Privacy Policy

Who we are

For the purposes of applicable data protection legislation, the data controller is Trading LG Limited, a company registered in England and Wales. If you have any questions about this Privacy Policy or our data practices, please contact us at office@lovalty.com.

Information we collect

Information you provide to us

• Account information: name, email address, phone number, date of birth, and postal address when you create an account.
• Identity verification: government-issued identification documents and selfie images for identity verification purposes.
• Financial information: bank account details, payment card information, and transaction history.
• Communications: information you provide when you contact our support team, respond to surveys, or participate in promotions.
• Business information: if you are a merchant partner, we collect business name, registration details, and business bank account information.

Information we collect automatically

• Device information: IP address, browser type, operating system, device identifiers, and mobile network information.
• Usage data: pages visited, features used, time spent on the platform, and interaction patterns.
• Location data: approximate location derived from your IP address or, with your consent, precise location from your device.
• Cookies and similar technologies: we use cookies, pixels, and similar technologies to collect information about your browsing activity.

Information from third parties

• Identity verification providers: to verify your identity and prevent fraud.
• Credit reference agencies: to assess creditworthiness where applicable.
• Merchant partners: transaction data related to your loyalty rewards activity.
• Public databases: sanctions lists and politically exposed persons registers.

How we use your information

We use your personal data for the following purposes:

• Providing our Services: to operate and maintain your account, process transactions, manage loyalty rewards, and deliver our platform features.
• Legal and regulatory compliance: to comply with anti-money laundering (AML), know your customer (KYC), and other regulatory obligations.
• Fraud prevention and security: to detect, prevent, and investigate fraud, unauthorised access, and other illegal activities.
• Improving our Services: to analyse usage patterns, conduct research, and develop new features and products.
• Communications: to send you service updates, security alerts, and, where you have opted in, marketing communications.
• Customer support: to respond to your queries and resolve issues.

Legal basis for processing

We process your personal data on the following legal grounds under the UK General Data Protection Regulation (UK GDPR):

• Contract: processing necessary to perform our contract with you, such as providing the Services and managing your account.
• Legal obligation: processing necessary to comply with our legal and regulatory obligations.
• Legitimate interests: processing necessary for our legitimate interests, such as fraud prevention, security, and improving our Services, provided these are not overridden by your rights.
• Consent: where you have given us specific consent, such as for marketing communications or precise location data.

How we share your information

We may share your personal data with the following categories of recipients:

• Service providers: third-party companies that provide services on our behalf, such as cloud hosting, payment processing, identity verification, and customer support.
• Merchant partners: to facilitate loyalty rewards and transaction processing.
• Regulators and authorities: where required by law or to comply with a legal obligation, including law enforcement agencies, tax authorities, and financial regulators.
• Professional advisers: such as auditors, lawyers, and accountants where necessary.
• Corporate transactions: in connection with a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction.

We do not sell your personal data to third parties.

International transfers

Your personal data may be transferred to, and processed in, countries outside the United Kingdom. Where we transfer your data internationally, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the Information Commissioner's Office (ICO), or transfers to countries deemed to have adequate levels of data protection.

Data retention

We retain your personal data for as long as necessary to fulfil the purposes for which it was collected, including to satisfy any legal, regulatory, accounting, or reporting requirements. Typical retention periods include:

• Account data: for the duration of your account and up to 6 years after closure to comply with regulatory requirements.
• Transaction data: up to 7 years to comply with financial record-keeping obligations.
• Marketing preferences: until you withdraw your consent or unsubscribe.
• Support queries: up to 3 years after resolution.

Your rights

Under the UK GDPR, you have the following rights in relation to your personal data:

• Right of access: request a copy of the personal data we hold about you.
• Right to rectification: request correction of inaccurate or incomplete data.
• Right to erasure: request deletion of your personal data in certain circumstances.
• Right to restrict processing: request that we limit how we use your data.
• Right to data portability: request a copy of your data in a structured, machine-readable format.
• Right to object: object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, please contact us at office@lovalty.com. We will respond to your request within one month.

Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include encryption of data in transit and at rest, access controls, regular security assessments, and employee training.

While we take reasonable steps to protect your information, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security.

Children's privacy

Our Services are not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately and we will take steps to delete such information.

Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by posting the updated policy on our website and updating the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

Contact us

If you have any questions, concerns, or complaints about this Privacy Policy or our data practices, please contact us:

• Email: office@lovalty.com
• Post: Data Protection Officer, Trading LG Limited, London, United Kingdom

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe your data protection rights have been violated. You can contact the ICO at ico.org.uk.