Smart Loyalty Privacy Notice for the United Kingdom
Last updated: 18 October 2026
This page is for people in the United Kingdom who visit smartloyalty.uk, book a demo, contact us or sign up for Smart Loyalty. It explains how we handle your personal data under UK data protection law: the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR).
Our main privacy policy is at https://smartloyalty.ie/privacy.php. Where this page differs from it, this page applies to people in the UK.
1. Who we are
Smart Loyalty is a product of Think X Intelligent Systems LTD, a company registered in Ireland (registered as ThinkX Intelligent Systems Limited, company number 706889), with its registered office at Currygrane, Ballinalee, Co. Longford, N39 AE76, Ireland.
Think X Intelligent Systems LTD is the controller of the personal data described on this page. That means we decide how and why it is used, and we are responsible for it.
Contact for privacy questions: privacy@smartloyalty.ie Post: Think X Intelligent Systems LTD, Currygrane, Ballinalee, Co. Longford, N39 AE76, Ireland
We are based in Ireland and do not currently have a representative in the UK. You can contact us directly using the details above.
We have not appointed a Data Protection Officer because the law does not require us to.
Loyalty app users: if you collect stamps or rewards in a café's or shop's own Smart Loyalty app, that business is the controller of your loyalty data, and we process it on its behalf. Please see the business's own privacy notice and the app's privacy notice, which is linked from the app's app store listing. For example, the Koffee House app's notice is at https://smartloyalty.ie/privacy/koffeehouse.php. To delete your loyalty account, use the delete option in the app or the business's deletion page, for example https://smartloyalty.ie/Account-services/koffeehouse.php. If you can't use either, email privacy@smartloyalty.ie and we will complete your request within one month. This page covers people who deal with Smart Loyalty directly, mainly business owners and their staff.
2. What personal data we collect
When you book a demo - Your name, business name, email address, phone number and website - Which advert or campaign led you to the form, if any
When you contact us - Your name, business name, email address and anything you tell us in your message
When you sign up and pay - Your name, business name, business address, email address and phone number - Details we need to build and publish your branded app, such as your logo, brand colours and app store account details - Payment details. These go directly to Stripe, our payment provider. We do not see or store your full card number. Stripe gives us limited details, such as the card type and the last four digits, plus your payment and subscription history.
When you use your Smart Loyalty account - Login details for you and any staff you add - Your support requests and our correspondence with you
When you visit our website - Technical data such as your IP address, browser type, device and the pages you request, which our servers log automatically - If you accept analytics or marketing cookies: information about how you use our website and how you reached it (see section 11)
3. Why we use your data and our lawful basis
Under the UK GDPR, we must have a lawful basis for each use of your data. This table sets them out.
| What we do | Lawful basis |
|---|---|
| Arrange and give demos, and answer enquiries | Steps you ask for before entering a contract, and legitimate interests: replying to businesses that contact us |
| Set up your account, build and publish your app, and provide support | Contract |
| Take payments and manage subscriptions through Stripe | Contract |
| Keep invoices and accounting records | Legal obligation |
| Send service emails, such as account, billing and security notices | Contract and legitimate interests |
| Send marketing emails about Smart Loyalty | Consent, or, for existing customers, emails about similar Smart Loyalty services with an easy opt-out (PECR regulation 22). For corporate email addresses, we rely on legitimate interests, and you can opt out at any time |
| Measure website use with Google Analytics | Consent, given through our cookie banner (PECR regulation 6) |
| Measure our Facebook and Instagram advertising with the Meta Pixel | Consent, given through our cookie banner (PECR regulation 6) |
| Keep our website and service secure and prevent fraud | Legitimate interests: protecting our service and our customers |
| Establish, exercise or defend legal claims | Legitimate interests |
Where we rely on legitimate interests, we have weighed our interests against your rights. You can ask us for more detail and you can object at any time (see section 7).
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. We do not sell your personal data.
4. Who we share your data with
We share personal data only where we need to, and only with:
- Hosting: Amazon Web Services (AWS), Ireland (eu-west-1, Dublin), which hosts our website, the Smart Loyalty platform and its databases.
- Email: our own mail server, hosted on AWS in Ireland, which handles our email and sends service emails.
- Payments: Stripe, which processes payments and manages subscriptions. Stripe acts as an independent controller for some activities, such as fraud prevention. See stripe.com/privacy.
- App stores: Apple and Google, when we publish your branded app.
- Google: Google Analytics, only if you accept analytics cookies. Our pages also load fonts from Google Fonts, which receives your IP address.
- Meta Platforms: the Meta Pixel, only if you accept marketing cookies.
- Professional advisers, such as our accountants and lawyers, where needed.
- Authorities and others, where the law requires it or to protect our rights.
- A buyer or investor, if our business is sold or restructured, under confidentiality terms.
Our processors may use your data only on our instructions, under written contracts.
