Last updated 13 September 2026
This policy explains what personal data Bee Loyal handles, why, and what rights you have. Bits Matter Ltd, England and Wales, is the controller where we decide why and how data is used. When a business uses Bee Loyal to manage data about its staff, customers, card holders or prize-draw entrants, that business is the controller and we act as its processor. Contact: privacy@bitsmatter.co.uk.
When a business sets up an account we hold the username, an email address where one is given, a securely hashed password, and a record of which company the login belongs to. We use this to provide access to the dashboard, protect the service and send account emails such as password resets. Bits Matter is the controller for this account and security data. Legal basis: performance of a contract and our legitimate interest in keeping the service secure.
If a business subscribes or buys a prize draw, Stripe collects its payment details and billing address under Stripe's own privacy policy. We keep the Stripe customer and subscription references, chosen plan, subscription dates and payment status, but not full card details. Bits Matter is the controller for this billing data. We use it to provide paid services, collect fees and keep the records the law requires.
A company using the service enters the details it wants on a card: name, job title, phone, email, website, social links, address, a short description and optionally a photo. We hold that data on the company's behalf and show it on the pass, in the contact QR code, and in the "your card is ready" email if the company chooses to send one. The company is the controller of that data and we act as its processor. If you are a card holder and want your details changed or removed, ask the company that issued your card, or contact us and we will pass the request on.
Loyalty, recognition and prize-draw passes can carry a unique card or entry number, a stamp or points balance, award reasons, offers and draw details. We also record events such as when a till stamps a card, when points are awarded or used, and draw entries and results. A unique number and its history can still be personal data even when the business does not give us the holder's name. The business running the scheme or draw is the controller and we act as its processor.
When a pass is added to Apple Wallet, the wallet registers a device identifier and a push token with us so the pass can be updated. These identifiers may be personal data even though they do not contain the holder's name. We use them only to tell the device that a pass has changed and process them on behalf of the business that issued the pass. Google Wallet passes are held by Google under its own privacy policy.
Our Data Processing Addendum is part of the Terms of Service. It records the business's instructions to us and covers confidentiality, security, sub-processors, international transfers, help with people's rights and breaches, deletion or return, and audits.
Data is stored on Amazon Web Services in London (eu-west-2). Email is sent through Amazon SES in Ireland (eu-west-1). This UK-to-Ireland transfer is covered by the UK's adequacy regulations. Passes are delivered through Apple and Google, which also process pass content under their own terms.
The dashboard sets one cookie holding your login token so you stay signed in. There are no advertising or analytics cookies.
Account and company service data is kept while the company uses the service and deleted when the company is closed. Billing and tax records may be kept for the period the law requires. Retired cards are kept for 30 days so that wallets can be told the pass is void, then deleted automatically. Server logs are deleted after 90 days.
Under UK data protection law you can ask for a copy of your data, ask for it to be corrected or deleted, object to or restrict some processing, and complain to the Information Commissioner's Office. For card, points, loyalty or draw data, contact the business that issued the pass or ran the draw; it is responsible for the request. You can also email privacy@bitsmatter.co.uk and we will pass the request to that business and help it respond. For data for which Bits Matter is the controller, email us directly and we will respond within one month.
We will post any changes to this policy here and, for material changes, email dashboard users.