LOOPY LOYALTY PRIVACY POLICY
Last Updated: Dec 6, 2025.
Loopy Loyalty is a loyalty product operated by PassKit (together, “Loopy Loyalty”, “PassKit”, “we”, “us” or “our”).
We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains what we do with your information when you use our websites, products and services.
1. Privacy in plain English
This is the short version. For legal details, keep reading below.
Who we are
Loopy Loyalty is a PassKit brand. PassKit operates the Loopy Loyalty platform and is responsible for your personal data when you use our website and platform (except where we process data purely on behalf of our business customers – see below).
What we do
We provide digital stamp card and loyalty software to merchants.
We collect information such as your name, email, company details, account info, and usage data when you interact with us or use the platform.
We also collect technical data like IP address, device and browser information when you visit our sites and apps.
When we’re a controller vs. a processor
When you interact with us (e.g. visit our website, talk to sales, use the dashboard, attend webinars, etc.), we’re a data controller.
When our customers use Loopy Loyalty to issue passes to their own end-customers, we process that data on their behalf. In that context, we are a data processor/service provider, and our customers are responsible for their own privacy notices.
How we use your data
Mainly to:
provide and improve the Loopy Loyalty platform and other services,
manage your account and handle billing,
respond to your requests and provide support,
send you information and marketing (where allowed),
secure our systems and comply with the law.
Cookies & tracking
We use cookies and similar technologies to run the site, understand usage, and (where you consent) for analytics and marketing.
We use CookieYes to present our cookie banner and manage your preferences. You can change your cookie choices at any time via the “Cookie Settings” link on our site.
Who we share data with
We share information with:
our service providers (hosting, analytics, payment, support, marketing tools),
business partners (for joint events / content, where you’ve registered or shown interest),
affiliates in the PassKit group,
authorities or other parties when required by law or to protect our rights,
another organisation if we are involved in a merger, acquisition or similar transaction.
Where your data goes
We may process your information in the EEA, UK, US, Hong Kong, Thailand and other locations where we or our providers operate. Where required, we use legal safeguards such as Standard Contractual Clauses.
How long we keep it
Only for as long as needed for the purposes described here, and to meet our legal obligations. Then we delete or anonymise it.
Your rights
Depending on where you live (for example in the EEA/UK or certain US states), you may have rights to:
access, correct or delete your data,
object or restrict certain processing,
receive your data in a portable format,
opt out of marketing and certain cookies,
complain to a data protection authority.
You can contact us at privacy@loopyloyalty.com to exercise your rights.
Customer end-users
If you’re an end-customer of one of our merchants using Loopy Loyalty passes, please contact that merchant directly to manage your data. We’ll support them as needed.
That’s the overview. The rest of this document gives the full legal details.
2. Who we are and when this Privacy Policy applies
Loopy Loyalty is a loyalty product and brand operated by PassKit. When we refer to “Loopy Loyalty” or “PassKit” in this Privacy Policy, we are talking about the PassKit group company or companies that determine how and why your personal data is processed in connection with Loopy Loyalty.
This Privacy Policy applies when you interact with:
websites that link to this Privacy Policy (including https://loopyloyalty.com and https://app.loopyloyalty.com);
our demo stamp cards, mobile applications (including the Loopy Loyalty Stamper app), and any other software that links to this Privacy Policy;
our branded social media pages;
our offices, if you visit in person;
our communications with you (emails, calls, messages);
our events or webinars;
job applications you submit to us;
information you share in connection with a potential or existing business relationship; and
registration and use of the Loopy Loyalty platform as an authorised user (for example, as an employee of one of our customers).
In these situations, we usually act as a data controller (under GDPR/UK GDPR and similar laws).
When we act as a data processor/service provider
Our business customers use the Loopy Loyalty platform to run their own loyalty programmes and digital passes. In doing so, they may upload or collect Personal Information about their own customers (“Customer Data”).
For Customer Data, PassKit/Loopy Loyalty acts as a data processor (or “service provider”) on behalf of our customers. Our obligations and data protection commitments in that role are governed by our contract with the relevant customer (for example, our Terms and Conditions or other services agreement), not this Privacy Policy.
