Privacy Policy

1. Information We Collect

The information we handle depends on whether you are a customer or a business.

If you are a customer, we collect:

• Account details — your name, email address, mobile number and address (address lines, town/city and postcode). If you sign in with Google, we receive your name, email address and Google account ID. Your password is stored in encrypted form.
• Age and terms — your confirmation that you are 13 or over, and when you accepted our Terms of Service and Privacy Policy.
• Loyalty activity — points earned and used, transactions and offers redeemed at each business, Bono Cash balance and referrals.
• Special Days — birthdays, anniversaries and the names of family members that you choose to save, so businesses can send you offers.
• Reviews and bills — reviews you write, and the bill photos or receipts you upload to claim points.
• Your marketing choices — whether you opted in to or out of marketing, when and where you did so, and the wording you agreed to.
• Technical data — your IP address, browser/device details and login times (used for security and to prevent fraud), and cookies (see section 6).

If you are a business, we collect the owner's name, email address and phone number, your business name, address and logo, your plan details, the staff accounts you create, and the date you accepted our Terms of Service and Privacy Policy.

You choose what optional information to provide. Details marked as required on our forms are needed to create and run your account.

2. How We Use Your Information

We use the information we collect to provide, maintain, and improve our services, process transactions, send communications, and respond to your comments and questions.

3. Our Legal Basis for Processing

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, we process your personal data on the following legal bases: performance of a contract with you, your consent (for example, for non-essential cookies), our legitimate interests in operating and improving our services, and compliance with our legal obligations.

4. Information Sharing

The business you join. When you join a business (for example by scanning its QR code or signing up through its link), that business — and the staff members it authorises — can see your name, email address, phone number, member number, and your points and activity with that business. They cannot see your password or your activity at other businesses. Each business uses this information to run its own loyalty programme; Bonocard processes it on the business's behalf, as explained in our Terms of Service.

Bonocard. Our team accesses personal data only to run, support and secure the service. We do not use customer data for our own marketing and we do not share one business's customers' data with another business.

Service providers. We use trusted providers who help us deliver the service, such as email, SMS, push-notification and hosting providers. They receive only the information needed to do their job and are bound by contract to protect it.

We do not sell your personal data. We may also disclose information where required by law or to protect the rights and safety of our users.

5. Data Security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction.

6. Cookies

We use cookies and similar tracking technologies to track activity on our platform. You can manage your preferences at any time on our Cookie Preferences page, or instruct your browser to refuse cookies.

7. Your Rights

Under UK data protection law, you have the right to: access the personal data we hold about you; have inaccurate data corrected; have your data erased; restrict or object to the processing of your data; receive a copy of your data in a portable format; and withdraw your consent at any time (this does not affect processing that happened before you withdrew it).

You can do most of this yourself, in the app:

• Download your data — Settings → My data & privacy → Download my data (a ZIP file with your profile, points history, reviews, referrals and saved special days).
• Correct your details — Settings → Edit profile.
• Close your account — Settings → My data & privacy → Close my account. You are signed out straight away and can no longer log in or receive messages.
• Withdraw marketing consent — Settings → Marketing preferences, or use the Unsubscribe link at the bottom of every marketing email. Account messages such as login codes and points confirmations are not marketing and will still be sent.

For anything else — for example to ask us to restrict or object to processing, or if you cannot use the options above — email support@bonocard.app. We will respond within one month of receiving your request (or tell you if a complex request needs longer). There is no charge. Because the business you joined is responsible for its loyalty programme, we may involve that business in order to deal with your request.

8. Data Retention

We retain your personal information for as long as necessary to fulfil the purposes outlined in this Privacy Policy, unless a longer retention period is required by law.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page with an updated effective date.

10. How to Complain

If you have concerns about how we handle your personal data, please contact us first so we can try to resolve the issue. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's independent regulator for data protection, at ico.org.uk.

11. Contact Us

If you have any questions about this Privacy Policy, please contact us at support@bonocard.app.