responsible for your data and you should contact them directly. We process that data on their behalf.

2. Who we are and when this Privacy Policy applies

Loopy Loyalty is a loyalty product and brand operated by PassKit. When we refer to “Loopy Loyalty” or “PassKit” in this Privacy Policy, we mean the PassKit group company or companies that determine how and why your personal data is processed in connection with Loopy Loyalty.

This Privacy Policy applies when you interact with:

• websites that link to this Privacy Policy (including https://loopyloyalty.com and https://app.loopyloyalty.com);

• our demo stamp cards, the Loopy Loyalty Stamper app and other software that link to this Privacy Policy;

• our branded social media pages;

• our offices, if you visit in person;

• our communications with you (emails, calls, messages);

• our events or webinars;

• job applications you submit to us; and

• registration and use of the Loopy Loyalty platform as an authorised user (for example, as an employee of one of our customers).

In these situations, we usually act as a data controller (under GDPR/UK GDPR and similar laws).

2.1. When we act as a data processor/service provider

Our business customers use the Loopy Loyalty platform to run their own loyalty programmes and digital passes. In doing so, they may upload or collect personal data about their own customers ("Customer Data").

For Customer Data, PassKit/Loopy Loyalty acts as a data processor (or “service provider”) on behalf of our customers. Our obligations and data protection commitments in that role are governed by our contract with the relevant customer (for example, our Terms and Conditions or other services agreement), not this Privacy Policy.

If you are an end-user of one of our customers and wish to exercise your privacy rights, please contact the relevant merchant or organisation directly. We will support our customer in responding as required.

2.2. Third-party websites and services

Our Services may link to third-party websites or services. We do not control these third parties and are not responsible for their privacy practices. We encourage you to review their privacy policies before providing any personal data to them.

3. Personal Information we collect

The information we collect depends on how you interact with us.

3.1. Information you provide directly

Site usage, forms and content downloads. When you visit our Sites, request a demo, sign up for updates, download content or otherwise interact with forms, we may collect:

• name and contact details (for example, email address, phone number);

• job title and role;

• company name, industry and address;

• country; and

• your preferences and how you engage with Loopy Loyalty content.

Events, meetings and webinars. If you register for or attend an event, meeting or webinar (in person or online), we may collect:

• name, email address and other contact details;

• job title and employer;

• event registration details and attendance;

• information from badge scans at in-person events (where we ask for your consent);

• audio and/or video recordings if the event or meeting is recorded and you participate.

Communications and support. When you contact us (for example, sales, support, job applications, social media or general enquiries), we may collect:

• name and contact details;

• job title and company;

• marketing subscription status and communication preferences;

• the content of your communications and any follow-up.

Account information (Loopy Loyalty platform). When you create or use an account on the Loopy Loyalty platform, we may collect:

• name and email address;

• company name, industry and website;

• login credentials and account settings;

• IP address and related technical and usage data about your access.

Surveys and feedback. If you participate in a survey or provide feedback, we may collect:

• name and contact details;

• job title and employer;

• your responses, opinions and preferences.

Social media and community content. Any content you post on our blogs, forums or social media pages may be publicly visible. Please do not share information you would prefer to keep private.

Office visits. If you visit our offices, we may record:

• your name and contact information;

• company name; and

• time and date of arrival.

3.2. Information we receive from other sources

We may also collect information about you from:

• publicly available sources (for example, company sites, social media, public databases);

• marketing partners and lead generation providers; and

• business partners (for example, joint events or webinars).

We require such third parties to confirm that they have the right to share this information with us.

Billing and payments. If you are a business contact for one of our customers, our billing and payment providers (such as Stripe, Inc.) may share limited billing-related information with us, such as:

• name and contact details;

• company name and billing address; and

• payment reference data (for example, tokenised card information or last four digits).

Stripe’s own terms and privacy notices apply to your payment method and transaction processing.

4. How and why we use Personal Information

We use your Personal Information for the purposes and on the legal bases below (under GDPR/UK GDPR, where applicable).

4.1. Providing and administering the Services

We use your information to:

• provide, operate and support the Loopy Loyalty platform and related services;

• process orders, renewals and payments;

• set up and administer user accounts;

• provide customer and technical support;

• respond to your requests and communications;

• allow you to register for and participate in events and webinars; and

• manage our relationship with you and your organisation.

Legal bases: performance of a contract or taking steps prior to entering into a contract; our legitimate interests in operating our business and providing Services.

4.2. Service operation, maintenance and security

We use your information to:

• monitor and improve the performance and reliability of our Services;

• troubleshoot issues and provide quality assurance;

• prevent unauthorised access and maintain security; and

• detect and prevent fraud, misuse or other harmful activity.

