Privacy Policy

2.1 The Hospitality Brand as data controller

When you join a membership, collect rewards or interact with a hospitality brand, that hospitality brand will generally act as the data controller.

The Hospitality Brand determines why and how personal data is used for:

1. membership administration;
2. stamps, points and rewards;
3. discounts and vouchers;
4. membership tiers;
5. referrals;
6. guest segmentation;
7. guest communication;
8. the Hospitality Brand’s marketing;
9. analysis of its guest relationships; and
10. its products, locations and services.

The Hospitality Brand’s legal name and contact details must be shown on the membership page, registration form, digital membership card or related privacy notice.

Questions about the Hospitality Brand’s use of personal data should normally be directed to the Hospitality Brand.

2.2 Regulars as data processor

Regulars generally acts as a data processor when we process personal data on behalf of a Hospitality Brand.

This includes providing the technology used to:

1. create and host memberships;
2. issue and update digital membership cards;
3. record stamps, points, visits and rewards;
4. manage vouchers and membership benefits;
5. send communications on the Hospitality Brand’s instructions;
6. connect the membership with supported systems;
7. provide reporting and analytics;
8. provide technical support; and
9. maintain the platform.

When Regulars acts as a processor, the Hospitality Brand remains responsible for:

1. selecting a lawful purpose;
2. identifying an appropriate legal basis;
3. providing required privacy information;
4. handling data-subject requests;
5. obtaining any required consent;
6. ensuring marketing is lawful;
7. determining retention periods; and
8. ensuring its membership programme complies with applicable law.

Regulars processes the data under a data processing agreement and the Hospitality Brand’s documented instructions.

2.3 Regulars as independent data controller

Regulars acts as an independent data controller when we determine the purpose and essential means of processing.

This includes processing for:

1. the Regulars checkout;
2. the Guest Service Fee;
3. payment and transaction administration;
4. accounting and financial documentation;
5. fraud prevention;
6. platform and network security;
7. service monitoring;
8. direct support requests to Regulars;
9. managing Hospitality Brand accounts;
10. billing and commercial relationships;
11. protecting and enforcing legal rights;
12. complying with legal obligations;
13. developing and improving the Regulars platform; and
14. operating the Regulars website.

For these activities, Regulars is responsible for complying with applicable data-protection requirements.

2.4 Independent third parties

Certain third parties may process personal data as independent controllers under their own privacy policies.

These may include:

1. payment providers;
2. banks and card issuers;
3. Apple Wallet;
4. Google Wallet;
5. reservation providers;
6. point-of-sale providers;
7. marketing platforms;
8. delivery platforms; and
9. other services selected by you or the Hospitality Brand.

Regulars doesn’t control how an independent third party processes personal data for its own purposes.

4.1 Identification information

This may include:

1. name;
2. membership number;
3. internal user or account ID;
4. profile picture, where offered;
5. date of birth, where relevant;
6. age or age range; and
7. other identifiers required for a specific membership.

4.2 Contact information

This may include:

1. email address;
2. telephone number;
3. postal address, where required;
4. business contact information; and
5. communication preferences.

4.3 Membership information

This may include:

1. Hospitality Brand memberships;
2. membership status;
3. joining date;
4. participating location;
5. membership tier;
6. stamps;
7. points;
8. vouchers;
9. rewards;
10. discounts;
11. referrals;
12. prepaid balances;
13. subscription status;
14. benefit eligibility; and
15. redemption history.

4.4 Transaction and activity information

This may include:

1. visit dates;
2. participating locations;
3. Qualifying Purchases;
4. transaction amounts;
5. purchased products or product categories;
6. stamps or points earned;
7. vouchers issued or redeemed;
8. rewards earned or redeemed;
9. refunds;
10. cancellations;
11. chargebacks;
12. subscription payments; and
13. other membership activity.

Regulars may receive detailed product information where it is provided through a connected system.

In other cases, Regulars may receive only the information required to record the relevant membership activity.

