This is a courtesy translation. Only the French version of this policy is legally binding.
1. Who is responsible for processing the data?
This Privacy Policy explains how Fydl collects and uses the personal data of the Users of its services.
The Fydl service is published by:
Digital Sphere, SASU with a share capital of 500 euros
Registered with the RCS of Paris (the Paris Trade and Companies Register) under number 832 790 455
Registered office: 128 rue La Boétie, 75008 Paris, France
Website: https://www.fydl-app.com
Contact: contact@fydl-app.com
Digital Sphere is the data controller for the processing operations necessary for the operation of Fydl, in particular the creation of accounts, access to the service, the technical management of the application, billing, security and support.
Where a Merchant uses Fydl to manage its loyalty programme, its Customers, its campaigns or its content, it remains responsible for the information, offers, communications and settings that it distributes via Fydl.
2. Who is this Policy intended for?
This Policy is intended for all Users of Fydl, in particular:
- Customers who join a Loyalty Card or who use Fydl;
- Merchants who create or manage a Loyalty Card;
- team members added by a Merchant;
- persons who contact Fydl or who use the Fydl webapp, application, website or compatible media.
3. What data is collected?
Fydl collects only the data necessary for the operation of the service.
Customer data
Fydl may collect, in particular:
- telephone number;
- SMS verification code or status;
- surname, first name, date of birth and email address where that information is requested in order to continue using the service;
- Loyalty Cards joined;
- Points, Rewards, visits, loyalty history and actions carried out;
- QR code, technical identifiers, wallet medium or access link;
- preferences and consents relating to SMS messages and push notifications;
- data relating to support requests;
- technical data necessary for the operation and the security of the service.
Merchant data
Fydl may collect, in particular:
- surname, first name, email, telephone number;
- business information, activity, addresses and points of sale;
- billing information;
- roles and team members;
- settings of the Loyalty Cards, Rewards, campaigns, news items, referrals and activated modules;
- usage data for the free and paid Services;
- payment history, top-ups, usage and invoices;
- data relating to support requests.
Data relating to till integrations
Where the Merchant activates an integration with till software or a third-party service, Fydl may process certain data necessary for the operation of the integration, depending on the partner concerned: order identifier, date, amount, point of sale, products, visit information or any other data useful for the allocation of Points or for the operation of the loyalty programme.
4. Why is this data used?
The data is used for the following purposes:
| Purpose | Examples of use | Legal basis |
|---|---|---|
| Creation and management of the Account | registration, login, verification of the number, access to the app or webapp | performance of the service |
| Management of the Loyalty Cards | linking to a business, Points, Rewards, history | performance of the service |
| Management of Merchants | creation of cards, points of sale, members, settings | performance of the service |
| Paid Services and billing | subscription, options, purse, invoices, payments | performance of the contract and legal obligations |
| Commercial SMS campaigns | sending SMS messages on behalf of a business | the Customer’s consent |
| Commercial push notifications | news, offers or information sent by a business | the Customer’s consent or settings |
| Support and complaints | responding to requests, monitoring of exchanges | performance of the service or legitimate interests |
| Security and prevention of misuse | detection of anomalies, fraud, abusive use, protection of the service | legitimate interests |
| Improvement of the service | usage statistics, correction of errors, improvement of the features | legitimate interests |
| Compliance with legal obligations | accounting, billing, requests from the authorities | legal obligation |
5. SMS communications and push notifications
The verification SMS messages sent at the time of registration or login are technical messages necessary for the operation of the service.
Commercial SMS messages sent on behalf of a Merchant are sent only to Customers who have given their agreement for the business concerned.
Each Customer may unsubscribe from a Merchant’s commercial SMS messages, in particular by means of the unsubscribe mechanism provided in the messages. The unsubscription applies to the business concerned.
Commercial push notifications may be disabled by the Customer from within Fydl, where the feature is available, or from the settings of their device.
Fydl retains the information necessary to evidence consent, refusal or unsubscription.
6. Who can access the data?
Personal data may be accessible only to the persons and bodies who need it in order to operate Fydl.
