Privacy Policy

Last updated: [DATE].

This policy explains what personal data PerkTrak collects, why we collect it, who we share it with, and the rights you have under UK data protection law (UK GDPR and the Data Protection Act 2018).

1. Who we are

Our role depends on whose data it is:

• For data you give us directly — your account, billing details and demo requests — we are the data controller.
• For data your customers give you through your loyalty programmes, the business running the programme is the controller and we act as its processor, handling that data only on its instructions.

2. What we collect

• Account data — name, email address, password (stored hashed, never in plain text), business name and branding.
• Billing data — handled by Stripe. We store your Stripe customer reference and subscription status only; we never see or store card numbers.
• Programme data — participants’ names, email addresses, stamps, points and reward activity, collected on behalf of the business running the programme.
• Technical data — server logs containing IP addresses and browser user-agent strings, kept for security, abuse-prevention and debugging.

3. Why we use it, and our lawful basis

• To provide the service — creating accounts, running campaigns, recording stamps and rewards. Lawful basis: contract.
• To take payment and manage subscriptions. Lawful basis: contract.
• To secure the platform — logging, rate-limiting, bot-protection and blocking abusive traffic. Lawful basis: legitimate interests (keeping the service and its data safe).
• To send service emails — receipts, password resets, reward notifications and account notices. Lawful basis: contract / legitimate interests.
• To meet legal obligations — e.g. keeping billing records. Lawful basis: legal obligation.

We do not sell personal data, and we do not send third-party marketing.

4. Who we share it with

We share data only with the processors we need to run the service, each under a data processing agreement:

• Railway — application and database hosting (EU).
• Stripe — payment processing and subscription billing.
• Brevo — delivery of transactional emails.
• Cloudflare — file storage for logos and images (R2, EU), and bot-protection on our forms (Turnstile), which processes request metadata such as IP address.
• Sentry — error monitoring (configured not to capture personal data).

5. Where your data is processed

Your account and programme data — our database and your uploaded files — is hosted in the European Union. The EU is covered by the UK’s data-protection adequacy regulations, so no additional safeguards are needed for data held there. Some of our processors are based outside the UK/EU, including in the United States (for example Stripe, Sentry and Cloudflare); where personal data is transferred to them we rely on an appropriate safeguard — the ICO’s International Data Transfer Agreement (or the UK Addendum to the EU Standard Contractual Clauses), or the UK Extension to the EU–US Data Privacy Framework where the recipient is certified.

6. How long we keep it

Account and programme data is kept while your subscription is active and for 90 days after cancellation, after which it is deleted. Security and server logs are kept for a short period for abuse-prevention and debugging. You can export your data from the admin area at any time before deletion.

7. Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to how we use it;
• receive a copy of your data in a portable format; and
• complain to the ICO (see section 10).

To exercise any of these, email our data protection contact at dpo@perktrak.com. We will respond within one month. When you ask us to erase your data, we remove the information that identifies you — your name, email address and login — while keeping any underlying records (such as transaction history) in an anonymised form where the business needs them or the law requires us to. If you are a participant in a business’s loyalty programme, please contact that business first — it controls your data, and we will assist it in fulfilling your request.

8. Cookies

We use only strictly necessary cookies: a session cookie that keeps you signed in, a CSRF token that protects our forms, and — on pages protected by Cloudflare Turnstile — a short-lived cookie used solely to tell humans from bots. We set no analytics or advertising cookies, so no cookie-consent banner is required.

9. Changes to this policy

We may update this policy from time to time. Material changes will be reflected in the “last updated” date above.

10. Contact and complaints

Data protection questions and requests: dpo@perktrak.com.

If you are unhappy with how we handle your data you can complain to the Information Commissioner’s Office at ico.org.uk, or by calling their helpline on 0303 123 1113.