4.5 Purchase and checkout information

When you make a purchase through Regulars, we may process:

1. the product purchased;
2. the Hospitality Brand;
3. the Brand Price;
4. the Guest Service Fee;
5. the Total Price;
6. currency;
7. payment status;
8. payment-provider references;
9. refund information;
10. subscription frequency;
11. billing status;
12. purchase date;
13. Order Confirmation details; and
14. information required to manage the purchase.

Payment-card numbers and security codes are generally collected directly by the payment provider.

Regulars doesn’t normally receive or store your complete payment-card number or security code.

4.6 Wallet and device information

This may include:

1. digital pass identifiers;
2. wallet type;
3. device or pass tokens;
4. card installation status;
5. card update information;
6. operating system;
7. browser type;
8. language;
9. device type;
10. IP address;
11. request timestamps; and
12. technical diagnostic information.

This information may be required to issue, update, secure and troubleshoot digital membership cards.

4.7 Communications

We may process information contained in:

1. support requests;
2. emails;
3. contact forms;
4. meeting notes;
5. complaints;
6. feedback;
7. surveys;
8. sales conversations; and
9. other communications with Regulars.

4.8 Hospitality Brand information

If you represent a Hospitality Brand, we may process:

1. your name;
2. work email;
3. work telephone number;
4. job title;
5. company;
6. account permissions;
7. login information;
8. platform activity;
9. commercial correspondence;
10. billing contacts;
11. training participation;
12. support history; and
13. actions taken within the platform.

4.9 Marketing and consent information

This may include:

1. whether consent was requested;
2. consent wording;
3. the date and method of consent;
4. communication channels selected;
5. withdrawals;
6. objections;
7. unsubscribe activity;
8. suppression records; and
9. evidence required to demonstrate compliance.

4.10 Security and compliance information

This may include:

1. login records;
2. access logs;
3. security events;
4. suspected fraud;
5. unusual activity;
6. dispute information;
7. account restrictions;
8. audit records;
9. identity-verification information; and
10. information required by law or a payment provider.

4.11 Sensitive personal data

Regulars doesn’t intentionally request special categories of personal data, such as information about health, political beliefs, religion or sexual orientation, through ordinary membership functionality.

You shouldn’t provide sensitive personal data unless it is necessary and you have been specifically asked to provide it through an appropriate and secure process.

If sensitive information is provided unexpectedly, it may be deleted, restricted or processed only where a valid legal basis applies.

5.1 Checkout and purchase administration

Purpose

To:

1. provide the checkout;
2. create and administer Orders;
3. calculate and collect the Guest Service Fee;
4. issue Order Confirmations;
5. administer subscriptions;
6. facilitate refunds;
7. communicate about purchases; and
8. resolve transaction issues.

Legal basis

Processing is generally necessary to perform a contract or take steps requested before entering into a contract, under GDPR Article 6(1)(b).

5.2 Payment administration

Purpose

To:

1. facilitate payments;
2. connect transactions with the Hospitality Brand;
3. reconcile payments;
4. manage failed payments;
5. facilitate refunds;
6. address payment disputes; and
7. maintain transaction records.

Legal basis

Processing is generally based on:

1. performance of a contract, GDPR Article 6(1)(b);
2. compliance with legal obligations, GDPR Article 6(1)(c); and
3. our legitimate interests in administering payments and preventing financial loss, GDPR Article 6(1)(f).

5.3 Accounting and tax compliance

Purpose

To:

1. maintain accounting records;
2. document the Guest Service Fee;
3. prepare financial reporting;
4. comply with tax requirements;
5. support audits; and
6. respond to public authorities.

Legal basis

Processing is necessary to comply with legal obligations under GDPR Article 6(1)(c).

5.4 Fraud prevention and security

Purpose

To:

1. detect fraud;
2. prevent unauthorised access;
3. investigate misuse;
4. protect digital cards;
5. secure accounts;
6. monitor system integrity;
7. prevent abuse of rewards;
8. manage security incidents; and
9. protect Guests, Hospitality Brands and Regulars.

