Data processing addendum
Last updated 25 October 2026. Operated by Fifty2 Global Solutions, Dubai, United Arab Emirates.
This addendum forms part of the terms of use and applies whenever Loyyaly (the Processor, operated by Fifty2 Global Solutions) processes personal data of end customers on behalf of an account holder (the Controller).
1. Subject matter and duration
Processing of end-customer personal data to issue, update and manage digital loyalty cards, record stamps and rewards, deliver messages and provide reporting, for the duration of the Controller's account.
2. Nature and purpose
Hosting, storage, transmission to Apple Wallet and Google Wallet, display in the Controller's dashboard and Stamper App, analytics and export, solely to provide the Service as instructed by the Controller.
3. Categories of data and data subjects
Data subjects are the Controller's customers. Data may include name, contact details and birthday where the Controller chooses to collect them, loyalty activity (stamps, rewards, redemptions, timestamps, issuing staff and location), card status and wallet device tokens.
4. Controller instructions
The Processor processes personal data only on documented instructions from the Controller, including those given through the dashboard, unless required by law. The Controller is responsible for the lawfulness of the instructions and for obtaining any required consents from data subjects.
5. Confidentiality and security
Personnel with access to personal data are bound by confidentiality. The Processor implements appropriate technical and organisational measures including encryption in transit and at rest, role-based access, logging, backups, vulnerability management and incident response.
6. Sub-processors
The Controller authorises the use of sub-processors for cloud hosting, payment processing, email delivery and analytics. A current list is available on request. The Processor will give notice of changes and remains responsible for its sub-processors.
7. Data subject rights
The Processor provides dashboard tools to export and delete customer data and will assist the Controller in responding to access, correction, deletion and objection requests within a reasonable time.
8. Personal data breaches
The Processor will notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data, with the information reasonably available to help the Controller meet its own notification obligations.
9. International transfers
Where personal data is processed outside the UAE, the Processor ensures contractual safeguards with the relevant provider consistent with the UAE Personal Data Protection Law and, where applicable, GDPR.
10. Audit and deletion
The Processor will make available information necessary to demonstrate compliance and allow reasonable audits, subject to confidentiality. On termination, the Controller may export data; the Processor deletes remaining personal data within a reasonable period unless retention is required by law.
Questions about this document: [email protected].