Privacy Policy

Privacy Policy for Bloyal
Last Updated 30/3/2025

1. Introduction
‍Welcome to Bloyal ("Company", "we", "our", or "us"). Your privacy matters to us, and this Privacy Policy explains how we collect, use, share, and safeguard your personal information when you use our website, merchant dashboard, mobile services, or interact with our platform in any way.This Privacy Policy is governed by and interpreted in accordance with applicable data protection laws, including the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and its Executive Regulations, the UK General Data Protection Regulation and the UK Data Protection Act 2018, as well as relevant data protection laws applicable in Qatar and other GCC jurisdictions.

Where permitted by law, disputes arising from this Privacy Policy or data misuse shall be subject to the exclusive jurisdiction of the competent courts of the United Arab Emirates.This Policy is governed by applicable data protection laws in the United Arab Emirates (UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data), Qatar (Law No. 13 of 2016), other GCC countries, and the United Kingdom (UK GDPR).By using our services, you agree to this Privacy Policy. If you do not agree, please refrain from using our platform.

2. Information We Collect
‍We only collect the minimum data necessary to provide our digital loyalty card services.
‍
‍2.1. Information You Provide
‍We collect personal information that you voluntarily provide when registering or using our services, including:Name,Email address,Phone number,Date of birth (optional, used for birthday rewards or age-based campaigns).This information is collected via registration forms on our platform or when businesses invite customers to join their loyalty program.
‍
‍2.2. Usage Data
‍We may collect anonymized information about how users interact with our platform, including:Browser type and versionTime spent on pages, IP address (for security and performance), Device type and general usage statistics.This information helps us improve the user experience and monitor system performance.

‍

3. How We Use Your Information
Your personal information is used strictly to deliver the services you request. This includes issuing digital loyalty cards, registering users to a business’s loyalty program, issuing and redeeming digital stamps or rewards, and sending service-related messages such as redemption confirmations, birthday offers, or promotions. Businesses on our platform may also use your information to communicate directly with you, only while they have an active subscription with us. We may also use your information to analyze service usage, troubleshoot issues, protect against misuse, or fulfill our legal obligations under local and international law. We do not use your information for profiling, automated decision-making, or advertising without your explicit consent.

Personal data collected through the Bloyal platform shall not be used for purposes materially different from those originally disclosed at the time of collection. This includes, without limitation, the transfer, migration, reuse, or repurposing of customer data for third-party loyalty systems, marketing platforms, or competing services without obtaining fresh, explicit, and informed consent directly from the data subject.

4. Legal Basis for Processing
Depending on your location and jurisdiction, we process your personal data based on your explicit consent, the necessity of fulfilling a contractual relationship (such as issuing a loyalty card or providing customer rewards), our legitimate interest in operating and maintaining a secure digital platform, or compliance with applicable legal obligations.

5. Data Ownership and Responsibilities
Customers are the owners of their personal data. Bloyal acts as a data controller for platform operations and as a data processor on behalf of subscribed businesses, depending on the context of processing.Businesses using Bloyal are granted a limited, non-transferable, and purpose-restricted right to access customer data solely for operating loyalty services within the Bloyal platform and only for the duration of an active subscription.Businesses are strictly prohibited from exporting, transferring, selling, licensing, sharing, or otherwise reusing customer data outside the Bloyal platform, including for migration to competing loyalty providers, marketing systems, or third-party platforms, unless each affected customer has provided separate, explicit, and verifiable consent for such transfer.Upon termination or expiry of a business subscription, all rights to access or process customer data immediately cease. Any continued access, copying, retention, or reuse of such data constitutes unauthorized processing and may result in contractual termination, legal action, and regulatory reporting.Bloyal actively enforces these restrictions through technical, contractual, and administrative safeguards.

5.1 Prohibition on Competitive Data MigrationBloyal does not support, facilitate, or permit the bulk migration of customer data to competing loyalty platforms or marketing systems where such transfer would enable unsolicited communications, profiling, remarketing, or reuse beyond the original loyalty purpose.Requests for data portability initiated by businesses, rather than individual data subjects, will be refused where they conflict with data protection laws, this Privacy Policy, or the rights and expectations of customers.

6. Data Retention
‍We retain personal information only for as long as required to fulfill the purposes outlined in this policy. If a customer deletes their account or unsubscribes from a business, or if a business terminates its contract with us, the associated personal data is deleted or anonymized within a reasonable period unless we are legally required to retain it for audit, dispute resolution, or regulatory purposes.

