Privacy policy

1. Who is responsible

Each participating business is the data controller for its own loyalty members. Stekki acts as a data processor on their behalf. If you choose to sign in with an email code, Stekki also keeps an optional stekki account (your name, email and sign-in sessions) so you can open all your cards in one place; businesses cannot see this account or your other businesses. [DRAFT — requires legal review: controller role for the optional account, DPA reference, contact and DPO details to be completed.]

2. What we collect

First name, optional last name, email and/or mobile number, language, consent choices (including which wording you saw and when), and loyalty activity (stamps, points, rewards, visit dates, location). A business may add private notes about you; these are included when you download your data. If you add a card to Apple Wallet, your device’s pass registration is stored so the pass can update. We do not collect payment card data for loyalty cards.

3. Why

To operate your loyalty card (contract), to send offers only if you opted in (consent, withdrawable at any time), and to keep security and audit records (legitimate interest / legal obligation). [Retention periods to be completed per business.]

4. Your rights

After signing in with your email, Settings lets you download a copy of your data, turn offers from each business on or off, delete your data at any business (this happens immediately: your name and contact details are removed, the card stops working and unused rewards are cancelled; visit history is kept without personal details so the business’s records add up), and delete your optional stekki account. Every welcome email has a link to stop offers or, if you didn’t sign up, remove the details. You can also ask the business at the counter, or contact Stekki at support@getstekki.com, and we will handle erasure for you. You may lodge a complaint with the Office of the Commissioner for Personal Data Protection (Cyprus).

5. Sharing

Your data is never shared between unrelated businesses: each business sees only its own membership, even when you use one stekki account. Wallet providers (Apple, Google) receive only the content shown on the pass. Services that process data for us: our email delivery provider (sign-in codes and card emails), Apple Push Notification service (pass updates), and the sign-in providers businesses use for their staff accounts. [DRAFT — provider names, locations and transfer safeguards to be completed with legal review.]