Legal bases: our legitimate interests in securing and maintaining our Services; compliance with legal obligations.

4.3. Marketing and communications

We may use Personal Information to:

• send you information about Loopy Loyalty and PassKit products, features, content and events;

• personalise and optimise our marketing communications; and

• measure the effectiveness of campaigns and interactions.

We will only send electronic marketing where permitted by law and, where required, with your consent. You can withdraw consent or opt out at any time.

Legal bases: your consent (where required); our legitimate interests in promoting our products and services.

4.4. Research, analytics and product development

We may use data (including aggregated or de-identified data) to:

• analyse how our Services are used;

• generate insights, industry or trend reports in anonymised form; and

• develop and improve our products, features and content.

Once data is anonymised so that it can no longer identify you, it is no longer personal data and we may use it for any lawful purpose.

Legal bases: our legitimate interests in improving and developing our Services; your consent where we rely on optional analytics/tracking technologies.

4.5. Community and public content

If you choose to post reviews, comments or other content on our Sites or social media, we may publish and share that content in line with your settings and the platform’s terms.

Legal bases: your consent when you choose to publish content; our legitimate interests in engaging with our user community.

4.6. Legal and compliance

We may use and share information as needed to:

• comply with legal and regulatory obligations;

• respond to lawful requests and legal processes;

• enforce our contracts and policies; and

• protect our rights, property and safety, or those of others.

Legal bases: compliance with legal obligations; our legitimate interests in protecting our business and enforcing our rights.

5. Cookies, tracking technologies and usage data (CookieYes)

We use cookies and similar technologies to help our Sites and apps work properly, to understand how they are used and, where you consent, to support analytics and marketing.

5.1. What we collect automatically

As you use our Sites and Services, we and our partners may automatically collect:

• IP address and approximate location;

• device identifiers, browser type and settings, operating system;

• pages viewed, links clicked, time spent, referring URLs;

• interactions with our emails and marketing content; and

• device and app information (including manufacturer, model, app version, activation and update events).

5.2. Types of cookies we use

We use:

• Essential cookies – required for the website and platform to function (for example, security, login sessions, basic features, live chat).

• Functional / performance cookies – help us understand usage and performance, so we can improve our Sites and Services and provide more relevant communications.

• Targeting / advertising cookies – used by us and our partners to build a profile of your interests and show relevant ads on our Sites and on other websites.

We may also use SDKs and similar technologies in our apps, and tools such as Google Analytics and Microsoft Clarity to better understand website usage.

5.3. CookieYes consent and your choices

We use CookieYes as our consent management platform to present our cookie banner and allow you to control non-essential cookies.

You can:

• set or change your cookie preferences via the “Cookie Settings” link (powered by CookieYes) on our Sites;

• adjust your browser or device settings to block or delete cookies; and

• use opt-out tools offered by specific analytics or advertising providers.

Where required by law, we will not place non-essential cookies or similar technologies unless and until you have consented through CookieYes or similar tools. Blocking certain cookies may affect some features or functionalities of the Services.

5.4. Do Not Track

Some browsers offer a “Do Not Track” (DNT) signal. Our Sites do not currently respond to DNT signals.

6. How we share Personal Information

We share Personal Information only when necessary for the purposes described in this Privacy Policy.

6.1. Service providers

We use third-party service providers to help us operate and support our business and Services, including:

• hosting, infrastructure, backup and storage;

• analytics and measurement;

• email, CRM and communication tools;

• payment processing and billing;

• customer support and helpdesk tools; and

• marketing and advertising platforms.

These providers are contractually required to use Personal Information only as instructed by us, to keep it secure and not to use it for their own unrelated purposes.

6.2. Business partners

From time to time we may collaborate with other companies to offer joint products, services, webinars or events. If you register for or express interest in such a joint offering, we may share your Personal Information with the relevant partner. Their use of your Personal Information is governed by their own privacy policy.

6.3. Affiliates

We may share information with other companies within the PassKit group, for example for internal administration, support and to provide the Services.

6.4. Legal and protection purposes

We may disclose Personal Information when we reasonably believe it is necessary to:

• comply with laws, regulations, court orders or other legal processes;

• respond to lawful requests from public authorities (including for national security or law enforcement purposes);

• enforce our terms, agreements or policies;

• investigate and prevent suspected fraudulent or illegal activity; or

• protect the rights, property and safety of Loopy Loyalty, PassKit, our customers or others.

6.5. Business transfers

In the event of a proposed or actual merger, acquisition, financing, reorganisation, sale of assets, insolvency or similar transaction involving Loopy Loyalty/PassKit, Personal Information may be transferred to one or more third parties as part of that transaction, subject to appropriate protections.