Legal basis

Processing is based on our legitimate interests in protecting the platform, users, transactions and business under GDPR Article 6(1)(f).

Where processing is required by law, GDPR Article 6(1)(c) may also apply.

5.5 Customer support

Purpose

To:

1. respond to questions;
2. resolve technical problems;
3. investigate complaints;
4. correct platform errors;
5. administer requests; and
6. improve support.

Legal basis

Processing may be based on:

1. performance of a contract, GDPR Article 6(1)(b);
2. our legitimate interests in providing support and resolving issues, GDPR Article 6(1)(f); or
3. compliance with legal obligations, GDPR Article 6(1)(c).

5.6 Hospitality Brand accounts

Purpose

To:

1. create and manage business accounts;
2. administer access and permissions;
3. deliver platform services;
4. provide onboarding and training;
5. provide reports;
6. manage subscriptions and billing;
7. communicate about the service; and
8. enforce the Subscription Agreement.

Legal basis

Processing may be based on:

1. performance of a contract, GDPR Article 6(1)(b), where the individual is a contracting party;
2. our legitimate interests in fulfilling a business relationship, GDPR Article 6(1)(f); and
3. compliance with legal obligations, GDPR Article 6(1)(c).

Our legitimate interest is to communicate with the employees and representatives needed to deliver and administer the service.

5.7 Product development and service improvement

Purpose

To:

1. understand how the platform is used;
2. identify errors;
3. improve user experience;
4. improve performance;
5. develop functionality;
6. understand aggregate membership patterns;
7. conduct internal analysis; and
8. maintain service quality.

Legal basis

Processing is based on our legitimate interests in operating and improving the Regulars platform under GDPR Article 6(1)(f).

Where reasonably possible, we use aggregated, anonymised or pseudonymised information.

We don’t use this purpose to override the Hospitality Brand’s instructions where Regulars acts as a processor.

5.8 Business development

Purpose

To:

1. respond to enquiries;
2. manage prospective Hospitality Brands;
3. arrange demonstrations;
4. prepare proposals;
5. develop business relationships;
6. maintain sales records; and
7. follow up on relevant business conversations.

Legal basis

Processing is based on:

1. steps requested before entering into a contract, GDPR Article 6(1)(b); or
2. our legitimate interests in developing and operating our business, GDPR Article 6(1)(f).

5.9 Direct marketing by Regulars

Purpose

To send information about Regulars to relevant business contacts.

Legal basis

The legal basis depends on the communication, recipient and applicable marketing rules.

It may include:

1. consent under GDPR Article 6(1)(a); or
2. legitimate interests under GDPR Article 6(1)(f), where permitted.

Where electronic marketing requires consent under applicable marketing law, Regulars will obtain the required consent unless a lawful exception applies.

You may object to direct marketing at any time.

5.10 Legal claims and compliance

Purpose

To:

1. establish legal rights;
2. enforce agreements;
3. defend legal claims;
4. handle disputes;
5. respond to authorities;
6. comply with court orders;
7. comply with legal obligations; and
8. document compliance.

Legal basis

Processing may be based on:

1. compliance with legal obligations, GDPR Article 6(1)(c); and
2. our legitimate interests in protecting and enforcing legal rights, GDPR Article 6(1)(f).

12.1 The Hospitality Brand

The Hospitality Brand may access data relating to its own membership programme, Guests and purchases.

A Hospitality Brand isn’t permitted to access another Hospitality Brand’s Guest data through Regulars.

12.2 Regulars personnel

Authorised Regulars employees and contractors may access personal data where necessary for:

1. support;
2. platform operation;
3. security;
4. billing;
5. compliance;
6. development; and
7. other authorised business purposes.

Access is limited according to role and need.

