Privacy policy

1. Who we are

Loyyaly is operated by Fifty2 Global Solutions, Dubai, United Arab Emirates, and runs on the Wally wallet platform. For account holders we act as a data controller for account and billing data. For end customers who hold a card, the business that issued the card is the controller and we act as its processor under a data processing addendum.

2. Data we collect from website visitors

Contact form details you choose to send (name, business, email, phone, message). Technical data such as IP address, browser and pages visited, collected through analytics where enabled. We do not use advertising cookies without consent.

3. Data we collect from account holders

Business name, contact name, email, phone, billing details (processed by Stripe; we do not store full card numbers), login records and the content you add to the Service. We use this to provide and bill the Service, to support you and to send service messages.

4. Data about end customers

When a customer saves a card, the issuing business decides which fields to request at sign-up, for example a name, phone number, email or birthday. We also record stamps, rewards, redemptions and card status, and the device token needed to update the card in Apple Wallet or Google Wallet. We process this data only on the business's instructions and never sell it.

Location-based messages use the wallet's own proximity features on the customer's device; we do not track a customer's location.

5. Legal bases and purposes

We process data to perform our contract with you, to comply with legal obligations, and for legitimate interests such as securing the Service and improving it. Marketing emails to account holders are sent only with consent and include an unsubscribe link.

6. Sharing

We share data with sub-processors needed to run the Service, such as cloud hosting, Stripe for payments, email delivery and, where enabled, analytics providers. Cards are delivered through Apple Wallet and Google Wallet under their own privacy terms. We disclose data to authorities only where required by law.

7. International transfers

Data may be stored and processed on cloud infrastructure outside the UAE. Where this happens we rely on contractual safeguards with the provider consistent with the UAE Personal Data Protection Law and, where relevant, GDPR.

8. Retention

Account data is kept while the account is active and for a limited period afterwards for accounting and legal purposes. End-customer data is deleted when the issuing business deletes the customer or closes its account, subject to the retention periods the business sets.

9. Security

Data is encrypted in transit and at rest. Access is role-based and logged. We maintain backups, monitoring and an incident response process, and will notify affected parties promptly if a personal data breach is identified.

10. Your rights

You may ask for access to, correction of, export of or deletion of your personal data, and may object to or restrict certain processing. Account holders can export and delete customer data directly from the dashboard. End customers should contact the business that issued their card; we will support the business in responding. You may also contact us directly, and you have the right to complain to the UAE Data Office or your local supervisory authority.

11. Cookies

This website uses strictly necessary cookies and, where enabled, analytics cookies to understand how pages are used. You can block cookies in your browser; the site will continue to work.

12. Changes

We will post updates to this policy on this page and notify account holders by email of material changes.