If you are an end-user of one of our customers and wish to exercise your privacy rights, please contact the relevant merchant or organisation directly. We will support our customer in responding as required.
Third-party websites and services
Our Services may link to third-party websites or services. We do not control these third parties and are not responsible for their privacy practices. We encourage you to review their privacy policies before providing any personal data to them.
3. Personal Information we collect
The information we collect depends on how you interact with us.
3.1 Information you provide directly
Site usage, forms and content downloads
When you visit our Sites, request a demo, sign up for updates, download content, or otherwise interact with forms, we may collect:
name and contact details (e.g. email address, phone number);
job title and role;
company name, industry and address;
country;
your preferences and how you engage with Loopy Loyalty content.
Events, meetings and webinars
If you register for or attend an event, meeting or webinar (in person or online), we may collect:
name, email address and other contact details;
job title and employer;
event registration details and attendance;
information from badge scans at in-person events (where we ask for your consent);
audio and/or video recordings if the event or meeting is recorded and you participate.
Communications and support
When you contact us (e.g. sales, support, job applications, social media, general enquiries), we may collect:
name and contact details;
job title and company;
marketing subscription status and communication preferences;
the content of your communications and any follow-up.
Account information (Loopy Loyalty platform)
When you create or use an account on the Loopy Loyalty platform, we may collect:
name and email address;
company name, industry and website;
login credentials and account settings;
IP address and related technical and usage data.
Surveys and feedback
If you participate in a survey or provide feedback, we may collect:
name and contact details;
job title and employer;
your responses, opinions and preferences.
Social media and community content
Any content you post on our blogs, forums or social media pages may be publicly visible. Please do not share information you would prefer to keep private.
Office visits
If you visit our offices, we may record:
your name and contact information;
company name;
time and date of arrival.
3.2 Information we receive from other sources
We may also collect information about you from:
publicly available sources (e.g. company sites, social media, public databases);
marketing partners and lead generation providers;
business partners (e.g. joint events or webinars).
We require such third parties to confirm that they have the right to share this information with us.
Billing and payments
If you are a business contact for one of our customers, our billing and payment providers (such as Stripe, Inc.) may share limited billing-related information with us, such as:
name and contact details;
company name and billing address;
payment reference data (e.g. tokenised card information, last four digits).
Stripe’s own terms and privacy notices apply to your payment method and transaction processing.
4. How and why we use Personal Information (legal bases)
We use your Personal Information for the purposes and on the legal bases below (under GDPR/UK GDPR, where applicable).
(a) Providing and administering the Services
We use your information to:
provide, operate and support the Loopy Loyalty platform and related services;
process orders, renewals and payments;
set up and administer user accounts;
provide customer and technical support;
respond to your requests and communications;
allow you to register for and participate in events and webinars;
manage our relationship with you and your organisation.
Legal bases:
Performance of a contract or taking steps prior to entering into a contract.
Our legitimate interests in operating our business and providing Services.
(b) Service operation, maintenance and security
We use your information to:
monitor and improve the performance and reliability of our Services;
troubleshoot issues and provide quality assurance;
prevent unauthorised access and maintain security;
detect and prevent fraud, misuse, or other harmful activity.
Legal bases:
Our legitimate interests in securing and maintaining our Services.
Compliance with legal obligations.
(c) Marketing and communications
We may use Personal Information to:
send you information about Loopy Loyalty and PassKit products, features, content and events;
personalise and optimise our marketing communications;
measure the effectiveness of campaigns and interactions.
We will only send electronic marketing where permitted by law and, where required, with your consent. You can withdraw consent or opt out at any time (see Section 10).
Legal bases:
Your consent (where required).
Our legitimate interests in promoting our products and services.
(d) Research, analytics and product development
We may use data (including aggregated or de-identified data) to:
analyse how our Services are used;
generate insights, industry or trend reports in anonymised form;
develop and improve our products, features and content.
Once data is anonymised so that it can no longer identify you, it is no longer personal data and we may use it for any lawful purpose.
Legal bases:
Our legitimate interests in improving and developing our Services.
Your consent where we rely on optional analytics/tracking technologies.
(e) Community and public content
If you choose to post reviews, comments or other content on our Sites or social media, we may publish and share that content in line with your settings and the platform’s terms.
Legal bases:
Your consent when you choose to publish content.
