Privacy Policy (Plattform)

1. Controller

The controller responsible for the processing of personal data within the meaning of the General Data Protection Regulation (GDPR) is:

2. Scope

This privacy policy applies to the use of the Loyalista platform, in particular to:

• the Vendor Portal
• the Loyalista API
• integrations with connected shop systems
• the use of the support and documentation services provided

A separate privacy policy applies to the public website at loyalista.de.

3. Hosting and Infrastructure

The Loyalista platform is operated on servers provided by Amazon Web Services (AWS).

The provider is:

Data processing takes place in data centres within the European Union, in particular in the AWS region eu-central-1 (Frankfurt am Main, Germany).

Technical connection data is processed to provide and secure the platform, in particular:

• IP address
• date and time of access
• browser information
• operating system
• resources accessed

Processing is carried out on the basis of Art. 6 para. 1 lit. b GDPR for the performance of the contract and Art. 6 para. 1 lit. f GDPR based on our legitimate interest in a secure and stable IT infrastructure.

The required data processing agreements have been concluded with AWS.

4. Registration and User Accounts

Registration of a vendor account is required to use the platform.

In this context, we process in particular the following data:

• first and last name
• company name
• email address
• password (exclusively in hashed form)
• registration date and time
• registration IP address

In the context of performing the contract, we additionally process:

• plan information
• contract status
• termination status
• billing information
• settings within the platform

Processing is carried out for the performance of the contractual relationship pursuant to Art. 6 para. 1 lit. b GDPR.

5. Login and Security Logs

To ensure the security of our systems, we log security-relevant events.

These include in particular:

• successful logins
• failed login attempts
• password resets
• IP addresses used
• browser and device information

Processing is carried out on the basis of Art. 6 para. 1 lit. f GDPR.

Our legitimate interest lies in ensuring IT security and in detecting and preventing misuse.

6. Use of the Platform

When using the platform, certain activities are logged in order to enable traceability of changes, error analysis and support by our support team.

These may include in particular:

• creation and management of API access credentials
• changes to settings
• points transactions
• configuration changes
• other relevant system actions

Processing is carried out on the basis of Art. 6 para. 1 lit. f GDPR.

7. Use of the Loyalista API

The Loyalista platform is based on an API-first architecture.

When using our API, we process in particular:

• API keys
• authentication data (hashes and secrets)
• IP addresses
• timestamps
• request data
• error messages and technical logs

Processing is carried out:

• pursuant to Art. 6 para. 1 lit. b GDPR for the provision of our contractual services
• pursuant to Art. 6 para. 1 lit. f GDPR to ensure system security, error analysis and detection of misuse

8. Processing of End Customer Data (Data Processing on Behalf)

When using Loyalista, personal data of your end customers may be processed.

This may include in particular:

• name
• email address
• customer ID
• order number
• order value
• loyalty points information
• transaction data

With regard to this data, you, as the vendor, act as the controller under data protection law.

Loyalista GmbH processes this data exclusively on your behalf and in accordance with your instructions as a processor pursuant to Art. 28 GDPR.

A prerequisite for using the platform to process your end customers' personal data is the conclusion of a data processing agreement (DPA).

9. Integrations with Third-Party Systems

We provide integrations and interfaces for connecting external systems.

These include in particular integrations with shop systems such as:

• plentyONE

If you activate an integration, data is transferred between your system and the Loyalista platform.

Processing is carried out for the performance of the contract pursuant to Art. 6 para. 1 lit. b GDPR.

10. Payment Processing and Invoicing

Paid subscriptions are processed via Stripe.

The provider is:

In the context of payment processing, the following data in particular may be processed:

• name
• billing address
• email address
• payment information
• payment status

Payment data is processed directly by Stripe. We do not receive complete credit card information.

Processing is carried out for the performance of the contract pursuant to Art. 6 para. 1 lit. b GDPR.

We store data relevant for invoicing and tax purposes on the basis of Art. 6 para. 1 lit. c GDPR.

Further information can be found in Stripe's privacy policy.

11. System Emails

For the provision of our contractual services, we send system and notification emails.

These include in particular:

• registration confirmations
• password resets
• invoices
• security-related notifications
• contract information

Emails are sent via:

Processing is carried out on the basis of Art. 6 para. 1 lit. b GDPR.

