top of page

Business Terms of Service

Last updated: 6th August 2026

This agreement is between Qardly Ltd (the "Operator") and the entity or individual who registers a business account on the Qardly platform (the "Customer").

​

1. Definitions

  • "Operator" means Qardly Ltd, a company incorporated in England and Wales.

  • "Customer" means the business or individual who registers to use the platform and accepts these Terms.

  • "Platform" means the Qardly loyalty card software, including the admin dashboard, member portal, API, and associated services.

  • "Members" means the loyalty card holders enrolled in the Customer's programme via the Platform.

  • "Member Data" means personal data relating to Members that is processed by the Operator on the Customer's behalf.

  • "Subscription" means the Customer's paid access to the Platform under the pricing plan selected at sign-up.


2. Service description

Qardly provides a white-label digital loyalty card platform that enables the Customer to:

  • Enrol Members and manage their accounts via a web-based admin dashboard.

  • Award loyalty points via QR code scanning or manual adjustment.

  • Allow Members to redeem points for rewards defined by the Customer.

  • Issue Members with digital loyalty passes for Apple Wallet and Google Wallet.

  • Monitor loyalty programme analytics and fraud-detection alerts.

  • Export member, transaction, and redemption data as CSV files.


The Operator provides the Platform on an "as-is" basis and does not guarantee continuous, uninterrupted availability. The Platform is not intended for use in regulated industries (e.g. financial services, healthcare) where separate regulatory compliance obligations apply.

 

3. Account registration and eligibility

  • The Customer must provide accurate, current, and complete information at registration and keep it updated.

  • The Customer is responsible for all activity on their account, including activity by any staff or agents who use the admin dashboard.

  • Each business may hold one account. Creating multiple accounts to circumvent subscription limits is prohibited.

  • The Customer must be a business entity or a person of at least 18 years of age contracting in a business capacity.

 

4. Subscriptions and payment

  • Billing. Subscriptions are billed in advance on a monthly or annual cycle, as selected after your trial period. All amounts are in GBP and inclusive of VAT (where charged) unless stated otherwise.

  • Auto-renewal. Subscriptions renew automatically at the end of each billing period. The Operator will notify the Customer at least 30 days before any price change takes effect.

  • Cancellation. The Customer may cancel their subscription at any time via the platform or by emailing privacy@qardly.co.uk. Cancellation takes effect at the end of the then-current billing period. No refund is issued for the unused portion of a prepaid period.

  • Non-payment. If a payment fails and is not resolved within 7 days, the Operator may suspend the Customer's account until payment is made.

  • Refunds. Except where required by law, subscription fees are non-refundable.

  • Price guarantee: Qardly Ltd will not increase your subscription price more than the UK Retail Price Index for the duration of your contract.


5. Acceptable use

The Customer agrees not to:

 

  • Use the Platform for any unlawful purpose or in violation of applicable law.

  • Enrol Members without obtaining any required consents under applicable data protection law.

  • Reverse-engineer, decompile, or copy any part of the Platform.

  • Attempt to gain unauthorised access to other customers' data or systems.

  • Use the Platform to send unsolicited commercial communications (spam).

  • Manipulate point balances or fabricate transactions for personal gain.

  • Resell or sublicense access to the Platform to third parties without the Operator's prior written consent.


6. Customer responsibilities for Member data

The Customer is the data controller for all Member Data. The Customer warrants that it will:

 

  • Have a valid lawful basis under UK GDPR Article 6 for collecting and processing Member Data before enrolling any Member.

  • Provide Members with a clear and accessible privacy notice that describes how their data will be used, including that Qardly Ltd processes it on the Customer's behalf.

  • Respond to data subject rights requests (access, erasure, etc.) from Members within statutory timeframes, and notify the Operator promptly of any such requests that require the Operator's assistance.

  • Not instruct the Operator to process Member Data in a way that would violate applicable law.


7. Data Processing Agreement (UK GDPR Article 28)

This section constitutes the Data Processing Agreement ("DPA") between the Customer (controller) and Qardly Ltd (processor) for the processing of Member Data, as required by Article 28 of the UK GDPR.


7.1 Subject matter and purpose

The Operator processes Member Data solely to provide the loyalty card platform services described in Section 2 of these Terms, on the documented instructions of the Customer.


7.2 Nature of processing

Storage, retrieval, display, updating, export (CSV), deletion of Member Data; generation of Apple Wallet and Google Wallet pass files; fraud-pattern analysis.


7.3 Types of personal data and data subjects

Personal data as described in Section 3b of the Qardly Privacy Policy, relating to the Customer's Members (loyalty card holders).


7.4 Duration

For the duration of the Customer's subscription, plus up to 30 days after termination for data deletion (except financial records retained for 7 years under legal obligation).