Our legitimate interests in engaging with our user community.
(f) Legal and compliance
We may use and share information as needed to:
comply with legal and regulatory obligations;
respond to lawful requests and legal processes;
enforce our contracts and policies;
protect our rights, property and safety, or those of others.
Legal bases:
Compliance with legal obligations.
Our legitimate interests in protecting our business and enforcing our rights.
5. Cookies, tracking technologies and usage data
We use cookies and similar technologies to help our Sites and apps work properly, to understand how they are used, and (where you consent) to support analytics and marketing.
5.1 What we collect automatically
As you use our Sites and Services, we and our partners may automatically collect:
IP address and approximate location;
device identifiers, browser type and settings, operating system;
pages viewed, links clicked, time spent, referring URLs;
interactions with our emails and marketing content;
device and app information (including manufacturer, model, app version, activation and update events).
5.2 Types of cookies we use
Essential cookies
Required for the website and platform to function (e.g. security, login sessions, basic features, live chat). These cannot usually be switched off without affecting core functionality.
Functional / performance cookies
Help us understand usage and performance, so we can improve our Sites and Services and provide more relevant communications.
Targeting / advertising cookies
Used by us and our partners to build a profile of your interests and show relevant ads on our Sites and on other websites.
We may also use SDKs and similar technologies in our apps. We use tools such as Google Analytics and Microsoft Clarity to better understand website usage.
5.3 CookieYes consent and your choices
We use CookieYes as our consent management platform (CMP) to present our cookie banner and allow you to control non-essential cookies.
You can:
set or change your cookie preferences via the “Cookie Settings” link (powered by CookieYes) on our Sites;
adjust your browser or device settings to block or delete cookies;
use opt-out tools offered by specific analytics or advertising providers.
Where required by law, we will not place non-essential cookies or similar technologies unless and until you have consented through CookieYes or similar tools.
Please note: blocking certain cookies may affect some features or functionalities of the Services.
5.4 Do Not Track
Some browsers offer a “Do Not Track” (DNT) signal. Our Sites do not currently respond to DNT signals.
6. How we share Personal Information
We share Personal Information only when necessary for the purposes described in this Privacy Policy.
6.1 Service providers
We use third-party service providers to help us operate and support our business and Services, including:
hosting, infrastructure, backup and storage;
analytics and measurement;
email, CRM and communication tools;
payment processing and billing;
customer support and helpdesk tools;
marketing and advertising platforms.
These providers are contractually required to use Personal Information only as instructed by us, to keep it secure, and not to use it for their own unrelated purposes.
6.2 Business partners
From time to time we may collaborate with other companies to offer joint products, services, webinars or events. If you register for or express interest in such a joint offering, we may share your Personal Information with the relevant partner. Their use of your Personal Information is governed by their own privacy policy.
You can avoid this sharing by not registering for joint events or by using any opt-out option provided.
6.3 Affiliates
We may share information with other companies within the PassKit group, for example for internal administration, support and to provide the Services.
6.4 Legal and protection purposes
We may disclose Personal Information when we reasonably believe it is necessary to:
comply with laws, regulations, court orders or other legal processes;
respond to lawful requests from public authorities (including for national security or law enforcement purposes);
enforce our terms, agreements or policies;
investigate and prevent suspected fraudulent or illegal activity;
protect the rights, property and safety of Loopy Loyalty, PassKit, our customers or others.
6.5 Business transfers
In the event of a proposed or actual merger, acquisition, financing, reorganisation, sale of assets, insolvency or similar transaction involving Loopy Loyalty/PassKit, Personal Information may be transferred to one or more third parties as part of that transaction, subject to appropriate protections.
7. International data transfers
We may process and store Personal Information in the European Economic Area (EEA), United Kingdom, United States, Hong Kong SAR, Thailand and in other countries where we or our service providers operate.
Some of these countries may not offer the same level of data protection as your home country. Where required by law, we implement appropriate safeguards, such as:
Standard Contractual Clauses approved by the European Commission;
adequacy decisions; or
your explicit consent for certain transfers.
For more information about these safeguards, you can contact us at privacy@loopyloyalty.com.
8. Security
We use appropriate technical, administrative and physical safeguards designed to protect Personal Information against unauthorised access, use, disclosure, alteration or destruction.
