Privacy policy

Loyalty Capital Sàrl-s ("Loyalty Capital", "we", "us") is a company registered in Luxembourg with its registered office at 126 Rue Pierre Gansen, 4570 Niederkorn, Luxembourg.

This policy covers two things:

• This website. We are the data controller for personal data processed through it.
• The mobile banking apps we build and operate for banks and other financial institutions ("your institution"). Your institution is the data controller for your banking data and decides how it is used. We process that data on its behalf, as its technology provider, and only on its instructions. Your institution's own privacy notice also applies to you.

Questions about this policy or about your personal data can be sent to privacy@loyaltycapital.tech.

• Data you provide. When you contact us through the enquiry form or by email, we receive your name, organisation, email address and the content of your message.
• Data collected automatically. Our hosting provider records standard server logs, including IP address, browser type, pages requested and timestamps, for security and operational purposes.

This website stores your display preference (light or dark theme) in your browser's local storage. This preference does not leave your device and is not used to identify you.

When you use the app, the following data is processed to provide the service:

• Sign-in details. Your login credentials are sent securely to verify your identity. After you sign in, a session token is kept in your device's secure storage so you stay signed in.
• Biometrics. If you turn on Face ID, Touch ID or fingerprint unlock, your device's operating system performs the check. Your biometric data never leaves your device and is never sent to us or to your institution.
• Phone number and verification codes. Your phone number is used to send one-time codes by SMS that confirm sensitive actions and verify your number.
• Account information. Balances, transactions and other account details are retrieved from your institution so that the app can show them to you.
• Photos. With your permission, you can take or select photos, for example of identity documents when opening an account, or an image for a group pool. Only the photos you choose are sent to your institution, and they are used only for that purpose. The app does not otherwise access your camera or photo library.
• Location. If you allow it, the app may use your approximate location to show nearby branches and ATMs. Your location is used on your device and is not stored by us.
• Preferences. Settings such as language and display theme are stored on your device.
• Technical data. When an error occurs, we record technical details about the request, the app version and the error so that we can keep the service reliable and secure.

Camera, photo library, location and biometric access are optional. You can grant or withdraw them at any time in your device's settings. The rest of the app keeps working without them.

The app does not currently use analytics or advertising services. If we introduce analytics to improve the app, we will update this policy before doing so and, where the law requires it, ask for your consent first. We do not use your data for advertising and we do not sell it.

• To respond to enquiries and correspond with you about our platforms and services.
• To provide the app's services on behalf of your institution.
• To operate, secure and maintain this website and the app, and to prevent fraud.
• To comply with legal obligations that apply to us.
• To establish, exercise or defend legal claims where necessary.

We do not sell personal data. We do not use personal data for automated decision-making or profiling.

For this website, we process personal data under Regulation (EU) 2016/679 (GDPR) on the following bases: our legitimate interests in responding to enquiries and keeping this website secure (Article 6(1)(f)); performance of, or steps prior to entering into, a contract with you or your organisation (Article 6(1)(b)); and compliance with legal obligations (Article 6(1)(c)).

For the app, we process personal data on your institution's instructions, under a data processing agreement (Article 28). Your institution relies on its own legal bases, typically the performance of its contract with you and its legal obligations, such as identity checks and anti-money-laundering rules.

App data is shared with your institution, which provides your accounts. We also share personal data with service providers who support the operation of this website, the app and our correspondence, such as hosting, email, SMS delivery and error-monitoring providers, under contracts that restrict their use of the data.

App data is hosted in the European Economic Area. Where a provider processes data outside the European Economic Area, we rely on an adequacy decision or appropriate safeguards such as the European Commission's standard contractual clauses.

We protect personal data with technical and organisational measures appropriate to banking systems, including encryption in transit, secure storage of session tokens on your device, role-based access controls and audit trails. More detail is available in our Trust centre.

We keep enquiry correspondence for as long as needed to handle the enquiry and any relationship that follows from it, and no longer than three years after our last contact unless a legal obligation or legal claim requires otherwise. Server logs are retained for a shorter, rolling period.

We keep app data for as long as your institution instructs us and as required by applicable banking and anti-money-laundering law, and then delete it. Data stored on your device is removed when you sign out or uninstall the app.

Subject to the conditions set out in the GDPR, you have the right to access your personal data, to have it rectified or erased, to restrict or object to its processing, and to receive it in a portable format. You may exercise these rights by writing to privacy@loyaltycapital.tech.

For app data, please contact your institution first, as it is responsible for your banking data. If you write to us instead, we will pass your request to your institution and help it respond.

You also have the right to lodge a complaint with a supervisory authority. In Luxembourg this is the Commission Nationale pour la Protection des Données (CNPD), 15 Boulevard du Jazz, L-4370 Belvaux, cnpd.lu.

This website and the app are not intended for children under 16, unless your institution's terms allow a younger person to hold an account. We do not knowingly collect personal data from children outside those terms.

We may update this policy from time to time. The date at the top of this page shows when it was last revised. Material changes will be highlighted on this page.