In this article:
An introduction to GDPR
The General Data Protection Regulation (GDPR) is a European Union law that controls how the personal data of people in the EU is collected, used and stored. The UK has its own version, the UK GDPR.
GDPR can apply to your business even if you are based outside the EU, for example if you sell to customers there.
GDPR & LoyaltyLion
Under our Terms of Service, you are the data controller for your customers' personal data, and LoyaltyLion is the data processor. We process that data only to run your loyalty program, and on your instructions.
To meet our responsibilities as a processor, LoyaltyLion:
Has appointed a Data Protection Officer.
Has appointed DataRep as our representative for people in the EU and Switzerland.
Keeps a register of processing activities and a Data Protection Impact Assessment (DPIA).
Has a signed Data Protection Addendum with every sub-processor we use.
Encrypts our primary databases at rest, and encrypts data in transit.
Has completed a SOC 2 Type I audit.
Our Security overview gives the detail, and our Sub-processors page lists every company that processes data for us and where it is located. Some are in the United States. When data moves outside the European Economic Area or the UK, our Terms of Service commit us to an approved safeguard for that transfer.
We handle your own account data as described in our Privacy Policy.
Data processed by LoyaltyLion
List the customer data LoyaltyLion processes in your own privacy policy. Depending on the features you use, the personal data we process about your customers includes:
Name and email address
Phone number
Billing and shipping addresses, where your platform sends them with order or customer data
Date of birth
IP address and browser details
Purchase history
Loyalty activity, such as points, rewards and referrals, including the email addresses of friends they refer
Social media usernames, if they earn points for following you
Receipt images, if you use receipt upload
We receive most of this from your ecommerce platform, such as Shopify, BigCommerce or Magento. The contractual list is in Appendix I of our Terms of Service.
When you subscribe to LoyaltyLion, we also receive your account holder's name and email address, and your company's address and phone number.
Data and privacy settings
In LoyaltyLion, go to Settings, and then Data and privacy.
Customer tracking consent mode decides when LoyaltyLion uses cookies and tracking on your store:
Always track: we always track your customers. This is the default.
Opt-in (GDPR – EU/EEA compliant): we track a customer only after they agree to tracking.
Opt-out (CCPA – California compliant): we track a customer unless they opt out.
Never track: we never track your customers.
The opt-in and opt-out modes read the customer's choice from Shopify's cookie consent. On other platforms there is no consent choice to read, so opt-in never tracks and opt-out always tracks.
Customer birthday collection lets you collect only the day and month of a customer's birthday, rather than the full date.
The right to access and erasure
Under GDPR, your customers can ask to see the personal data you hold about them (the right of access), or ask you to delete it (the right to erasure, sometimes called the right to be forgotten). They can ask verbally or in writing, and you must respond within one month.
Because LoyaltyLion is your data processor, we get customer data from your ecommerce platform. How you erase a customer from LoyaltyLion depends on your platform.
Erasing customer data on Shopify
Process the erasure request in Shopify, following Shopify's guide to customer data requests. Shopify then sends the request to LoyaltyLion, and we erase the customer automatically 5 days later.
If you delete a customer in Shopify without an erasure request, we remove them from your program but keep their personal data. If they create a new account with your store later, they join your program as a new customer.
We recommend processing an erasure request for every customer you remove from your store.
Erasing customer data on other platforms
On BigCommerce, Magento and custom platforms, deleting a customer from your store doesn't remove them from LoyaltyLion. Erase them from their customer profile instead. You need the Admin, Program manager or Customer support role, or to be the account owner.
In LoyaltyLion, go to Customers and open the customer's profile.
Click Actions.
Select Erase personal data.
Read the confirmation, and click Erase data.
Erasing a customer can take up to 10 minutes.
To erase a large number of customers at once, contact our Support team at support@loyaltylion.com.
What we do when we erase a customer
We overwrite the customer's personal data, such as their name, email address, phone number, birthday and IP addresses, and remove them from customer search. We keep their points and order history without personal details, so your totals, such as total points earned, still include them.
We keep encrypted backups for up to 90 days, and we don't remove erased data from backups that already exist.
Resources
This article and the resources above are for information only and are not legal advice. Talk to your legal counsel about how GDPR affects your business.