Loyalty card privacy notice

Data controller is the shop that issues the card (shown on the card itself). Hash42 Labs provides the Hash42 Stamp platform and processes data on the shop's behalf, as data processor.

Data collected: name, mobile number or email, stamps, amounts recorded at the till, rewards and vouchers, date and time of each operation. If the shop offers a birthday gift and you choose to enter them, also your day and month of birth (never the year).

Purpose: managing the loyalty card (stamps, rewards, vouchers, card in the Wallet and its notifications) and, if you entered your birthday, adding the gift to your card on that day. Only if you gave the optional consent, the shop may send you offers and news, including messages on the card in your Wallet (for example a reminder if you have not visited for a while).

Legal basis: performance of the service you requested (the card, and the birthday gift if you asked for it by entering the date) and consent (promotional messages), which you can withdraw at any time by asking the shop.

Retention: for the life of the card and up to 24 months after its last use, then the data is deleted or anonymised.

Where the data is stored: on servers in the European Union, with hosting and database providers working on behalf of Hash42 Labs. If you save the card to Google Wallet, the card data is also processed by Google under its own terms. You can remove the card from your Wallet at any time.

Your rights: access, rectification, erasure, restriction, portability and objection, by writing to the shop or to Hash42 Labs via hash42.xyz. You can also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).