Privacy Policy
Effective date: October 29, 2026
In this list: Who we are and what this policy covers; Personal data we collect; How we use personal data and why; Cookies and similar technologies; Messages from My Loyalty+; Who receives personal data; International transfers; How long we keep personal data; Security; Age; Automated processing; Your choices and rights; Rights by region; Changes to this policy; Contact.
Who we are and what this policy covers
My Loyalty+™ is a free system that lets businesses offer promotions to their customers through QR codes. A customer scans a code, receives a voucher and uses it at the business, where a cashier validates it. My Loyalty+ is operated by Olivo Group LLC ("Olivo Group", "we", "us"). Olivo Group decides why and how the personal data described here is used. It is the controller of that data.
This policy covers:
- The website. Visitors to myloyaltyplus.com, including people who write to us through the contact form.
- The service. Customers who scan a My Loyalty+ QR code, receive vouchers or get messages from us, and the businesses that use My Loyalty+ and their staff.
Personal data is any information that identifies you or can reasonably be linked to you. This policy should be read with the Cookie Notice and the Terms of Service.
Personal data we collect
Contact form on the website
If you use the contact form, we collect:
- your name;
- your business name and type of business;
- your email address or WhatsApp number;
- the message you write, if you choose to write one (optional);
- a record that you ticked the consent box.
Do not put sensitive information or personal data about other people in the message.
The form is protected by Google reCAPTCHA Enterprise, which checks whether the request comes from a person or a bot. It loads when you use the form. To do this, Google receives technical data from your browser, such as your IP address and how your device interacts with the form. Google handles that data under its own privacy policy.
Website visits
- Technical data and server logs. When you visit the site, your device sends us your IP address, browser and device type, language setting, the page you asked for and the time of the request. We keep logs for security and to keep the site working.
- Analytics. If you accept the Analytics category, Google Analytics 4 collects information about how you use the site, such as pages viewed, approximate location and device type. It does not run until you accept. Advertising features of Google Analytics are not used.
- Language choice. If you accept the Personalization category, the site saves your language choice in your browser.
- Cookie choices. The site saves your cookie choices in a cookie so that it can respect them.
The service
When you use My Loyalty+ as a customer, we collect only what the service needs:
- Scan data. The QR code or short link you opened, which identifies the business, promotion and place where the code was shown, plus the date and time. The location of a scan is the location of the code, not of your device. We do not ask for your precise location.
- Technical data. IP address, browser and device type, language, the page that referred you, and security signals such as repeated requests from one source.
- Your details. Your contact detail (WhatsApp number, email address or mobile number), your name and your date of birth.
- Consent records. What you agreed to, when, which wording and version you saw, and through which channel.
- Verification data. The one-time code or claim link we send you, when it expires, whether it was used and whether the message was delivered. Codes and links are short-lived.
- Loyalty ID. A hashed, non-guessable key that links your contact details, vouchers and history so that you have one profile. A hashed ID is still personal data.
- Interest answers. Answers to optional questions about what you like. Answering is voluntary.
- Vouchers and redemption. The vouchers you receive and their status, when and where a voucher was used, what staff at the business record when they validate it (for example your name or code), and when you mark a voucher as used.
- Messages. Messages you send us, our replies, and your choices about receiving messages, including opt-outs.
We do not ask for government identification numbers, payment card numbers, passwords, health information or information about children.
Businesses and their staff
When a business signs up, we collect the contact person's name, work email or phone number, role, staff account details, the promotions the business sets up and records of staff validating vouchers. We use this to provide the service, support the business and meet our legal duties.
Other sources
Businesses may tell us what we need to run a promotion for you, for example that you used a voucher. Messaging and email providers tell us whether a message was delivered. We do not buy personal data lists to build profiles.
How we use personal data and why
Where we rely on consent, you can withdraw it at any time.
