Privacy

Provisional text, legal review in progress.

Who is responsible?

Kanso Démo is responsible for your loyalty card. Contact: the shop, at the counter.

The shop uses the Kanso Fidélité service of Sakura Care SRL (company number 1006.924.039, Belgium), which processes your data on the shop's behalf, as a processor.

What data?

Your first name, your phone number or e-mail, your language, the date you accepted the privacy policy, your optional choice to receive the shop's offers, your card code and the history of your stamps and rewards (date and staff member). No payment data.

Why?

To keep your loyalty card, find you at the counter, give you your reward and prevent stamp fraud.

Messages

If you accepted offers, Kanso Démo can send you short messages: an offer, or a small "we miss you" note when you have not visited for a while. Without your consent you receive no offers and no "we miss you". When your card is created you receive a welcome message, even if you did not accept offers.

These messages appear on your card page and, if you added the card to Google Wallet, on that card too (with a notification, at most one a day); only in that case is their content passed to Google. Kanso deletes them after 180 days; in Google Wallet they are no longer shown after 30 days. You can withdraw your consent at any time, from your card page or by asking the shop.

On what basis?

Performance of the loyalty card you ask for (Art. 6(1)(b) GDPR); fraud prevention, the shop's legitimate interest (Art. 6(1)(f)); the shop's offers, only with your consent (Art. 6(1)(a)), which you can withdraw at any time. Without a first name and a phone number or e-mail, the card cannot be created.

How long?

As long as your card is active; it is deleted 24 months after your last visit. Your consent to offers is kept until you withdraw it. To limit abuse, only a one-way (HMAC) fingerprint of your IP address is kept, for 24 hours.

Who receives your data?

The shop and Sakura Care SRL (Kanso). The server is hosted by Hostinger in Paris (European Union). If you choose "Add to Google Wallet", Google receives the card content (shop name and logo, card code, number of stamps); Google also processes it under its own privacy rules. Your data is not sold and not used for targeted advertising.

Your rights

Access, rectification, erasure, restriction, objection, portability, withdrawal of consent. Ask the shop, at the counter. You can also lodge a complaint with the Data Protection Authority, Rue de la Presse 35, 1000 Brussels, contact@apd-gba.be, www.dataprotectionauthority.be.