This Privacy Policy also applies to our voucher landing pages, on which we provide new customer promotions and registration options for the Bonus Club. The processing of the data collected (e.g. name, telephone number) is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR.
Privacy Policy "Bonus-Club"
Valid as of: 20.03.2024
1. Data protection
1.1 Data protection is a top priority for the Bonus Club "La Topolina". We respect your privacy and personal sphere. Boutique La Topolina, Weidlinger Straße 12, 3400 Klosterneuburg, AT ("Contractor" or "Responsible") processes your personal data as part of the customer loyalty solution provided ("Bonus-Club") and the software solution used, within the legal framework in the form of the General Data Protection Regulation ("GDPR") and the Austrian Data Protection Act, as amended. In this privacy policy, we therefore inform you about the processing of personal data when using the Bonus Club.
2. Processing of personal data
2.1 Object of the agreement
The object of this contract is the realisation of the following tasks: Operation and provision of a bonus club system. As part of the registration and subsequent ongoing use of the Bonus Club, you ("User" or "You") will provide Data ("Data") to the Contractor. As a user, you are a "data subject" within the meaning of Art 4 ZI 1 GDPR.
2.2 Data categories
The following data categories are processed:
2.2.1 Personal data: IP address at the time of registration for the Bonus-Club, unique identifier of the end device ("Device-ID"), unique identifier of the user ("User-ID"). First and last name, date of birth, gender, address, date of birth, mobile phone number, e-mail address.
2.2.2 Device data: Information about the end device(s) and version(s) you are using: Manufacturer, model, operating system, browser used, app version.
2.2.3 Connection data: IP address of your Internet connection, resulting in your location (determined via the IP address). Date and time of access. The http response code and the client's request are also logged.
2.2.4 Purchase data: When collecting bonus points and bonuses for purchases, the following data is also collected about your associated and completed purchases: Date and time of purchase, shop location, cash register ID and name, receipt number, invoice totals, purchase frequency and information about loyalty points and/or vouchers received. The original value of the scanned QR code is also stored. There is expressly no profiling of your purchases. The Bonus-Club therefore does not store any in-depth information about your purchases, such as which products were purchased.
2.2.5 Usage data: Last login to the Bonus Club, data from submitted forms, status, purchase frequency, if/when/which pages, vouchers or messages were accessed and displayed.
2.2.6 When registering via Facebook, Apple or Google login: name, profile picture, access token, profile ID, information about the social media account used. Registration via social media is offered to you as a user for the convenient creation of a new Bonus-Club account.
2.2.7 Communication & marketing messages: Title and content or text of the message, reason for the message transmission (birthday greetings, new voucher transmission, direct message for marketing purposes), channel via which the message was transmitted (SMS, WhatsApp, other messenger, email, push notification).
2.2.8 Redeeming vouchers & discounts: Voucher received, voucher ID, code, value, time of redemption and shop (location) in which the voucher was redeemed.
2.2.9 Survey data: When you participate in surveys, the answers you give are saved, as well as the original questions linked to them and the date and time of participation.
2.2.10 Competition data: When participating in competitions, the date and time, as well as the participation data of the competition are stored, as well as the data of the resulting, possibly won competition prize.
2.2.11 Recommendation data: If you recommend our Bonus-Club to other people, we store the invitation link, invitation code, as well as the fact that and who you have invited to the Bonus-Club and whether the other person(s) have accepted the invitation.
2.2.12 Check-In data: Time and location of your check-in.
2.3 Processing purpose
Your data will be processed for the following purposes:
Managing membership of the Bonus-Club, running the Bonus-Club, targeted advertising and communication, sending special offers and vouchers, analysing and compiling statistics on your purchases, running competitions and surveys, acquiring new customers (initiation) and building up a customer database.
2.4 Legal basis
The data is processed on the basis of the following legal bases: Art 6 para 1 lit a GDPR (consent), Art 6 para 1 lit b GDPR (fulfilment of contract) and Art 6 para 1 lit f GDPR (legitimate interests). The legitimate interests include the prevention of misuse in the context of multiple registrations and the multiple and therefore unauthorised use of identical benefits, the improvement of the Bonus-Club system and quality assurance. The provision of user data and in particular the consent to receive electronic messages (SMS, WhatsApp, Messenger) is mandatory, as otherwise the benefits (e.g. vouchers) cannot be transmitted (personalised) and membership in the Bonus-Club is therefore not possible.
