Privacy Policy

We collect the following categories of personal data:

• Account data: name, email address, mobile number, password (stored in hashed form), profile preferences and country/region.
• Transaction data: payments, top-ups, cash wallet balances, loyalty stamps, points earned and redeemed, gift card purchases and redemptions, and the Merchants involved.
• Device and usage data: device identifiers, operating system, app version, IP address, approximate location derived from IP, in-app events, crash logs and diagnostic data.
• Location data: approximate or precise location, only where you grant the relevant permission, to show nearby Merchants.
• Communications: messages you send to our support team and your marketing preferences.

We do not store full card numbers. Card payments are processed by our regulated payment processors.

We use personal data to:

• create and manage your LoyLap account;
• process payments, top-ups, loyalty rewards, points, cash wallet balances and gift card transactions;
• show you Merchants, offers and reward balances relevant to your account;
• provide customer support and respond to your queries;
• detect, prevent and investigate fraud, abuse and security incidents;
• comply with legal, regulatory, accounting and anti-money-laundering obligations;
• send service messages (for example, transaction receipts and important account notices);
• where you have opted in, send marketing communications about LoyLap and Merchants; you can withdraw consent at any time;
• improve the Services through analytics and aggregated, non-identifying reporting.

Where GDPR or UK GDPR applies, we rely on the following legal bases:

• Contract: to provide the Services you have signed up for.
• Legal obligation: to meet tax, accounting, consumer protection and anti-money-laundering requirements.
• Legitimate interests: to secure the Services, prevent fraud, and improve product performance in a proportionate way.
• Consent: for optional marketing communications, precise location and certain cookies. You can withdraw consent at any time.

We share personal data only where necessary, including with:

• Merchants you transact with, so they can honour your purchase, reward, gift card or loyalty entitlement;
• Payment processors and acquirers that handle card payments, top-ups and payouts;
• Facilipay, our operating partner, which provides the underlying technology platform and merchant infrastructure;
• Cloud hosting, analytics and communications providers acting as our processors under written contracts;
• Professional advisers, auditors and regulators where legally required;
• Prospective or actual buyers in the context of a corporate transaction, subject to appropriate safeguards.

We do not sell your personal data.

Your data is primarily processed within the European Economic Area. Where data is transferred outside the EEA or UK, we rely on appropriate safeguards such as adequacy decisions or Standard Contractual Clauses together with any supplementary measures required by law.

We retain personal data only for as long as necessary for the purposes set out in this Policy, including to meet legal, regulatory, tax and accounting obligations, to resolve disputes and to enforce our agreements.

Transaction records are typically retained for a minimum of six years to meet financial and tax requirements. Account data is retained while your account is active and for a reasonable period after closure.

Subject to applicable law, you have the right to:

• access the personal data we hold about you;
• request correction of inaccurate or incomplete data;
• request deletion of your data where a legal basis applies;
• restrict or object to certain processing;
• request portability of data you have provided to us;
• withdraw consent where processing is based on consent;
• lodge a complaint with your local data protection authority; for Irish users this is the Data Protection Commission (dataprotection.ie).

To exercise any of these rights, contact us using the details in Section 11.

We use technical and organisational measures appropriate to the risk, including encryption in transit, access controls, hashed credentials, monitoring and vetted subprocessors. No system can be guaranteed 100% secure; please help us by using a strong password and keeping your device up to date.

Our website uses cookies and similar technologies for essential site functionality, preferences and, where you consent, analytics. You can manage your preferences through your browser or, where available, our in-app controls.

The Services are not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with data, please contact us and we will take appropriate steps to delete it.

For privacy questions, data requests or to withdraw consent, contact:

Smart Points Limited t/a LoyLap
Liberty Lane, Dublin 8, Ireland
Email: privacy@loylap.com

We may update this Policy from time to time. Material changes will be notified through the Services or by email. The "Effective Date" above indicates when this Policy was last updated.