12.3 Service providers and subprocessors

We use service providers that support:

1. cloud hosting;
2. databases;
3. security;
4. system monitoring;
5. email delivery;
6. push and wallet delivery;
7. customer support;
8. payment processing;
9. accounting;
10. communication;
11. analytics;
12. software development; and
13. business administration.

Where a provider acts as our processor or subprocessor, we require an appropriate data processing agreement.

Hospitality Brands can obtain information about Regulars’ current subprocessors through their contractual documentation or by contacting [email protected].

12.4 Payment providers

Payment providers may receive:

1. contact information;
2. transaction information;
3. payment references;
4. device information;
5. fraud-prevention information; and
6. other information required to process a payment.

Payment providers may act as independent controllers for parts of their processing.

12.5 Wallet and device providers

Apple, Google and other wallet providers may process information required to:

1. add a digital card;
2. store the card;
3. display it;
4. update it;
5. secure the wallet; and
6. operate their services.

Their processing is governed by their own terms and privacy policies.

12.6 Integrations selected by the Hospitality Brand

A Hospitality Brand may choose to connect Regulars with:

1. a point-of-sale system;
2. a reservation system;
3. a marketing platform;
4. an accounting system;
5. an ordering platform;
6. a payment system; or
7. another business service.

The Hospitality Brand is responsible for ensuring that the connection and disclosure are lawful.

12.7 Professional advisers

We may disclose information to:

1. lawyers;
2. auditors;
3. accountants;
4. insurers;
5. financial advisers; and
6. other professional advisers.

Disclosure is limited to what is reasonably necessary.

12.8 Authorities and legal recipients

We may disclose personal data where required or permitted by law, including to:

1. courts;
2. law-enforcement authorities;
3. tax authorities;
4. supervisory authorities;
5. regulators; and
6. other public authorities.

12.9 Business transfers

Personal data may be disclosed as part of:

1. an investment;
2. merger;
3. acquisition;
4. reorganisation;
5. financing;
6. sale of assets; or
7. transfer of the Regulars business.

The recipient may only use the information in accordance with applicable law and the purposes disclosed in this Privacy Policy, unless another lawful basis applies.

14.1 Membership data processed for a Hospitality Brand

Regulars retains membership data according to:

1. the Hospitality Brand’s instructions;
2. the data processing agreement;
3. the duration of the Hospitality Brand’s use of Regulars;
4. the status of the membership;
5. legal requirements; and
6. valid requests from the Hospitality Brand.

When the Hospitality Brand’s agreement ends, data is returned, deleted or retained in accordance with the data processing agreement and applicable law.

Residual copies may remain temporarily in protected backups until they are overwritten through the ordinary backup cycle.

14.2 Checkout and financial records

Order, payment, Guest Service Fee and accounting records are normally retained for five years from the end of the relevant financial year, or longer where required by law or an unresolved legal matter.

14.3 Hospitality Brand account information

Business account and commercial relationship information is normally retained for the duration of the relationship and for up to 24 months afterwards.

Information may be retained longer where required for:

1. accounting;
2. security;
3. disputes;
4. legal claims; or
5. another lawful purpose.

14.4 Support communications

Support correspondence is normally retained for up to 24 months after the matter is resolved.

It may be retained longer where necessary for an ongoing dispute, security matter or legal claim.

14.5 Security logs

Ordinary security and technical logs are normally retained for up to 12 months.

Relevant records may be retained longer where they concern:

1. a security incident;
2. fraud;
3. misuse;
4. a dispute;
5. an investigation; or
6. a legal claim.

14.6 Prospective Hospitality Brands

Sales and business-development information is normally retained for up to 24 months after the most recent meaningful interaction.

It may be deleted earlier if the contact objects or the information is no longer relevant.

14.7 Marketing consent and objections

Marketing preferences are retained while relevant.

Evidence of consent, withdrawal, objection or unsubscribe activity may be retained for up to five years after the relevant event where necessary to demonstrate compliance or defend legal claims.

A limited suppression record may be retained after an objection or unsubscribe request to ensure that further marketing isn’t sent.