12. Marketing Communications

If you have expressly consented, we will inform you by email about:

• new features
• product news
• events
• offers
• other information relating to Loyalista

Processing is carried out on the basis of your consent pursuant to Art. 6 para. 1 lit. a GDPR.

You may withdraw your consent at any time with effect for the future.

We do not analyse your email opening or click behaviour.

13. Customer Service and Helpdesk

For processing support requests and providing our online documentation, we use a self-hosted helpdesk solution (Frappe).

This system is hosted by us on servers provided by:

If you contact our support team or use our helpdesk, the following data in particular may be processed:

• name
• email address
• company
• communication content
• file attachments
• technical connection data and session cookies
• time of the request

Processing is carried out:

• for the performance of contractual services pursuant to Art. 6 para. 1 lit. b GDPR
• on the basis of our legitimate interest in efficient customer service pursuant to Art. 6 para. 1 lit. f GDPR

14. Monitoring and System Monitoring

We use Amazon CloudWatch to monitor the stability, availability and security of our systems.

In this context, technical operating data, error logs and performance metrics may be processed.

Processing is carried out on the basis of Art. 6 para. 1 lit. f GDPR.

15. Cookies

Only technically necessary cookies are used within the Vendor Portal.

These include in particular:

• Session Cookie: Used for authentication and maintaining your session.
• Security Cookie (CSRF Token): Used to protect against unauthorised requests and attacks.

Use is based on § 25 para. 2 TDDDG as well as Art. 6 para. 1 lit. b and lit. f GDPR.

No tracking or marketing cookies are used within the Vendor Portal.

16. External Resources

External content is currently integrated to provide individual functions and resources.

These include in particular:

• Google Fonts
• Stripe JS
• jsDelivr
• Cloudflare cdnjs
• Flaticon

When these resources are retrieved, your browser's IP address is transmitted to the respective provider for technical reasons.

Use is based on our legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR in the secure, functional and consistent presentation of our system.

17. Backups and Data Security

To ensure the availability and recoverability of our systems, we regularly create encrypted backups.

The backups are managed automatically and cleaned up in accordance with a defined retention and deletion concept.

Processing is carried out on the basis of Art. 6 para. 1 lit. f GDPR.

18. Data Recipients

Within Loyalista GmbH, only those persons who require personal data to perform their duties have access to it.

In addition, we use the following categories of service providers:

• Amazon Web Services (hosting and infrastructure)
• Stripe Payments Europe Ltd. (payment processing)
• Microsoft Ireland Operations Limited (email delivery)

The required data protection agreements have been concluded with all service providers used.

19. Data Transfers to Third Countries

If personal data is transferred to recipients outside the European Union or the European Economic Area, this is done exclusively in compliance with the legal requirements of Art. 44 et seq. GDPR.

Where required, appropriate safeguards are provided in particular through:

• adequacy decisions of the European Commission
• certifications under the EU-U.S. Data Privacy Framework
• EU Standard Contractual Clauses

Not every use of the services employed necessarily results in a transfer to a third country.

20. Storage Period

We store personal data only for as long as is necessary for the respective processing purposes.

In particular, the following periods apply:

• Vendor account data: duration of the contractual relationship plus 6 months
• Invoice data: 10 years
• Support requests: 3 years
• Server and security logs: generally 30 to 90 days
• API logs: generally 30 to 90 days
• Audit and event logs: generally 90 to 180 days

After expiry of the respective periods, the data is deleted unless statutory retention obligations prevent deletion.

21. Your Rights

Under the applicable statutory provisions, you have in particular the following rights:

• right of access (Art. 15 GDPR)
• right to rectification (Art. 16 GDPR)
• right to erasure (Art. 17 GDPR)
• right to restriction of processing (Art. 18 GDPR)
• right to data portability (Art. 20 GDPR)
• right to object (Art. 21 GDPR)
• right to withdraw consent previously given (Art. 7 para. 3 GDPR)

To exercise your rights, you may contact us at any time using the contact details stated above.

22. Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data.

Competent supervisory authority:

This privacy policy applies to all user accounts of the Loyalista platform and supplements the privacy policy of the public website.