2.5 Duration of the agreement
The agreement is concluded for an indefinite period and can be cancelled or revoked by you as a user at any time. This cancellation takes place by deleting the user account within the Bonus-Club or alternatively upon written request. The data will be stored and processed for the purpose of documentation and fulfilment of legal obligations, or for the provision of the Bonus-Club system.
2.6 Obligations of the contractor
The Contractor declares in a legally binding manner that it has obligated all persons commissioned with data processing to confidentiality before accepting the activity or that they are subject to an appropriate statutory confidentiality obligation. In particular, the confidentiality obligation of the persons commissioned with data processing shall remain in force even after termination of their activity and departure from the Contractor.
3. Security, transfer, processing
3.1 Data security
The contractor shall take suitable technical and organisational measures to protect the data processed within the scope of the Bonus-Club against loss, destruction and unauthorised access. These measures relate in particular to the storage of the user's personal data and its transmission. The measures are also regularly subjected to a thorough review and further developed on the basis of new technological developments or additional legal requirements.
3.2 Consent to data processing
The user's personal data is processed for the purpose of contract fulfilment on the basis of the user's voluntary consent. There is no obligation to give consent (e.g. for special categories of personal data) and to use the Bonus-Club system. However, failure to grant consent would mean that the order cannot be accepted and the creation of a required user profile for the Bonus-Club is not possible.
3.3 Transfer of data
All data is subject to the agreed or statutory obligation to maintain confidentiality and to protect personal data. The user's data will only be forwarded - apart from the forwarding of the processing necessary for operation within the framework of concluded order data processing agreements - with the express consent of the user.
3.4 Submissions
The contractor forwards the data to the company responsible for the operation and development of the Bonus Club: Christoph Harald Holubar, Cleverloyal ("sub-processor"). The user will be informed of any intended changes to the sub-processor in good time by updating this data protection agreement so that the user can prohibit this if necessary. The updated data protection agreement will be displayed in the event of changes within the Bonus-Club, whereby (renewed) consent by the user is required. The contractor shall conclude the necessary agreements within the meaning of Art 28 (4) GDPR with the processor. It must be ensured that the processor enters into the same obligations that are incumbent on the contractor on the basis of this agreement. If the processor does not fulfil its data protection obligations, the contractor shall be liable to the user for compliance with the obligations of the sub-processor. The Contractor and Cleverloyal may engage further sub-processors (system maintenance, hosting, development, support).
3.5 Place where the data processing is carried out
Data processing activities are carried out as far as possible within the European Union on the basis of the GDPR. However, at least in part, data processing activities may also be carried out outside the EU or the EEA, namely in America / USA. The appropriate level of data protection results from
- an adequacy decision of the European Commission pursuant to Art 45 GDPR.
- an exception for the specific case pursuant to Art 49 (1) GDPR.
- binding internal data protection provisions pursuant to Art 47 in conjunction with Art 46 (2) (b) GDPR.
- Standard data protection clauses pursuant to Art. 46 (2) (c) and (d) GDPR.
- approved rules of conduct pursuant to Art. 46 para. 2 lit e in conjunction with Art. 40 GDPR.
- an approved certification mechanism in accordance with Art 46 para 2 lit f in conjunction with Art 42 GDPR.
4. Your Rights ("data subject")
You have the following rights vis-à-vis the Bonus-Club (see point 5 for contact details) under the GDPR:
4.1 The right to information in accordance with Art. 15 GDPR regarding the personal data processed by us. In the event of repeated requests for information, we may charge reasonable administrative costs.
4.2 The right to rectification under Art. 16 GDPR, the right to erasure under Art. 17 GDPR and the right to restriction of processing under Art. 18 GDPR.
4.3 The right to object in accordance with Art 21 GDPR. If you have given your consent to the processing of data by the Bonus-Club, you can revoke this at any time without giving reasons with effect for the future. The withdrawal of consent does not affect the lawfulness of the data processing carried out up to that point.
4.4 The right to data portability in accordance with Art. 20 GDPR.
4.5 If you believe that the processing of your personal data violates data protection regulations, you have the right to lodge a complaint with a supervisory authority in accordance with Art 77 GDPR. In Austria, this is the Austrian Data Protection Authority.
5. Data protection officer and controller
The data protection officer of the Bonus-Club is available for all questions and information relating to data protection in connection with the Bonus Club and can be contacted by e-mail at datenschutz@cleverloyal.com or by post at Boutique La Topolina, Weidlinger Straße 12, 3400 Klosterneuburg, AT
Controller: Boutique La Topolina, Weidlinger Straße 12, 3400 Klosterneuburg, AT
6. Final provisions
6.1 Conditions of participation. The terms and conditions of the Bonus-Club apply.
German
