SME Loyalty Privacy Policy

1. Definitions

• Platform: The SME Loyalty website, software, mobile interfaces, and related services.
• Merchant / Business / Partner: Any business subscribing to the Platform to manage its own loyalty or rewards programmes.
• Customer / User: Any individual participating in a loyalty programme offered by a Merchant through the Platform.
• Loyalty Programme / Rewards Programme: Any reward, promotion, incentive, cashback, discount, or loyalty offer created by a Merchant.

2. Categories of Data We Collect

3. How We Use Personal Data

SME Loyalty acts as a Data Processor for customer data and a Data Controller for merchant accounts. Data is used for:

• Operating and maintaining the Platform
• Enabling Merchants to manage loyalty programmes
• Sending notifications regarding rewards, promotions, and programme updates
• Providing analytics, reporting, and insights to Merchants
• Improving Platform functionality, services, and user experience
• Communication about subscriptions, support, or feedback requests

Explicit Consent: By participating in a Merchant's loyalty programme, Customers consent to the collection and processing of their personal data. Merchants are responsible for obtaining and recording this consent in compliance with POPIA.

4. Data Sharing and Third Parties

• Sub-Processors: Trusted third-party providers may be used for hosting, payment processing, messaging, and analytics. All sub-processors comply with data protection standards.
• Cross-Border Transfers: Customer and merchant data may be stored or processed outside South Africa. SME Loyalty ensures appropriate safeguards are in place in line with POPIA requirements.
• Aggregated Data: Anonymised and aggregated data may be used for Platform improvement, benchmarking, and research.
• No Sale of Personal Data: SME Loyalty does not sell identifiable merchant or customer information.

5. Data Retention and Deletion

• Customer and Merchant data is retained only as long as necessary for service provision or legal compliance.
• Merchant Data: Retained until account deletion plus one (1) year for backup, legal, or regulatory purposes.
• Customer Data: Retained for the duration of participation in a loyalty programme plus one (1) year for legal compliance.
• Upon account deletion, all associated data is permanently removed and cannot be recovered.

6. Security of Data

SME Loyalty implements reasonable technical and organisational measures, including:

• Encrypted data storage and secure communication channels
• Access controls and authentication measures
• Regular monitoring and vulnerability assessments

Note: Absolute security cannot be guaranteed, but SME Loyalty strives to protect all personal data against unauthorised access, loss, or misuse.

7. Data Breach Notification

In the event of a data breach that affects personal information:

• SME Loyalty will assess the risk and notify affected merchants/customers without undue delay.
• Relevant authorities, including the Information Regulator, will be informed as required by POPIA.

8. User Rights

Merchants and Customers have the right to:

• Access: Request access to personal information held by SME Loyalty.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of personal data (subject to legal obligations).
• Withdrawal of Consent: Withdraw consent for processing of personal information.
• Objection / Complaint: Object to processing or lodge complaints with SME Loyalty or the South African Information Regulator.

How to Exercise Rights: Contact us at info@smeloyalty.co.za with your request. We will respond within a reasonable time in accordance with POPIA.

9. Cookies and Tracking

• Cookies improve Platform functionality and user experience.
• Cookies may track login sessions, preferences, and feature usage.
• Users can disable cookies in browser settings, but some Platform features may not function correctly.

10. Marketing and Communications

• Customers may receive notifications about rewards, programme updates, or relevant Platform announcements.
• Marketing communications outside of reward notifications will only be sent with explicit consent.
• Users may opt-out of marketing messages at any time via provided unsubscribe links or by contacting info@smeloyalty.co.za.

11. Third-Party Links

The Platform may contain links to third-party websites or services. SME Loyalty is not responsible for the privacy practices or content of these third parties.

12. Minors

• The Platform is intended for users 18 years or older.
• SME Loyalty does not knowingly collect personal information from minors.

13. Updates to this Privacy Policy

• This Privacy Policy may be updated from time to time.
• Updated policies will be published on www.smeloyalty.co.za.
• Continued use of the Platform constitutes acceptance of the revised Privacy Policy.

14. Contact Information

For any questions, concerns, or requests regarding this Privacy Policy or personal data:

SME Loyalty (Pty) Ltd
Website: www.smeloyalty.co.za
Email: info@smeloyalty.co.za