5. International transfers
We are based in Ireland, so personal data we collect from the UK is processed in Ireland and elsewhere in the European Economic Area (EEA). UK law treats the EEA as giving adequate protection, so these transfers are allowed under UK adequacy regulations.
Some of our providers, including Google, Meta and Stripe, are based in the United States or may access data from there. When UK personal data goes to a country without UK adequacy regulations, we protect it with one of these:
- the UK Extension to the EU-US Data Privacy Framework (the "UK-US data bridge"), for US companies certified under it; or
- the ICO's International Data Transfer Agreement (IDTA), or the UK Addendum to the European Commission's Standard Contractual Clauses, with extra safeguards where needed.
You can ask us for more information about the safeguards we use, or a copy of them, using the contact details in section 1.
6. How long we keep your data
| Data | How long |
|---|---|
| Demo requests and enquiries that do not lead to a sign-up | 2 years from our last contact |
| Customer account data | While you are a customer. When your account is closed, we delete it within 30 days, and backup copies are overwritten within a further 35 days. Invoices and accounting records are kept as set out below |
| Invoices and accounting records | 6 years after the end of the financial year they relate to, as Irish tax and company law requires |
| Marketing email preferences | Until you unsubscribe. We then keep only your email address on a suppression list so that we do not email you again |
| Server and security logs | 14 days |
| Google Analytics data | 14 months, then deleted automatically |
After these periods we delete the data or anonymise it so that it can no longer identify you.
7. Your rights under UK law
You have the following rights over your personal data:
- Access: ask for a copy of the personal data we hold about you.
- Rectification: ask us to correct inaccurate data or complete incomplete data.
- Erasure: ask us to delete your data, for example when we no longer need it or you withdraw consent.
- Restriction: ask us to limit how we use your data, for example while we check whether it is accurate.
- Portability: ask for data you gave us in a structured, commonly used, machine-readable format, or ask us to send it to another organisation, where we rely on contract or consent.
- Objection: object to processing based on our legitimate interests. You can object to direct marketing at any time, and we will stop.
- Automated decisions: not to be subject to decisions based solely on automated processing that have legal or similarly significant effects. We do not make such decisions.
- Withdraw consent: at any time, where we rely on consent (see section 8).
To use any of these rights, email privacy@smartloyalty.ie Using your rights is free. We will reply within one month. If your request is complex, or you have sent several, we may need up to two more months; if so, we will tell you within the first month and explain why. We may ask you to confirm your identity before we act.
8. Withdrawing consent
You can withdraw your consent at any time, and doing so is as easy as giving it:
- Cookies: click Cookie settings at the bottom of any page and switch analytics or marketing off, or choose Reject all.
- Marketing emails: click the unsubscribe link in any marketing email, or email privacy@smartloyalty.ie.
Withdrawing consent does not affect processing that took place before you withdrew it.
9. Your right to complain to the ICO
If you are unhappy with how we handle your personal data, please tell us first at privacy@smartloyalty.ie so we can try to put it right.
You have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk or on 0303 123 1113. You can also complain to Ireland's Data Protection Commission at www.dataprotection.ie.
10. Children
Smart Loyalty's website and business services are for business owners and their staff, and are not aimed at children. We do not knowingly collect personal data from anyone under 18 through this website. If you think a child has given us personal data, contact us and we will delete it.
11. Cookies on smartloyalty.uk
Under PECR, we only use cookies that are not strictly necessary if you agree. When you first visit, we show a banner with Accept, Reject and Cookie settings buttons of equal prominence. The analytics and marketing switches are off until you turn them on. Nothing from Google Analytics or Meta loads until you choose.
Cookie durations are to be confirmed.
| Cookie | Provider | Type | Purpose | Duration |
|---|---|---|---|---|
sl_consent |
Smart Loyalty | Strictly necessary | Remembers your cookie choices | 180 days (to confirm) |
PHPSESSID |
Smart Loyalty | Strictly necessary | Keeps forms and sign-in working, where used | Until you close your browser (to confirm) |
_ga |
Google (Google Analytics 4) | Analytics (consent) | Gives your browser a random ID so we can count visitors and see how our site is used | About 400 days (13 months) (to confirm) |
_ga_0971LP06MD |
Google (Google Analytics 4) | Analytics (consent) | Keeps track of your visit (session) for our Google Analytics property | About 400 days (13 months) (to confirm) |
Meta Pixel (for example _fbp, _fbc) |
Meta Platforms | Marketing (consent) | Measures the results of our Facebook and Instagram adverts. Used on our demo request page | Set and controlled by Meta (see Meta's privacy policy) |
We ask you again after 180 days. To change your mind, click Cookie settings at the bottom of any page. When you withdraw consent, the analytics and marketing tools stop loading. Our pages also load fonts from Google Fonts, which receives your IP address.
12. Changes to this page
We may update this page when our services, providers or the law change, including as new parts of the Data (Use and Access) Act 2025 come into force. The date at the top shows when it was last updated. If we make a significant change, we will tell customers by email before it takes effect.