14.8 Legal claims

Information relevant to a dispute or legal claim may be retained until:

1. the matter has been resolved;
2. the applicable limitation period has expired; and
3. any related legal obligation has ended.

14.9 Anonymised information

Regulars may retain information that has been irreversibly anonymised.

Information that can no longer reasonably be linked to an identifiable person isn’t personal data and isn’t covered by this Privacy Policy.

17.1 Right to information

You have the right to receive clear information about how your personal data is processed.

17.2 Right of access

You may request confirmation of whether personal data about you is processed and obtain:

1. access to the data;
2. a copy;
3. information about the purposes;
4. categories of data;
5. recipients;
6. retention;
7. sources; and
8. applicable rights.

17.3 Right to rectification

You may request correction of inaccurate personal data and completion of incomplete information.

17.4 Right to erasure

You may request deletion of personal data where the legal conditions are met.

The right to erasure isn’t absolute.

Information may be retained where processing is necessary for:

1. a legal obligation;
2. accounting;
3. fraud prevention;
4. freedom of expression;
5. public-interest purposes;
6. legal claims; or
7. another lawful exception.

17.5 Right to restriction

You may request that processing be restricted where:

1. you dispute the accuracy of the information;
2. the processing is unlawful and you oppose deletion;
3. the information is needed for a legal claim; or
4. you have objected and the assessment is pending.

17.6 Right to data portability

Where processing is automated and based on consent or a contract, you may have the right to receive personal data you provided in a structured, commonly used and machine-readable format.

Where technically feasible, you may request direct transfer to another controller.

This right doesn’t apply to all information, including all inferred or calculated data.

17.7 Right to object

You may object to processing based on legitimate interests for reasons relating to your particular situation.

Processing will stop unless the controller demonstrates compelling legitimate grounds or the processing is required for legal claims.

17.8 Absolute right to object to direct marketing

You may object to direct marketing at any time.

This includes profiling related to direct marketing.

Once you object, the relevant personal data may no longer be used for that marketing.

17.9 Right to withdraw consent

Where processing is based on consent, you may withdraw consent at any time.

Withdrawal doesn’t affect the lawfulness of processing performed before consent was withdrawn.

Withdrawing consent doesn’t prevent processing based on another valid legal basis.

17.10 Rights concerning automated decisions

You have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, except where an applicable legal exception and required safeguards apply.

17.11 Right to complain

You may complain to the competent data-protection authority.

In Denmark, the supervisory authority is:

The Danish Data Protection Agency
Carl Jacobsens Vej 35
2500 Valby
Denmark

You may also have the right to complain to the supervisory authority in the EU or EEA country where you live, work or believe an infringement occurred.

18.1 Requests concerning a Hospitality Brand

If your request concerns:

1. your membership;
2. stamps or points;
3. rewards;
4. Hospitality Brand marketing;
5. Hospitality Brand segmentation;
6. purchase history used by the Hospitality Brand; or
7. another Hospitality Brand purpose,

you should normally contact the Hospitality Brand directly.

Its contact information should appear on the membership page, card or registration confirmation.

Regulars will assist the Hospitality Brand where required under the data processing agreement.

18.2 Requests concerning Regulars

If your request concerns processing for which Regulars is the controller, contact: [email protected]

Please describe:

1. who you are;
2. your relationship with Regulars;
3. the Hospitality Brand, where relevant;
4. the email or telephone number connected with the service; and
5. the right you wish to exercise.

18.3 Identity verification

We may request reasonable information to verify your identity before acting on a request.

We won’t request more information than reasonably necessary for verification.

18.4 Response time

We will respond without undue delay and normally within one month.

The period may be extended by up to two additional months where a request is complex or numerous.

If an extension is required, you will be informed within the initial one-month period.

18.5 Fees

Requests are generally handled without charge.

A reasonable fee may be charged, or a request may be refused, where it is manifestly unfounded or excessive, particularly because it is repetitive.