Privacy Policy
Last updated: 18 July 2026
In short
This page explains how your personal data is processed when you take part in the loyalty programme of the business you signed up with, through your digital loyalty card in Apple Wallet or Google Wallet. The business you signed up with is responsible for your data; Mon Carnet Client is the software provider that hosts and processes it on that business's behalf. Your earned rewards never expire, and you remain in control of your data at all times.
Who is responsible for your data
The data controller for your data is the business with which you signed up for the loyalty card: its name is shown on your loyalty card, on the sign-up page you used and at the point of sale. This business decides why and how your data is used. Mon Carnet Client, as the software provider, acts solely as a processor: it processes your data on the business's instructions and does not use it for its own purposes. For any question about your data, please contact the business first, in store or through its usual contact details; you can also write to contact@moncarnetclient.fr and your request will be passed on to the business.
What data is collected
When you sign up and take part in the programme, the following is collected: your first name, your last name, your date of birth, your preferred language, your loyalty balance (stamps, points or visits), and a record of your consents (acceptance of the terms and, where applicable, marketing consent) with their date, time and source. No email address or phone number is required to create your card.
Why your data is used
Your data is used to create and manage your digital loyalty card, count your stamps, points or visits and trigger your rewards, and, only if you have consented, send you the business's marketing communications. These marketing communications are delivered exclusively as push notifications on your Apple Wallet or Google Wallet card: since no email address or phone number is collected, you will never receive any message from the programme by email or SMS.
Legal basis
Managing your membership of the loyalty programme and granting your rewards rely on the performance of the contract (the programme terms) you accept when signing up. Sending marketing communications via wallet notifications relies exclusively on your consent (Article 6(1)(a) GDPR), obtained freely, specifically and without any pre-ticked box.
Your marketing consent
Consent to marketing communications is entirely optional: it is never ticked by default and is not a condition for enjoying the loyalty card. You can withdraw it at any time, without giving a reason and as easily as you gave it: via the unsubscribe link on your loyalty card or from the dedicated page provided to you. Withdrawing consent stops marketing notifications going forward, without affecting the stamps, points or rewards you have already earned.
How long your data is kept
Your data is kept for as long as your loyalty card is active, then for three (3) years after your last activity or the end of the programme. The record of your consents is kept for as long as needed to prove they were obtained, in line with CNIL recommendations. When you exercise your right to erasure, your identifying data (first name, last name, date of birth) is removed through anonymisation, as explained below.
Who has access to your data
Your data is accessible to the responsible business and its authorised staff. To provide the service, Mon Carnet Client relies on technical providers acting as sub-processors under contract: Cloudinary (hosting of your card images), Apple Wallet and Google Wallet (display and notifications of the card on your device), Stripe (billing of the business, with no access to your loyalty history), and a professional infrastructure provider hosting the PostgreSQL database. Your data is never sold. Some of these providers (in particular Apple, Google, Cloudinary and Stripe) are established in the United States: those transfers are covered by the European Commission's EU-US Data Privacy Framework adequacy decision and, where needed, its standard contractual clauses.
Your rights
Under the GDPR, you have the right to access your data, and to rectification, erasure, restriction, portability, as well as the right to object and the right to withdraw your marketing consent at any time. Your right to erasure is implemented through anonymisation: your identifying data (first name, last name, date of birth) is deleted and your account is frozen, while a non-identifying history (number of visits, rewards) may be kept in anonymous form for the business's statistics, without allowing you to be re-identified. You can trigger this erasure yourself from your card, via the dedicated erasure page provided to you, or ask the business to do it for you.
How to exercise your rights and contact us
To exercise your rights, contact the responsible business, in store or through its usual contact details, or use the features built into your card (marketing unsubscribe, account erasure). You can also write to contact@moncarnetclient.fr and your request will be passed on to the business. If you believe your rights are not being respected, you may lodge a complaint with the French data protection authority (CNIL), 3 Place de Fontenoy, 75007 Paris, France, www.cnil.fr.