Privacy Policy
Last updated: [DATE]
In short
This page explains how your personal data is processed when you take part in the loyalty programme of [BUSINESS LEGAL NAME], through your digital loyalty card in Apple Wallet or Google Wallet. The business you signed up with is responsible for your data; Mon Carnet Client is the software provider that hosts and processes it on that business's behalf. Your earned rewards never expire, and you remain in control of your data at all times.
Who is responsible for your data
The data controller for your data is the business with which you signed up for the loyalty card, namely [BUSINESS LEGAL NAME], [LEGAL FORM], registered under number [SIREN], with its registered office at [REGISTERED OFFICE ADDRESS]. This business decides why and how your data is used. Mon Carnet Client, as the software provider, acts solely as a processor: it processes your data on the business's instructions and does not use it for its own purposes. For any question about your data, please contact the business first at [BUSINESS CONTACT EMAIL].
What data is collected
When you sign up and take part in the programme, the following is collected: your first name, your last name, your date of birth, your preferred language, your loyalty balance (stamps, points or visits), and a record of your consents (acceptance of the terms and, where applicable, marketing consent) with their date, time and source. No email address or phone number is required to create your card.
Why your data is used
Your data is used to create and manage your digital loyalty card, count your stamps, points or visits and trigger your rewards, send you emails strictly necessary for the service to work (invitation to add your card to the wallet, email verification, review requests, and other administrative messages), and, only if you have consented, send you the business's marketing communications. These marketing communications are delivered exclusively as push notifications on your Apple Wallet or Google Wallet card: you will never receive marketing by email or SMS.
Legal basis
Managing your membership of the loyalty programme and granting your rewards rely on the performance of the contract (the programme terms) you accept when signing up. Sending marketing communications via wallet notifications relies exclusively on your consent (Article 6(1)(a) GDPR), obtained freely, specifically and without any pre-ticked box. Strictly transactional emails rely on the business's legitimate interest in operating the service you requested.
Your marketing consent
Consent to marketing communications is entirely optional: it is never ticked by default and is not a condition for enjoying the loyalty card. You can withdraw it at any time, without giving a reason and as easily as you gave it: via the unsubscribe link on your loyalty card, from the dedicated page provided to you, or by replying to the welcome email. Withdrawing consent stops marketing notifications going forward, without affecting the stamps, points or rewards you have already earned.
How long your data is kept
Your data is kept for as long as your loyalty card is active, then for [RETENTION PERIODS] after your last activity or the end of the programme. The record of your consents is kept for as long as needed to prove they were obtained, in line with CNIL recommendations. When you exercise your right to erasure, your identifying data (name, email, phone) is removed through anonymisation, as explained below.
Who has access to your data
Your data is accessible to the responsible business and its authorised staff. To provide the service, Mon Carnet Client relies on technical providers acting as sub-processors under contract: a transactional email provider, Cloudinary (hosting of your card images), Apple Wallet and Google Wallet (display and notifications of the card on your device), Stripe (billing of the business, with no access to your loyalty history), and a PostgreSQL database host, [HOSTING PROVIDER]. Your data is never sold. Some of these providers may process data outside the European Union; in that case, appropriate safeguards (for example the European Commission's standard contractual clauses) are put in place [NON-EU TRANSFERS TO CONFIRM].
Your rights
Under the GDPR, you have the right to access your data, and to rectification, erasure, restriction, portability, as well as the right to object and the right to withdraw your marketing consent at any time. Your right to erasure is implemented through anonymisation: your identifying data (name, email, phone) is deleted and your account is frozen, while a non-identifying history (number of visits, rewards) may be kept in anonymous form for the business's statistics, without allowing you to be re-identified. You can trigger this erasure yourself from your card, via the dedicated erasure page provided to you, or ask the business to do it for you.
How to exercise your rights and contact us
To exercise your rights, send your request to the responsible business at [BUSINESS CONTACT EMAIL], or use the features built into your card (marketing unsubscribe, account erasure). Where applicable, you may contact the data protection officer at [DPO/CONTACT EMAIL]. If you believe your rights are not being respected, you may lodge a complaint with the French data protection authority (CNIL), 3 Place de Fontenoy, 75007 Paris, France, www.cnil.fr.