Privacy Policy

This policy explains how Yoybo Ltd. ("Yoybo", "we") handles personal data. It covers two groups of people:

• •Businesses that use Yoybo to run a loyalty card, and their staff (Part A)
• •Customers who add a business's loyalty card to their phone (Part B)

1. Who we are

Yoybo Ltd., 167-169 Great Portland Street, 5th Floor, London W1W 5PF, United Kingdom. ICO registration number: C1946136. Contact: [email protected]

2. Data we collect

Business account

• •Business name, category, logo and address
• •Account owner's name, email and phone number
• •Billing address and, where required, tax/VAT number
• •Card settings: stamp count, rewards, card design, sign-up form, locations

When you set up your business, we may fill in some of these details (name, address, map coordinates, phone number and website) from Google Places. You can edit them at any time.

Staff

• •Name, email or phone number used to log in
• •Actions in the cashier app (stamps given, rewards redeemed and when)

Usage and technical data

• •Login times, IP address, device and browser type, and a history of settings changes

Payment

Card payments are handled by Stripe. We do not receive or store your card details. We receive the plan, amount and payment status.

3. Why we use it

We do not sell your data.

4. Who is responsible for your data

When you join a business's loyalty card, that business is responsible for your data (the "controller"). Yoybo stores and processes the data on the business's behalf (as a "processor"), under a data processing agreement.

For questions about how a business uses your data, contact the business first. You can also contact us and we will pass your request on.

5. Data we collect

Sign-up form

The business decides which fields its form asks for. Typically:

• •Name
• •Email address and/or phone number
• •Birthday (optional)
• •Whether you agree to receive marketing messages
• •Any other fields the business adds (text, number, date or tick-box)

Card activity

• •Stamps collected, rewards earned and used, and dates of visits

Device data needed for the card

• •For Apple Wallet and Google Wallet: a card identifier and a technical push token that lets us update your card. We do not receive your Apple ID or Google account details.

Location

If the business adds its address to the card, your phone may show the card on your lock screen when you are nearby. Your phone does this on its own. Yoybo does not receive or store your location. You can turn this off in the card's settings in your wallet ("Suggest on Lock Screen" on iPhone).

6. What the data is used for

• •Adding stamps and rewards to your card
• •Updating your card in your wallet
• •Sending you messages from the business about your card and rewards (for example, "You have a free coffee waiting")
• •Marketing messages from the business, only if you agreed: card notifications, email or SMS
• •Showing the business statistics about its loyalty program

7. What the business can see

The business can see the fields you filled in on its sign-up form and your card activity at that business.

A business cannot see:

• •Your cards at other businesses
• •Your activity at other businesses

Businesses may use your data only for their own loyalty program and marketing. They may not sell it or share it with others.

8. Notifications and messages

• •Card notifications: You can turn them off from the card's settings in your wallet. Your card and stamps stay.
• •Email: Every email has an unsubscribe link.
• •SMS: Reply with the opt-out word in the message, or contact the business.
• •Delete the card: Removing it from your wallet stops all card notifications. To delete your data, see section 13.

9. Children

Yoybo is not intended for children under 16. Businesses must not knowingly sign up children under 16 without parental consent. If you believe a child has signed up, contact us and we will delete the data.

10. Who we share data with

We share data only with providers that help us run Yoybo:

If a business connects its own email or SMS provider (for example SendGrid, Mailgun, Brevo or Twilio) to send campaigns, those messages are sent through that provider under the business's own account.

For the analytics and advertising tools used on our website, see our Cookie Policy.

We may also share data when the law requires it, or as part of a merger or sale of the company (you will be told beforehand).

11. Security

• •Encrypted connections (TLS)
• •Each business's data is kept logically separate, and access is checked on every request
• •Passwords are stored only in hashed form
• •Access is limited to staff who need it

12. How long we keep data

13. Your rights

Under UK GDPR, EU GDPR and Turkey's KVKK, you can ask to:

• •See the data we hold about you
• •Correct it
• •Delete it
• •Restrict or object to its use
• •Get a copy in a portable format
• •Withdraw consent at any time

Send requests to [email protected]. We reply within 30 days. If you are a customer, we may pass the request to the business that runs your card.

You can also complain to:

• •UK: Information Commissioner's Office (ico.org.uk)
• •EU: your local data protection authority
• •Turkey: Kişisel Verileri Koruma Kurumu (kvkk.gov.tr)

14. International transfers

Data may be processed outside the UK, the EU or Turkey (for example, by our providers in the United States). When it is, we use legally approved safeguards such as standard contractual clauses or adequacy decisions.

15. Cookies

See our Cookie Policy.

16. Changes

If we make important changes, we will tell businesses by email at least 30 days in advance. The date at the top shows the latest version.