The Reward Collection App

Personal data policy

Read the personal data policy for The Reward collection App (TRC) below.

To use the Reward Programme, you must accept the Personal Data Policy below.

Personal data policy, April 2023.

1. In general

1. This Personal Data Policy (hereinafter referred to as the “Policy”) applies to your use of the loyalty program. The loyalty program gives you as a user the opportunity to obtain Rewards (hereinafter referred to as "^vGBP") from the participating companies. The loyalty program is hereinafter referred to as "TRC App "(TRC).  TRC  is owned and operated by Enigmatic Smile Limited (hereinafter referred to as “SID”).
2. The personal data policy applies to all TRC channels, regardless of whether you access TRC  via the website or the app (hereinafter referred to as the “Platforms”).
3. Your personal data is processed in accordance with the Policy and applicable legislation.

2. Data controller

1. SID is responsible for the processing of your personal data.

SID’s address is: Enigmatic Smile, Swift House Ground Floor, 18 Hoffmanns Way, Chelmsford, Essex, England, CM1 1GU

3. Type of personal data processed and purpose of the processing.

1. Identification data and contact information
   When you create a user profile, you must enter your name, your e-mail address, your mobile phone number, a password and one or more payment cards (see more about our processing of card information in section 3.3).

1. Purpose and basis
   
   Personal information about you is processed to be able to identify you as a user, including to be able to contact you. The processing of this information is necessary for TRC  to be delivered to you, including to be able to invoice companies for your earned ^vGBP. This processing is necessary for the agreement with you as a user to be fulfilled. 

With your consent, your e-mail address and mobile phone number are also used for sending marketing material from TRC . 

2. Other general personal data
   
   SID may collect other general personal data if you enter this in your user profile on the Platforms. This could be for example, information about your date of birth, your age, number of people in your household, your gender, and your postcode. Entering such information is always optional for you.
   
   However, we can make an estimate of your gender and your postcode based on your entered name and your geographical location, if you have given consent to the collection thereof.

1. Purpose and basis
   
   This personal data is processed in order to carry out targeted marketing and offer you relevant opportunities to use TRC .

3. Payment card information
   
   SID processes information about your payment card number, expiry date and name of the cardholder. SID only collects this information when you add your card details. In the event that you wish to make a payment for an additional service, you must also enter the card's CVV/CVC. You may be asked to provide your CVV/CVC when registering your card. SID does not store your CVV/CVC, but uses this to authorize a specific payment or to authorize your card.
   
   Your payment card information is only processed in an IT environment that is certified according to the PCI (Payment Card Industry) rules.

1. Purpose and basis
   
   SID needs your card details in order to register which purchases you make where you are entitled to receive a vGBP reward. The processing is necessary to be able to fulfil the agreement with you. 

4. Payment information
   
   SID processes information about the purchases you make with a payment card registered to TRC. SID processes information about the time of purchase and the amount you purchased for. With your express consent, SID also processes information about where you made the payment. If you do not wish to notify SID of your consent, SID cannot provide the service to you. SID does not process information about what you have purchased, unless it is necessary for the purpose of calculating a Reward.

1. Purpose
   
   Your payment information is processed so that SID can calculate how much vGBP you are entitled to. This is necessary in order to fulfil the agreement with you. 
2. 
   With your consent, SID also uses information about your purchases for targeted marketing and to be able to offer you relevant opportunities to use TRC . 

5. Customer number
   
   SID processes your customer number in connection with payment of your vGBP Rewards. Some payment methods require you to provide your customer number with the company to which the payment is to be made, e.g. if you want to offset a payment with your vGBP. SID only collects this information when if you provide it in order to collect rewards.

1. Purpose and basis
   
   The purpose of the processing is that SID can allow you to use your vGBP in the manner that you have requested. For example, you may have asked that your vGBP be used for offsetting a bill or similar. 

6. Contact List

Where you opt to provide access in app, SID will processes your Contact list to check if anyone in your contact list already has an account with SID.

1. Purpose and basis
   
   The purpose of the processing this information is to make it easy for you to send rewards to other users within the app. In addition, it allows you to send an invite link to a person who is not already onboard.

7. Geographical location
   
   With your consent, we process information about your geographical location.

1. Purpose and basis
   
   The purpose of the processing is that TRC can target its marketing and show you companies (shops, restaurants, webshops, etc.) that offer vGBP near you. We may also use your geographic location to make an estimate of your current residence post code.

8. Targeted marketing / profiling

1. SID can carry out profiling in order to provide you with relevant offers and adapt our marketing to ensure that you receive the offers that are most likely to correspond to your personal interests and needs. The profiling does not mean that you are cut off from certain offers, products or services, but only aims to target the marketing as best as possible based on your personal interests. SID only sends direct marketing to e-mail if you have given consent to this. 