Depending on the case, the data may be accessible:
- to Fydl and to the authorised members of its team;
- to the Merchant concerned, only for the Customers linked to its Loyalty Card;
- to the team members added by the Merchant, according to their access rights;
- to the technical service providers necessary for the operation of Fydl, in particular for hosting, the sending of SMS messages, push notifications, payment, billing, maintenance and security;
- to the technical services or partners activated by the Merchant or necessary for certain features, in particular in the case of a till integration, a wallet medium, a card or the completion of a merchant profile;
- to the administrative or judicial authorities where the law so requires.
Fydl does not sell Users’ personal data.
7. How long is the data retained?
Fydl retains personal data only for the period necessary for the purposes for which it is used.
The data relating to the Customer Account is retained for the period during which the Account is used, then deleted or anonymised if the Account is deleted, save for temporary retention necessary in order to comply with a legal obligation, ensure the security of the service or preserve evidence of a right.
The data relating to the Loyalty Cards, Points, Rewards and histories is retained for as long as the Customer Account or the Loyalty Card concerned is active, save for deletion, anonymisation or discontinuation of the Loyalty Card by the Merchant.
The data relating to SMS consents, push notifications, refusals or unsubscriptions is retained for the period necessary in order to comply with the User’s choices and to keep evidence of those choices.
The data relating to Merchant Accounts, to the paid Services, payments, top-ups, usage and invoices is retained for the period necessary for the management of the commercial relationship, then archived where this is necessary in order to comply with the applicable accounting, tax or legal obligations.
Support data is retained for the period necessary to handle the request, and may then be archived temporarily where evidence or follow-up is required.
Technical and security data is retained for a limited period, necessary for the proper operation of the service, the diagnosis of incidents, security and the prevention of misuse.
Where the data is no longer necessary, it is deleted, anonymised or archived where the law so requires.
8. Data imported, transmitted or retrieved for a Merchant
A Merchant may ask Fydl to import or process certain customer data in order to set up or use its loyalty programme.
In that case, the Merchant warrants that it holds the rights necessary to transmit that data to Fydl and to use it within the framework of its loyalty programme.
Fydl may also allow the Merchant to retrieve or complete certain information relating to its establishment where that feature is used.
Fydl may refuse or suspend an import or a processing operation that is manifestly unlawful, abusive or contrary to these terms.
9. Service providers and third-party services
In order to provide its services, Fydl may use technical service providers necessary for the operation of the application, of the webapp and of the associated services.
Those service providers may act in particular in respect of hosting, the sending of SMS messages, push notifications, payment, billing, wallet media, addresses or the technical integrations activated by the Merchant.
Fydl limits those service providers’ access to the data necessary for their task.
Where certain service providers process data outside the European Union, Fydl ensures that such transfers are governed in accordance with the applicable regulations.
Fydl may change its service providers according to its technical needs, subject to maintaining a level of protection compliant with the applicable regulations.
10. Data security
Fydl implements reasonable technical and organisational measures in order to protect personal data against unauthorised access, loss, alteration or disclosure.
The User must also ensure the confidentiality of their access credentials and inform Fydl in the event of any suspicious use of their Account.
11. What are Users’ rights?
In accordance with the applicable regulations, Users may request:
- access to their data;
- the rectification of inaccurate data;
- the erasure of their data, where this is possible;
- the restriction of processing;
- objection to certain processing;
- the portability of their data, where that right applies;
- the withdrawal of their consent for processing based on consent.
Such requests may be sent to Fydl at the following address: contact@fydl-app.com.
Fydl may request additional information if necessary in order to verify the identity of the person making the request or to handle that request.
In the event of a difficulty, the User may lodge a complaint with the CNIL (the French data protection authority).
12. Deletion of the Account
A Customer may request the deletion of their Account by means of the features provided for that purpose or by contacting Fydl at the following address: contact@fydl-app.com.
Deletion of the Account results in the deletion or the anonymisation of the associated data, except where the temporary retention of that data is necessary in order to comply with a legal obligation, ensure the security of the service or preserve evidence of a right.
Deletion of the Account may result in the loss of access to the associated Loyalty Cards, Points, Rewards and histories.
13. Amendment of the Privacy Policy
Fydl may amend this Privacy Policy in order to take account of changes in the service, in the features, in legal obligations or in the processing carried out.
The applicable version is the one available on the Fydl website, application or webapp.
In the event of a material amendment, Fydl may inform Users by any appropriate means.