Privacy Policy

Last updated: 24 July 2026

1. Who we are

This Privacy Policy is issued by Qardly Ltd, a company incorporated in England and Wales ("Qardly", "we", "us", or "our").

Privacy contact: privacy@qardly.co.uk

We are registered with the Information Commissioner's Office (ICO) as required under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Scope and our two roles

Qardly operates a white-label loyalty card platform. We interact with two distinct groups of people, and our legal role differs depending on which group you belong to:

Who you are

Business admin

Loyalty card membe

Our role

Data controller

Data processor

What that means

We determine how and why your personal data (your name, email, account details) is processed. Sections 3–14 of this policy apply to you.

We process your personal data only on the documented instructions of the business whose loyalty programme you have joined. That business is the data controller for your data and must provide you with its own privacy notice. Section 3b and Section 4b of this policy explain what we process on the business's behalf.

3. Data we collect and why

3a. Business admin data (Qardly as controller)
When a business registers to use Qardly, we collect:

Business name and URL slug

Admin email address

Password

Account status and creation date

Subscription and billing information

to identify and configure your loyalty programme.

to authenticate you and send transactional emails (password resets, account notices).

stored as a one-way bcrypt hash; we cannot read your password

for account management and audit purposes.

to process your subscription payments. Payment card data is handled by our payment processor and is never stored on our servers.

3b. Loyalty member data (Qardly as processor, on the business's behalf)

When a member joins a loyalty programme hosted on Qardly, the business instructs us to store and process the following data on its behalf:

Name and email address

Phone number (optional)

Password

Points balance

QR code payload

Transaction history

Redemption history

Point adjustment history

Account status

to identify the member and enable login.

if provided at registration.

stored as a one-way bcrypt hash; we cannot read your password

lifetime points, and lifetime spend — to operate the loyalty scheme.

a unique string used to link the member's physical or digital QR code to their account.

date, description, points earned, transaction source (QR scan, manual entry).

points spent, timestamp, and a unique redemption code for each reward claimed.

manual adjustments made by the business admin, including reason and timestamp.

(active/inactive) and join date.

4. Lawful basis for processing

Processing activity

Managing your business admin account

Processing loyalty member data on the business's behalf

Sending transactional emails (password resets, account notices)

Fraud detection (monitoring point-adjustment patterns)

Retaining financial transaction records

Lawful basis (UK GDPR Article 6)

Article 6(1)(b) — performance of our contract with you

Article 6(1)(b) — performance of our contract with the business (as processor acting on the business's instructions)

Article 6(1)(b) — necessary to perform the service

Article 6(1)(f) — legitimate interests of Qardly and the business in preventing fraudulent activity

Article 6(1)(c) — compliance with legal obligations (7-year financial record retention)

5. Digital wallet passes

If a member requests an Apple Wallet or Google Wallet loyalty pass, Qardly generates a digital pass file containing the member's name and the business's branding (company name, colour, and logo). This file is transmitted to Apple Inc or Google LLC for delivery to the member's device. Apple and Google act as independent data processors under their own terms and privacy policies when delivering the pass.

6. How we share your data — sub-processors

We do not sell personal data. We share data only with the third-party processors listed below, who are engaged to operate the Qardly platform. Each is bound by a data processing agreement and processes data only as instructed.

Processor

Replit Inc

Google LLC

Apple Inc

Location

USA

Function

Cloud hosting, database infrastructure, and object storage (logos, images)

Transactional email delivery (via Gmail SMTP) and Google Wallet pass delivery

Apple Wallet pass delivery

Data received

All data stored on the platform

Email address, email content (for SMTP); member name and business branding (for Wallet passes)

Member name, business branding data contained in the pass file

7. International transfers

Replit Inc, Google LLC, and Apple Inc are based in the United States. Transfers of personal data to these processors are governed by the UK's International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses (SCCs), in accordance with Article 46 of the UK GDPR. These mechanisms provide appropriate safeguards for your personal data.

8. Data retention

Data category

Business admin account data

Loyalty member personal data

Transaction and redemption records (financial)

Password reset tokens

Retention period

Duration of the subscription + 30 days after termination (for offboarding and data export)

Deleted within 30 days of the business closing its account or requesting deletion of a member's data

7 years from the date of the transaction, as required by UK financial record-keeping obligations

1 hour (automatic expiry)

9. Cookies and browser storage

Qardly does not use tracking cookies, advertising pixels, analytics scripts, or session-recording tools.

We use the following browser storage for essential functionality only:

localStorage — stores your authentication token (JWT) so you remain signed in between browser sessions. This is strictly necessary and does not require your consent under the UK PECR.
sessionStorage — stores your business's URL slug within a single browser session to route you to the correct loyalty programme. Cleared automatically when you close the browser tab.

No personal data is stored in cookies. No third-party cookies are set by Qardly.

10. Security

We implement the following technical and organisational measures to protect personal data:

All passwords are stored as one-way bcrypt hashes and are never accessible to Qardly staff.
All data in transit is encrypted using TLS.
All data at rest is encrypted by our cloud infrastructure provider (Replit Inc).
Authentication tokens (JWTs) are signed with a secret key and expire after a fixed period.
Access to production systems is restricted to authorised personnel only.
Fraud detection monitoring flags unusual account activity automatically.

In the event of a personal data breach, we will notify the ICO within 72 hours where required, and will notify affected business admins without undue delay.

11. Your rights

Under the UK GDPR, you have the following rights regarding your personal data. To exercise any of these rights, please email privacy@qardly.co.uk. We will respond within 30 calendar days.

Right

Access (Article 15)

Rectification (Article 16)

Erasure (Article 17)

Portability (Article 20)

Restriction (Article 18)

Objection (Article 21)

What it means

Request a copy of the personal data we hold about you.

Ask us to correct inaccurate or incomplete data.

Ask us to delete your personal data, subject to our legal retention obligations.

Request your data in a structured, commonly used, machine-readable format.

Ask us to limit how we process your data in certain circumstances.

Object to processing based on legitimate interests (e.g. fraud detection).

Note for loyalty members: Because the business whose programme you joined is the data controller for your personal data, you should also contact that business directly to exercise your rights. Qardly will assist the business in responding to your request.

12. Children

Qardly's services are intended for individuals aged 18 or over. We do not knowingly collect personal data from anyone under 18. If we become aware that we have collected data from a person under 18 without verifiable parental consent, we will delete that data promptly. If you believe we hold data about a child, please contact us at privacy@qardly.co.uk.

13. Changes to this policy

We may update this Privacy Policy from time to time. For material changes, we will give you at least 30 days' notice before the change takes effect, by email or by a prominent notice on our platform. The "Last updated" date at the top of this page reflects the date of the most recent version.

14. Contact and complaints

For any questions about this Privacy Policy or to exercise your rights, contact us at: privacy@qardly.co.uk.

You have the right to lodge a complaint with the UK supervisory authority: Information Commissioner's Office (ICO)

Website: ico.org.uk
Helpline: 0303 123 1113