Privacy Policy

Mage Ecom Ltd is a company registered in England and Wales. For the purposes of the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018, we are the data controller when we process the personal data of visitors to our Website, prospective customers, and users who interact with us directly.

When our customers use the Platform to run loyalty and retention programmes for their own end users, we act as a data processor on behalf of those customers. Section 7 of this policy explains what that means in practice.

Under the UK GDPR we must have a valid legal ground for processing your personal data. The bases we rely on are set out below.

We use the personal data we collect to:

• Set up and manage your account and provide access to the Platform
• Process transactions, send invoices, and manage billing
• Respond to your enquiries and provide customer support
• Send service-related notices, including technical updates, security alerts, and changes to our terms or policies
• Analyse how the Website and Platform are used so that we can improve them
• Detect, prevent, and investigate fraud, abuse, or other unlawful activity
• Comply with legal obligations and enforce our Terms of Service
• With your consent, send marketing communications about products, features, or promotions that may be relevant to you

We will not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects on you.

We do not sell your personal data. We share it only where necessary and only with the following categories of recipient:

When you use the Platform to run loyalty programmes, rewards, or referral campaigns for your own customers, you may upload or generate personal data relating to those end users ("Customer Platform Data").

In this context, you are the data controller and we are the data processor. We process Customer Platform Data only on your instructions and solely for the purpose of providing the Service. Our obligations as a processor are set out in Section 4 of our Terms of Service.

If an end user wishes to access, correct, or delete their personal data, that request should be directed to you (the merchant) as the data controller. We will assist you in responding to such requests in accordance with our obligations under applicable data protection law.

Mage Ecom Ltd is based in the United Kingdom. Some of the third-party service providers we use (including our hosting and database infrastructure) may process data outside the UK and the European Economic Area.

Where personal data is transferred to a country that has not been deemed to provide an adequate level of data protection, we ensure appropriate safeguards are in place, such as the International Data Transfer Agreement (UK IDTA) or the EU Standard Contractual Clauses (as supplemented by the UK Addendum), to protect your data in accordance with the UK GDPR. You may request a copy of the relevant safeguards by contacting us at hello@mageloyalty.com.

We keep your personal data only for as long as necessary for the purposes for which it was collected. The retention period depends on the nature of the data and the reason we hold it:

• Account data: retained for the duration of your account and for up to 90 days afterwards (to allow reactivation), unless you request earlier deletion.
• Billing and transaction records: retained for up to 7 years to comply with tax and accounting obligations.
• Support correspondence: retained for up to 2 years after the issue is resolved.
• Website analytics data: retained in accordance with Google Analytics' default retention settings (currently 14 months).

When personal data is no longer required, we will securely delete or anonymise it. Data held on automated backups will be overwritten in the normal backup cycle.

Under the UK GDPR you have a number of rights in relation to your personal data. Subject to certain conditions and exemptions, you have the right to:

To exercise any of these rights, please contact us at hello@mageloyalty.com. We will respond within one month of receiving your request. In complex cases we may extend this by a further two months, in which case we will let you know.

If you are not satisfied with how we handle your request, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection. You can contact the ICO at ico.org.uk/make-a-complaint or by calling 0303 123 1113.

We may send you emails about products, features, or updates that we think will be of interest to you. We will only do so where you have given your consent or where we are permitted to do so under the "soft opt-in" rule (i.e., you are an existing customer and the communications relate to similar products or services).

You can opt out of marketing emails at any time by clicking the "unsubscribe" link at the bottom of any marketing email, or by emailing us at hello@mageloyalty.com. Opting out of marketing will not affect service-related communications (such as billing notices or security alerts).

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, loss, destruction, or alteration. These measures include encryption of data in transit, access controls, and regular security reviews.

However, no method of transmission over the internet or method of electronic storage is completely secure. While we strive to protect your personal data, we cannot guarantee its absolute security.