1. Who is responsible
Skanni is developed by iQQi, a brand of Generic Stuff, Lda. We are the controller for personal data used to administer merchant accounts, handle enquiries and manage our own service relationship.
NIF: 513 277 978
Estrada da Branqueta, 25
4930-682 Valença, Portugal
Privacy and product contact: [email protected]
For a merchant’s customer loyalty programme, the merchant normally determines the purposes of processing and is the controller. We process programme data on its behalf where we act as its processor. The merchant’s own privacy notice explains its use of your data; ask the business shown on your card about its programme.
2. Data involved
- Merchant accounts: login email, authentication data, business name, account identifiers, and business or contact details you provide.
- Programme settings: logo, colours, reward settings and customer support email. Information placed on a card or enrolment page is intended to be visible to customers.
- Loyalty participation: details requested in the enrolment form, pass identifiers, stamp balances, reward activity, card status and any recorded consent choices. The actual fields depend on the programme.
- Support: messages, contact details and information supplied to resolve a request.
- Technical use: IP address, browser or device information, request times, session identifiers and operational or security logs processed by the services that deliver Skanni.
The current public landing page does not collect payments. If paid checkout is enabled, its notice must identify the payment provider and the billing data involved before payment details are submitted.
3. Why data is used
| Purpose | Legal basis for our controller activities |
|---|---|
| Set up an account, answer a requested enquiry and provide the service | Contract or steps you request before a contract. For staff acting for a business, our legitimate interest in managing that business relationship. |
| Protect accounts, diagnose faults and prevent misuse | Legitimate interests in maintaining a secure, reliable service, balanced against individuals’ rights. |
| Meet accounting, tax or other legal requirements | Legal obligation, where applicable. |
| Optional promotional messages or non-essential tracking | Consent where required. Participation in a loyalty programme is not, by itself, permission for unrelated marketing. |
For customer programme data processed on behalf of a merchant, that merchant determines and explains the relevant legal basis. Required account fields are needed to provide access; without them we may be unable to create or maintain the account. Optional consent can be refused or withdrawn.
4. Who receives data
Data is made available as needed to authorised personnel and service providers supporting hosting, databases, authentication, wallet passes and support. The website and merchant dashboard are hosted on Cloudflare, which also runs our backend and database. PayMeGPT provides the wallet-pass services and the website’s chat assistant. Apple and Google handle use of their wallet products under their own applicable terms and privacy notices.
A merchant can access data for its own loyalty programme. Information deliberately published on a pass, including the merchant’s support email, is visible to its holders. Authorities or professional advisers may receive information when required by law or necessary to establish or defend legal rights.
The pages also request fonts from Google Fonts and, where used, styles from cdnjs; those requests expose technical connection information to the asset providers. Contact us for details about the providers relevant to your use.
5. International processing
Some technology providers operate internationally, so processing may involve locations outside the European Economic Area. An overseas transfer requires a valid GDPR transfer mechanism, such as an applicable adequacy decision or appropriate safeguards, including standard contractual clauses where relevant.
For information about the locations and safeguards applicable to your data, or to request a copy of relevant safeguards, contact [email protected]. This notice does not represent that all data is stored exclusively in Portugal or the EU.
6. How long data is kept
Retention depends on why the data is needed. Account and programme records are needed while the account or programme is in use; support information while an enquiry is being handled and for relevant follow-up; security records for investigating and preventing incidents. Legal obligations and the need to establish or defend claims can require some records to be kept longer.
For customer data held on a merchant’s behalf, retention and deletion follow the merchant’s lawful instructions and the applicable processing agreement. Ask us about account closure or erasure. This notice does not imply that an automatic deletion tool is currently available.
Removing a pass from your phone does not, by itself, delete the merchant’s programme records. Clearing browser storage removes local data, not the corresponding server account.
7. Browser storage, cookies and camera
The merchant dashboard uses session storage for its login session and local storage for language preferences and local drafts or settings. You can clear these using your browser settings, although doing so may sign you out or remove unsynchronised drafts.
The hosting services may also use technical cookies or logs to deliver and protect pages. Any non-essential analytics or advertising technologies requiring consent must be disclosed and offered with a valid choice before activation; this notice is not consent to tracking.
The card scanner requests camera access when you start it. You can deny or revoke that permission in your browser. The scanner uses the camera to read a code; the code or pass identifier is then used to perform the requested programme operation.
8. Your rights and choices
Depending on the circumstances, you may request access, correction, erasure, restriction or portability, and object to processing based on legitimate interests. You may withdraw consent without affecting earlier lawful processing. You can object to direct marketing at any time.
Write to [email protected]. We may need proportionate information to verify your identity. Requests normally receive a response within one month; if a lawful extension is necessary, we will explain it within that month.
For a merchant’s loyalty records, contact that merchant first. If you contact us, we can help identify the appropriate controller and assist with requests within our role.
You may complain to Portugal’s Comissão Nacional de Proteção de Dados (CNPD) or another competent supervisory authority.
9. Security and younger users
Account authentication and merchant-specific access are used to restrict access to programme data. No online system can guarantee absolute security. Protect your credentials, use a trusted device and report suspected misuse promptly.
Merchant accounts are intended for adults authorised to represent a business. Merchants must consider age-related requirements for their own programmes. Please avoid entering children’s data or sensitive information that the service does not need.
The current stamp and reward functions do not use automated decision-making intended to produce legal or similarly significant effects on individuals.
10. Updates and related information
This notice covers Skanni’s current website and merchant service. It will need updating when processing changes, including when payments, optional marketing or additional providers are introduced. Material changes will be communicated where required.
See also the Terms & Conditions. The merchant’s customer-facing privacy notice and any required data-processing agreement remain separate documents.