| Purpose | Data used | Basis |
|---|---|---|
| Answer contact form enquiries and discuss whether My Loyalty+ fits a business | Contact form data | Our legitimate interest in responding; steps before entering a contract |
| Protect the site and the form from abuse; keep security logs | Technical data, reCAPTCHA signals | Our legitimate interest in security |
| Measure how the site is used | Analytics data | Your consent |
| Remember your language choice | Language setting | Your consent |
| Remember your cookie choices | Consent cookie | Our legal obligation to respect your choices; legitimate interest |
| Create and maintain your profile; send one-time codes and claim links; issue and show vouchers | Your details, Loyalty ID, verification and voucher data | Performance of the contract (the Terms of Service); legitimate interest in securing accounts |
| Let a business confirm that a voucher is genuine and mark it as used | Voucher and redemption data, name or code | Performance of the contract; legitimate interest in accurate redemption |
| Prevent fraud and abuse, for example one active voucher per person | Contact details, Loyalty ID, voucher, scan and technical data | Our legitimate interest in preventing fraud |
| Confirm you meet the minimum age | Date of birth | Legitimate interest; legal obligation where it applies |
| Give businesses information about how their promotions perform and who they reached | Name, age range, interests, voucher and redemption data | Legitimate interest; your consent for interest answers |
| Ask optional interest questions and build an interest profile | Your answers | Your consent |
| Send you offers from My Loyalty+ | Contact detail, interests, voucher history | Your consent |
| Respond to your messages and privacy requests | Messages, identity checks | Legitimate interest; legal obligation |
| Improve the service, for example how many people finish the form | Technical, scan and voucher events | Legitimate interest; your consent for non-essential cookies |
| Comply with the law, handle legal claims and keep consent records | Relevant data | Legal obligation; legitimate interest |
| Create statistics that do not identify you | Data from the purposes above | Legitimate interest |
We do not use your data for decisions that have legal or similarly significant effects on you. If we want to use data for a new and materially different purpose, we will tell you and, where the law requires, ask for your consent first.
Cookies and similar technologies
The website uses a consent cookie, and, only if you agree, analytics cookies and a language setting. We do not use advertising cookies or advertising pixels. The categories, names and durations are in the Cookie Notice. You can change your choices at any time with the Manage cookies link in the footer of every page.
Messages from My Loyalty+
There are two kinds of messages.
- Service messages. One-time codes, claim links and your vouchers. You get them because you asked to claim a voucher.
- Offers. Offers from My Loyalty+ are sent only if you tick the optional box on the first-visit form (not pre-ticked) or otherwise agree, and only through the channels you gave us. You can receive a voucher without ticking it.
Offers may include promotions from participating businesses other than the one where you signed up. We choose them using your interests and voucher history and we send them ourselves. The business shown in an offer does not receive your contact details because we sent you that offer.
On WhatsApp, messages are sent through WhatsApp business messaging operated by Meta, which handles your phone number and message data under its own terms. SMS carriers may charge message and data rates. Message frequency varies.
To stop offers, reply STOP to a text or WhatsApp message, use the unsubscribe link in an email, or write to [email protected]. If you opt out of offers, we still send service messages you request, such as a one-time code. We keep a record of your consent and of your opt-out so that we respect it.
Who receives personal data
We do not sell your personal data. We do not share contact form data with anyone outside Olivo Group, except service providers that process it on our behalf. We share personal data only as described below.
Service providers
Providers act for Olivo Group under written terms and may use the data only to provide their service. They include:
- Google Workspace, which delivers contact form messages to us by email and sends the automatic acknowledgement;
- Google reCAPTCHA Enterprise, which protects the form against abuse;
- Google Analytics 4, which receives analytics data only after you accept the Analytics category;
- Cloudflare, which serves the site as a content network and security provider;
- hosting, storage, messaging and email delivery providers, including WhatsApp business messaging operated by Meta, for the service;
- professional advisers, such as lawyers, auditors and insurers.
The participating business whose promotion you used
The business that made an offer receives:
- confirmation that its voucher was issued, claimed or used;
- the name or code shown to its staff when it validates your voucher;
- periodic reports on how its promotions performed, which show the people reached by name with a short summary profile, such as an age range and interests.
The business does not receive your phone number, email address or other contact details through these reports. Olivo Group keeps them. We share your contact details with a business only if you ask us to, if you give a separate and specific consent, or if the law requires it. A business is responsible for how it uses what it receives and must follow the law.
Legal, safety and company changes
We may disclose data where the law or valid legal process requires it, to protect rights, safety and the security of the service, and in a merger, financing, sale or reorganization.
Aggregated data
We may share statistics that do not identify you. We do not try to re-identify them.
International transfers
Olivo Group is based in the United States and operates from there. Your personal data is processed and stored in the United States and in other countries where our providers operate. Those countries may have data protection laws that differ from the laws where you live. Where the law requires it, we use a recognized transfer mechanism, such as standard contractual clauses, or we rely on your consent. You can ask about these safeguards by writing to [email protected].