No system is completely secure. You are responsible for keeping your account credentials and passwords confidential. If you believe your account or data is no longer secure, please contact us immediately at privacy@loopyloyalty.com.
9. Data retention
We retain Personal Information only for as long as necessary to:
provide the Services;
meet the purposes described in this Privacy Policy;
comply with our legal, accounting and reporting obligations;
resolve disputes and enforce agreements.
When Personal Information is no longer needed, we will delete or anonymise it, or, where that is not possible (for example, due to backup systems), securely store it and isolate it from further processing until deletion is possible.
10. Your rights and choices
Your rights may vary depending on where you live, but in general you have the following options.
10.1 Marketing communications
You can opt out of marketing emails:
by clicking the “Unsubscribe” link in any marketing email; or
by contacting us at privacy@loopyloyalty.com.
We may still send you non-marketing messages that relate to your account or the Services (for example, security alerts, service announcements, changes to terms).
10.2 Cookies and online advertising
You can manage your cookie preferences using the CookieYes “Cookie Settings” link on our Sites, through your browser or device settings, and via industry opt-out tools (for example those provided by the Network Advertising Initiative or local equivalents).
Because these controls are browser- and device-specific, you will need to set them separately on each browser and device.
10.3 GDPR / UK GDPR rights (EEA & UK residents)
If you are located in the European Economic Area or the United Kingdom, you have the right (subject to certain conditions and exemptions) to:
request access to your Personal Information;
request correction of inaccurate or incomplete data;
request deletion of your data;
request restriction of processing;
object to processing based on our legitimate interests;
receive your data in a portable format (data portability);
withdraw consent at any time (where we rely on consent).
You also have the right to lodge a complaint with your local data protection authority.
To exercise any of these rights, please contact us at privacy@loopyloyalty.com.
10.4 US state-specific rights
Depending on your US state of residence, you may have additional rights. For example:
California (CCPA/CPRA): rights to know, access, delete, correct, and (where applicable) opt out of certain “sales” or “sharing” of personal information and to be free from discrimination for exercising these rights.
Colorado: rights to access, delete, correct, obtain a copy of your data, and opt out of certain types of processing.
Nevada: right to opt out of certain sales of personal information.
Virginia: rights to access, delete, correct, obtain a copy of your data and opt out of targeted advertising, certain sales and profiling.
We do not currently sell personal information as “sale” is defined under Nevada or California law, nor do we knowingly sell personal information of minors.
You can exercise US state privacy rights by emailing privacy@loopyloyalty.com with a subject line such as:
“California Data Rights Request”
“Colorado Data Rights Request”
“Nevada Do Not Sell Request”
“Virginia Data Rights Request”.
We will respond in accordance with applicable law.
10.5 Customer Data processed on behalf of merchants
If your Personal Information is processed within the Loopy Loyalty platform in our capacity as a processor on behalf of a merchant or other customer, please direct your rights request to that customer. We will support our customer in responding, as required under our agreement with them.
11. Children
Our Services are not directed to individuals under the age of 16, and we do not knowingly collect Personal Information from children under 16.
If you are a parent or guardian and believe your child has provided us with Personal Information without your consent, please contact us and we will take steps to delete such information.
12. Third-party sites and services
Our Services may include links or integrations with third-party websites, services and social media platforms (such as Facebook, LinkedIn, Twitter, Instagram, Vimeo, YouTube and others). These third parties may collect information about you, including via cookies or similar technologies.
Your use of these third-party services, and any information you provide to them, is governed by their own terms and privacy policies, not this Privacy Policy.
13. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by:
posting the updated Privacy Policy on our Sites; and/or
sending a notice via email or through the Services, where appropriate.
Please review this Privacy Policy periodically. Your continued use of the Services after changes take effect means you accept the updated Privacy Policy.
14. Contact us
If you have any questions about this Privacy Policy or our privacy practices, or if you wish to exercise your rights, please contact us at:
F.A.O. Loopy Loyalty Privacy Team
PassKit (Loopy Loyalty)
6E Golden Sun Centre
59–67 Bonham Strand West
Sheung Wan
Hong Kong SAR
Email: privacy@loopyloyalty.com