7. International data transfers

We may process and store Personal Information in the European Economic Area (EEA), United Kingdom, United States, Hong Kong SAR, Thailand and in other countries where we or our service providers operate.

Some of these countries may not offer the same level of data protection as your home country. Where required by law, we implement appropriate safeguards, such as:

• Standard Contractual Clauses approved by the European Commission;

• adequacy decisions; or

• your explicit consent for certain transfers.

For more information about these safeguards, you can contact us at privacy@loopyloyalty.com.

8. Security

We use appropriate technical, administrative and physical safeguards designed to protect Personal Information against unauthorised access, use, disclosure, alteration or destruction.

No system is completely secure. You are responsible for keeping your account credentials and passwords confidential. If you believe your account or data is no longer secure, please contact us immediately at privacy@loopyloyalty.com.

9. Data retention

We retain Personal Information only for as long as necessary to:

• provide the Services;

• meet the purposes described in this Privacy Policy;

• comply with our legal, accounting and reporting obligations; and

• resolve disputes and enforce agreements.

When Personal Information is no longer needed, we will delete or anonymise it, or, where that is not possible (for example, due to backup systems), securely store it and isolate it from further processing until deletion is possible.

10. Your rights and choices

Your rights may vary depending on where you live, but in general you have the options described below.

10.1. Marketing communications

You can opt out of marketing emails:

• by clicking the “Unsubscribe” link in any marketing email; or

• by contacting us at privacy@loopyloyalty.com.

We may still send you non-marketing messages that relate to your account or the Services (for example, security alerts, service announcements, changes to terms).

10.2. Cookies and online advertising

You can manage your cookie preferences using the CookieYes “Cookie Settings” link on our Sites, through your browser or device settings and via industry opt-out tools (for example those provided by the Network Advertising Initiative or local equivalents).

Because these controls are browser- and device-specific, you will need to set them separately on each browser and device.

10.3. GDPR / UK GDPR rights (EEA & UK residents)

If you are located in the European Economic Area or the United Kingdom, you have the right (subject to certain conditions and exemptions) to:

• request access to your Personal Information;

• request correction of inaccurate or incomplete data;

• request deletion of your data;

• request restriction of processing;

• object to processing based on our legitimate interests;

• receive your data in a portable format (data portability); and

• withdraw consent at any time (where we rely on consent).

You also have the right to lodge a complaint with your local data protection authority. To exercise any of these rights, please contact us at privacy@loopyloyalty.com.

10.4. US state-specific rights

Depending on your US state of residence, you may have additional rights. For example:

• California (CCPA/CPRA): rights to know, access, delete, correct and (where applicable) opt out of certain “sales” or “sharing” of personal information and to be free from discrimination for exercising these rights.

• Colorado: rights to access, delete, correct, obtain a copy of your data and opt out of certain types of processing.

• Nevada: right to opt out of certain sales of personal information.

• Virginia: rights to access, delete, correct, obtain a copy of your data and opt out of targeted advertising, certain sales and profiling.

We do not currently sell personal information as “sale” is defined under Nevada or California law, nor do we knowingly sell personal information of minors.

You can exercise US state privacy rights by emailing privacy@loopyloyalty.com with a subject line such as “California Data Rights Request”, “Colorado Data Rights Request”, “Nevada Do Not Sell Request” or “Virginia Data Rights Request”. We will respond in accordance with applicable law.

10.5. Customer Data processed on behalf of merchants

If your Personal Information is processed within the Loopy Loyalty platform in our capacity as a processor on behalf of a merchant or other customer, please direct your rights request to that customer. We will support our customer in responding, as required under our agreement with them.

11. Children

Our Services are not directed to individuals under the age of 16, and we do not knowingly collect Personal Information from children under 16.

If you are a parent or guardian and believe your child has provided us with Personal Information without your consent, please contact us and we will take steps to delete such information.

12. Third-party sites and services

Our Services may include links or integrations with third-party websites, services and social media platforms (such as Facebook, LinkedIn, Twitter, Instagram, Vimeo, YouTube and others). These third parties may collect information about you, including via cookies or similar technologies.

Your use of these third-party services, and any information you provide to them, is governed by their own terms and privacy policies, not this Privacy Policy.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by:

• posting the updated Privacy Policy on our Sites; and/or

• sending a notice via email or through the Services, where appropriate.

Please review this Privacy Policy periodically. Your continued use of the Services after changes take effect means you accept the updated Privacy Policy.

14. Contact us

If you have any questions about this Privacy Policy or our privacy practices, or if you wish to exercise your rights, please contact us at:

F.A.O. Loopy Loyalty Privacy Team
PassKit (Loopy Loyalty)
6E Golden Sun Centre
59-67 Bonham Strand West
Sheung Wan
Hong Kong SAR

Email: privacy@loopyloyalty.com