7. Third-Party Processors
‍In order to operate our platform effectively, we engage carefully selected third-party service providers for hosting, email delivery, system monitoring, and analytics. These providers are contractually bound to handle your data in accordance with the highest privacy standards. They are not permitted to use your data for their own purposes. All third-party vendors are located in jurisdictions with appropriate data protection laws or are governed by legally binding agreements such as Standard Contractual Clauses where applicable.

8. Cookies and Analytics
‍Our website uses cookies and lightweight tracking scripts to understand general user behavior, improve navigation, and secure user sessions. These cookies do not store any sensitive or personally identifiable information. You may configure your browser settings to reject cookies, although this may limit certain features or reduce performance. We do not use cookies to serve targeted advertisements or sell user behavior data.

9. Push Notifications and Messaging
‍If you opt in to receive push notifications, we may send updates related to your loyalty activity such as newly issued stamps, reward availability, or promotional messages from businesses you’ve joined. You may disable push notifications through your device settings or by unsubscribing from communications via links provided in our emails.

10. Your Rights Under Data Protection LawAs a user, you have the right to request access to your personal data at any time. You also have the right to request corrections if the information we hold is inaccurate, and to request deletion of your data, subject to certain legal and operational exceptions. If you have previously consented to data processing, you may withdraw your consent at any time. In certain jurisdictions such as the UK, you may also have the right to object to specific processing or request the transfer of your data to another service provider.All data rights requests should be submitted to support@beloyal.io. We aim to respond within the timeframe required by your local data protection authority.

The right to data portability applies only to individual data subjects and covers personal data they have directly provided. It does not grant businesses the right to export or transfer entire customer databases for commercial reuse, marketing, or onboarding into third-party or competing platforms.

10.1 Marketing and CommunicationsMarketing communications may only be sent where a lawful basis exists, including explicit consent where required by law. Any third party receiving customer data must obtain independent marketing consent prior to sending communications. Bloyal is not responsible for unauthorized marketing conducted outside its platform and reserves the right to take legal action where misuse occurs.

11. Children's Data
‍Bloyal is not designed for or directed at users under the age of 18. We do not knowingly collect personal data from minors. If we become aware that data has been collected from a minor without parental consent, we will delete the information as quickly as possible. Parents and legal guardians may contact us to review or delete data associated with a child.12. Data Security and InfrastructureWe take all reasonable and industry-standard precautions to protect personal information from loss, theft, or unauthorized access. Our platform uses HTTPS encryption, secure authentication methods, access controls, and server firewalls. Internal staff access to user data is restricted and reviewed regularly. While no digital system is entirely immune to cyber threats, we continuously monitor and test our infrastructure to ensure that your information remains secure. We also encourage users to maintain good security practices such as choosing strong passwords and avoiding public networks when accessing sensitive content.
‍
‍13. Business Transfers
‍In the unlikely event of a merger, acquisition, or restructuring of Bloyal, your personal data may be transferred to a successor entity under strict confidentiality and privacy terms. In such cases, users will be notified in advance, and the acquiring entity must honor the protections set forth in this Privacy Policy or provide similar protections.
‍
‍14. Links to Third-Party Sites
‍Our platform may contain links to websites, tools, or applications operated by third parties. These services are not covered by this Privacy Policy, and we do not control how these parties collect or use your data. We recommend reviewing the privacy policies of all external sites before submitting any personal information.
‍
‍15. Updates to This Privacy Policy
‍We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal obligations. The most recent version will always be available on our website with an updated “Last Updated” date. We encourage you to check this page regularly. Continued use of our services after an update means that you accept the revised terms.


16. Enforcement and Legal Remedies
Any unauthorized use, transfer, or disclosure of personal data in violation of this Privacy Policy, applicable data protection laws, or contractual obligations may result in immediate suspension or termination of services, legal action, claims for damages, and notification to relevant data protection authorities.Bloyal reserves all rights and remedies available under UAE law, UK law, and applicable international regulations.

‍17. Contact Us
‍If you have any questions about this Privacy Policy, your rights, or how we process your data, please contact us at:
Bloyal for Loyalty Card Services Co. L.L.C
Registered in the United Arab Emirates
Email: support@beloyal.io
Phone: +971 50 314 6679
Website: https://www.beloyal.io