Terms and conditions

This is a translation for convenience. In case of any discrepancy, the Spanish version prevails.

These terms govern the use of Loyaltygo by a business. By creating an account, the business accepts them, together with the legal notice and the privacy policy.

1. Who provides the service

Diego Ceniceros, tax ID (NIF) 33006489V, with address at Calle Espartinas 6, 28001 Madrid (España), contact soporte@loyaltygo.io (hereinafter, “Loyaltygo”).

2. What the service includes

Loyaltygo allows the business to design a digital loyalty card, deliver it to its customers through a link or a QR code, record stamps or points, manage redemptions and send email communications to the customers who have consented to them.

3. Business account

The business must provide truthful information and is responsible for keeping its credentials and its team’s PIN safe, as well as for all activity carried out from its account. It must give notice without delay if it detects unauthorized access.

4. Obligations of the business

To use the service in accordance with the law and not to use it to send unsolicited communications or to upload data of people who have not voluntarily signed up to its program.
To be the controller of its customers’ data, to inform them and obtain their consent where appropriate, and to respond to the rights they exercise.
To hold the rights to the logo, images and texts it uploads, and not to include content that is unlawful or that infringes the rights of third parties.
Not to attempt to access data of other businesses or to interfere with the operation of the service.

5. Price and payment

The financial terms in force are those published on the website. Payment is handled by Paddle, which acts as merchant of record and issues the invoice, taking care of the applicable taxes. Non-payment allows access to the dashboard, the scanner and the sign-up of new customers to be suspended after the grace period indicated in the service itself. Cancellation and the cases in which a refund is given are detailed in the refund policy.

6. Availability

Loyaltygo works to keep the service available, but does not guarantee uninterrupted availability: there may be interruptions for maintenance or for external causes, such as failures of providers or of digital wallet platforms.

7. Intellectual property

The software and the design of the service belong to Loyaltygo. The content uploaded by the business remains its own; by uploading it, the business authorizes Loyaltygo to host and display it for the sole purpose of providing the service.

8. Liability

Loyaltygo is liable for the direct damage attributable to it, up to the amount paid by the business in the previous twelve months. It is not liable for loss of profits or for the use the business makes of the service with its customers. Nothing in the foregoing limits any liability that the law does not allow to be excluded.

9. Term and termination

The contract remains in force for as long as the account is active. The business may close its account whenever it wishes from Settings; when the account is deleted, its data and its customers’ data are deleted, and the cards already installed stop updating. Loyaltygo may suspend or cancel an account that breaches these terms, giving prior notice unless the seriousness of the matter or a legal obligation prevents it.

10. Changes

These terms may be modified. Material changes will be communicated by email with reasonable notice; continuing to use the service afterwards implies accepting them.

11. Governing law

Spanish law applies. Disputes shall be heard by the courts and tribunals that have jurisdiction under the applicable rules.

Annex I — Data processing agreement

This annex forms part of the terms and complies with Article 28(3) of the GDPR. The business is the controller of its customers’ data and Loyaltygo, the processor.

Subject matter, duration and nature

Loyaltygo processes the data of the business’s customers to issue and update their loyalty cards, record stamps, points and redemptions and send, when the business requests it, communications to the customers who have consented to them. The processing lasts as long as the contract.

Data and data subjects

Identification and contact data (name, email address and, optionally, phone number), card activity and technical data associated with the pass, of the business’s end customers. No special categories of data are processed.

Obligations of Loyaltygo as processor

To process the data solely in accordance with the business’s documented instructions.
To ensure confidentiality on the part of those who access the data.
To apply the security measures of Article 32 of the GDPR.
To assist the business in responding to the rights of its customers and in complying with its security and notification obligations.
To notify the business without undue delay of any security breach it becomes aware of.
To delete the data when the contract ends or when the business deletes its account, unless it must keep it due to a legal obligation.
To make available to the business the information necessary to demonstrate compliance with this annex.

Sub-processors

The business gives general authorization for Loyaltygo to engage the following sub-processors, with whom it has contracts that impose the same obligations. Any addition or replacement will be notified in advance so that the business can object:

Supabase — Database and login accounts of the businesses. Location: European Union (Frankfurt).
Vercel — Hosting of the application, storage of the card images and aggregate counting of visits to the public website, without cookies. Location: European Union (Frankfurt), with the provider’s global content delivery network.
Resend — Sending of the service emails and of each business’s campaigns. Location: European Union and United States (standard contractual clauses).
Paddle — Collection of the business’s subscription payments; acts as merchant of record. Location: United Kingdom and European Union (United Kingdom adequacy decision).
Apple — Delivery and updating of the card in Apple Wallet. Location: United States (standard contractual clauses).
Google — Sign-in with Google for the business owner, if they choose to use it, and delivery and updating of the card in Google Wallet. Location: United States (standard contractual clauses).
Sentry — Logging of application errors, with personal data filtered out before it is sent. Location: European Union (Frankfurt).
Cloudflare — Domain management and protection against attacks; data only passes through in transit. Location: Global network, with an entry node in the European Union.
GitHub — Storage of the daily database backups, always encrypted. Location: United States (standard contractual clauses).