Privacy

1. Controller

The controller is Punkted, –, email: –.

2. What we process

Your card has a random card number; without confirmation we know no name and no email address. We store your visits to partners (partner, time, receipt amount, staff login), your points history, wheel spins and prizes, referrals and your marketing consent.

With a confirmed email address we store it. If you allow it, we store your browser's or phone's identifier for notifications. When you use the pages we process technically necessary data (IP address, browser identifier, time) to run the service, keep you signed in and prevent misuse. We only set technically necessary cookies.

3. Purposes and legal bases

We process the data to provide the loyalty programme: points, rewards, the wheel, referrals and settlement with partners (Art. 6(1)(b) GDPR). Misuse detection and security rest on our legitimate interest (point f). We send marketing messages only with your consent (point a), at most once a week; you can withdraw it in the app at any time. We keep settlement records because the law requires it (point c).

4. Recipients

At a visit, partners only see the end of the card number, the points balance and the visit itself, not your email address. We use service providers for hosting in the EU, sending email and payments with partners. If you add the card to Apple Wallet or Google Wallet or allow notifications, data is passed to Apple, Google or your browser's push service or Expo for that purpose.

5. How long we keep data

We keep the data as long as your card is used. On request we delete your email address, consents and device identifiers; the points history is kept without personal reference where we need it for settlement with partners. Settlement records are kept for up to ten years.

6. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection, and the right to withdraw consent. Write to –. You can also complain to a data protection supervisory authority. There is no automated individual decision-making; the wheel draw is random.