How long we keep personal data
We keep personal data only as long as needed for the purposes in this policy.
| Data | How long |
|---|---|
| Contact form enquiries | 24 months after the last contact |
| Cookie consent record | 182 days, then asked again |
| Analytics data | For a limited period set in the analytics tool |
| Server and security logs | As long as needed for security and diagnosis |
| Service profile, vouchers, redemption and consent records | While your profile is active, and afterwards as long as needed for disputes, accounting and legal duties; then deleted or anonymized |
| Interest answers | Until you withdraw consent or delete your profile |
| Opt-out records | Kept so that we do not contact you again |
We may keep data longer where the law requires it or where it is needed for legal claims.
Security
We use technical and organizational measures suited to the risk. They include a hashed Loyalty ID in place of your contact details as the account key, encryption of data in transit, short-lived one-time codes, single-use claim links, access limited to people and providers who need it, and logging. No system is completely secure. If a breach affects you, we will notify you and the authorities as the law requires.
Age
My Loyalty+ is for people who are at least 18 years old. We do not knowingly collect personal data from anyone younger. If you are younger than 18, do not use the service or send us your data. If we learn that we hold data from someone younger, we will delete it. A parent or guardian can write to [email protected].
Automated processing
We use automated tools to apply limits, such as one active voucher per person, and to stop issuing a voucher when a promotion's limit has been reached. If you agree to receive offers, we also use automated tools to choose offers based on your interests and voucher history. These tools do not make decisions with legal or similarly significant effects on you. If a limit stops you from getting a voucher and you think it is a mistake, write to [email protected] and a person will review it. You can object to profiling for offers at any time.
Your choices and rights
Depending on where you live, you may have the right to:
- know whether we process your data and get a copy;
- correct inaccurate data;
- delete your data;
- restrict or object to processing, including profiling and direct marketing;
- withdraw consent at any time;
- receive your data in a portable format;
- opt out of the sale or sharing of personal data and of targeted advertising (we do neither);
- not be treated unfairly for using your rights;
- ask for a person to review an automated decision;
- complain to a data protection authority.
How to use your rights. Write to [email protected]. To protect you, we confirm your identity before we act on a request. For service profiles, this is usually done with a one-time code sent to the contact detail linked to the profile. You may use an authorized agent where the law allows. We reply within the time set by the law that applies to you. If we cannot act on a request, we tell you why, and you can appeal by replying to our message.
Quick choices.
- Cookies: use Manage cookies in the footer.
- Offers: reply STOP, use the unsubscribe link, or write to us.
- "I used this" links: each voucher can include a one-tap link that marks the voucher as used. It records only that the voucher was used. Anyone who has the link can mark that voucher as used, so do not forward it.
- Delete your profile: write to [email protected]. Deleting a profile ends access to its wallet and vouchers.
Please give accurate information and keep your contact channel secure. If your phone number is reassigned or your email is compromised, tell us so that we can protect your profile.
Rights by region
European Economic Area, United Kingdom and Switzerland. The controller is Olivo Group LLC. The legal bases are in the table above. You have the rights listed above, including the right to object to processing based on legitimate interests and to direct marketing, and the right to complain to your local data protection authority.
California and other US states. In the past 12 months we may have collected these categories: identifiers (name, contact details, Loyalty ID, IP address); commercial information (vouchers and their use); internet or network activity (site, scan and click data); inferences (interests); and age. We collect them from you, your device, participating businesses and our service providers, and disclose them for business purposes only to the service providers listed above. We do not sell personal information and we do not share it for cross-context behavioral advertising. You may ask to know, access, correct or delete your personal information, and you will not be treated unfairly for doing so. You may appeal a denial where state law gives that right. Use the contact below.
Brazil and other Latin American countries. Where local law applies, you have the rights it gives you, such as confirmation of processing, access, correction, deletion, portability, information about sharing, withdrawal of consent and review of automated decisions. You may also complain to your national authority, for example the Autoridade Nacional de Proteção de Dados in Brazil.
Changes to this policy
We may update this policy. The new version is posted with a new effective date. If a change is material, we tell you through the service or the contact channel you gave us and, where the law requires, ask for your consent again. This policy is also available in Spanish. If the versions differ, the English version applies, except where local law requires otherwise.
Contact
Privacy questions and requests: [email protected]
Related pages: Terms of Service and Cookie Notice.