7.5 Processor obligations

The Operator will:

 

  • Process only on instruction. Process Member Data only on documented instructions from the Customer, except where required to do so by applicable law.

  • Confidentiality. Ensure that persons authorised to process Member Data are bound by confidentiality obligations.

  • Security. Implement appropriate technical and organisational security measures as described in Section 10 of the Privacy Policy and Article 32 of the UK GDPR.

  • Sub-processors. Not engage a new sub-processor without giving the Customer at least 30 days' prior notice. The Customer may object to a new sub-processor within that period; if the objection cannot be resolved, either party may terminate the affected services on written notice. Current sub-processors are listed in the Qardly Privacy Policy.

  • Data subject rights. Assist the Customer in responding to data subject rights requests, by providing reasonable technical and organisational measures.

  • Breach notification. Notify the Customer without undue delay (and in any event within 48 hours of becoming aware) of any personal data breach affecting Member Data.

  • Data Protection Impact Assessments. Provide reasonable assistance to the Customer where required to conduct a DPIA.

  • Deletion or return. On termination of the agreement, delete or return all Member Data within 30 days, at the Customer's choice, unless applicable law requires continued storage.

  • Audit rights. Make available to the Customer all information reasonably necessary to demonstrate compliance with this DPA, and permit audits conducted by the Customer (or a third-party auditor) on reasonable written notice, subject to confidentiality obligations.

 

8. Intellectual property

The Operator owns all intellectual property rights in the Platform, including the software, design, trade marks, and documentation. Nothing in these Terms grants the Customer any ownership rights in the Platform. The Customer retains all intellectual property rights in its own brand assets (logo, colours, company name) uploaded to the Platform.


9. Confidentiality

Each party agrees to keep the other's confidential information (including pricing, technical details, and business data) strictly confidential and not to disclose it to any third party without prior written consent, except as required by law. This obligation survives termination of these Terms for 3 years.


10. Warranties and disclaimers

The Operator warrants that it will provide the Platform with reasonable skill and care. To the fullest extent permitted by law, the Operator excludes all other warranties, conditions, and representations, express or implied, including implied warranties of fitness for a particular purpose, merchantability, and non-infringement. The Platform is provided without any uptime guarantee unless a separate Service Level Agreement has been agreed in writing.


11. Limitation of liability

Neither party shall be liable to the other for any indirect, incidental, special, consequential, or punitive loss or damage (including loss of profits, loss of data, or loss of goodwill) arising out of or in connection with these Terms, whether in contract, tort (including negligence), or otherwise, even if advised of the possibility of such loss.

Subject to the exclusions below, the Operator's total aggregate liability arising out of or in connection with these Terms shall not exceed the total fees paid by the Customer in the 12 months immediately preceding the event giving rise to the claim.

Nothing in these Terms limits or excludes liability for: (a) death or personal injury caused by negligence; (b) fraud or fraudulent misrepresentation; or (c) any other liability that cannot be excluded or limited by law.


12. Indemnification

The Customer agrees to indemnify, defend, and hold harmless Qardly Ltd and its officers, directors, and employees from and against any claims, damages, or costs (including reasonable legal fees) arising from: (a) the Customer's breach of these Terms; (b) the Customer's failure to comply with applicable data protection law in relation to Member Data; or (c) the Customer's loyalty programme rules or reward fulfilment obligations.


13. Term and termination

These Terms commence on the date the Customer creates an account and continue until the Subscription is terminated. Either party may terminate immediately by written notice if the other party: (a) commits a material breach and fails to remedy it within 30 days of written notice; or (b) becomes insolvent, enters administration, or ceases to trade.

On termination, the Customer's access to the Platform will cease at the end of the then-current billing period. The Operator will delete all Member Data within 30 days of termination, unless the Customer requests export beforehand. Financial records are retained for 7 years as required by law.


14. Governing law and jurisdiction

These Terms and any dispute or claim arising out of or in connection with them (including non-contractual disputes) are governed by the laws of England and Wales. The parties submit to the exclusive jurisdiction of the courts of England and Wales.


15. General

  • Entire agreement. These Terms (including the DPA in Section 7 and the Privacy Policy incorporated by reference) constitute the entire agreement between the parties and supersede all prior agreements.

  • Amendments. The Operator may amend these Terms by giving at least 30 days' written notice. Continued use of the Platform after that period constitutes acceptance.

  • Severability. If any provision is found unenforceable, the remaining provisions continue in full force.

  • Waiver. Failure to enforce any right is not a waiver of that right.

  • Assignment. The Customer may not assign these Terms without the Operator's prior written consent. The Operator may assign these Terms in connection with a merger, acquisition, or sale of all or substantially all of its assets.

  • Notices. Legal notices to the Operator should be sent to: privacy@qardly.co.uk.

bottom of page