4. Disclosure of data

1. The personal data about you that SID processes will not be passed on to third parties without your consent, unless SID has another legal basis for the disclosure.
   
   SID passes on information about the amount spent, the vGBP added to your balance and the time of the transaction to the companies connected to TRC  in order to invoice for your vGBP. This processing is necessary for SID to fulfil its agreement with you. 

When you shop with a store, SID passes on information about your age, gender, postal code as well as the amount spent, the vGBP paid to you and the time of the transaction.

If you choose to "follow" a store on the Platforms, SID can pass on your first name, age, gender and postal code, the amount spent, the vGBP paid to you and the time of the transaction to the store and will update your news feed with targeted marketing. 

SID may also pass on your personal data to comply with the law, in connection with a legal process and to comply with requests from public authorities. 

2. SID receives transaction information based on your purchases from registered companies with registered payment cards, so that SID can calculate the vGBP due to you on your registered payment cards from payment providers. SID can exchange this information with SID's sub-suppliers with the aim of being able to identify and calculate vGBP for your purchases at registered companies (shops, restaurants, webshops, etc.). 

3. As a user, you consent to your payment card being registered for rewards and to your card number being passed on to payment providers connected to SID. You also consent to these companies processing information about where, when and for what amount you have spent using your card in order to calculate your vGBP. Information about what you have purchased will not be processed. 

4. We use the information we receive about your vGBP and collect from you to be able to create targeted marketing for you. In this connection, we pass on pseudonymised information to third parties for the purpose of optimizing our marketing efforts. 

5. SID also collaborates with a number of sub-suppliers/data processors in connection with our general operation of the company and the Platforms:

1. Enigmatic Smile Ltd, which calculates the vGBP, stores card data and other collected personal data and sends service messages to users.

6. SID has concluded data processing agreements with its data processors. The agreements determine the obligations that the data processor must comply with when it processes your personal data on our behalf. The data processor can thus only legally process information about you to fulfil the stated purposes.  

5. Storage

1. Personal data is not stored longer than is necessary to fulfil the purpose for which it was collected, unless the storage is necessary to meet national legal requirements, including statutory storage periods in connection with bookkeeping etc.

2. SID stores your personal data until you unsubscribe from the TRC, after which your personal data is either deleted or pseudonymised. If you revoke a consent, the personal data previously processed under the consent will be deleted or anonymised, unless we have another legal basis for continued processing.  

6. Rights
   
   When SID processes your personal data, you as a registered user have a number of rights. These personal data rights are listed below. If you wish to assert one or more of your rights, you are welcome to contact SID at any time.

1. Right to access: You have the right to access which personal data SID has registered about you.
2. Right to rectification: You have the right to have personal data that SID processes about you corrected if the personal data is incorrect or misleading.
3. Right to deletion: In certain cases, you have the right to delete personal data that SID processes about you.
4. Right to restriction: You have the right for SID to temporarily limit its processing of your personal data to storage only in certain cases. 
5. Right to data portability: In certain cases, you have the right to have personal data that you have provided to SID handed over in a structured, generally usable and machine-readable format.
6. Right to object: You have the right at any time, based on your particular situation or special reasons, to object to SID's processing of your personal data. You can also object to the processing of your information for direct marketing, including profiling. If your objection concerns the use of your personal data for direct marketing purposes, SID will stop such processing.

7. Right to complain: You have the right to complain about SID's processing of your personal data. Such a complaint can be submitted to us at any time.

7. Revocation of consent
   
   You can revoke one or more of your consents at any time by contacting SID, by deleting your profile or by changing your settings on the Platforms.
   
   If you revoke your consent, please note that in some cases you may not be able to use TRC .

8. Data processors and transfer of personal information outside the United kingdom

1. SID may transfer certain personal data to data processors in countries outside the United Kingdom. Transfer of personal data only takes place when a necessary basis for transfer has been secured in accordance with local Personal Data Regulations and where you have provided explicit consent.

9. Security and confidentiality

1. SID protects your personal data by implementing adequate technical and organizational security measures.
2. SID treats your personal data confidentially. Selected employees at SID and business partners are authorized to access data where necessary to solve usability or technical problems. All of SID's employees and business partners are subject to strict confidentiality requirements when processing personal data.

10. Access to complaints

1. If you wish to complain about our processing or storage of your personal data, please contact us at the points below 2.2 mentioned contact information.

11. Changes to the Policy

1. SID reserves the right to change the Policy at any time and without prior notice. Changes to the Policy come into force ten days after SID has informed you about changes to the Policy by contacting you at the email address you provided when creating your profile.

Personal data policy, April 2023.