⚠️ VORLAGE / TEMPLATE — vor Veröffentlichung von einer Anwältin/einem Anwalt prüfen lassen. / Have this reviewed by a lawyer before publishing.

This is a non-binding convenience translation — the German version (Datenschutzerklärung) prevails.

Privacy Policy

This privacy policy explains how personal data is processed in connection with the Stampbird platform (digital loyalty cards for Apple Wallet and Google Wallet), accessible via our website, the merchant dashboard and the associated interfaces.

1. Controller

Nebold, owner Taha Cemal Kaya (sole proprietorship) Wittelsbacherallee 107, 60385 Frankfurt am Main, Germany Represented by: Taha Cemal Kaya (owner) E-mail: office@nebold.com Privacy enquiries: office@nebold.com

2. Roles: controller and processor

Stampbird is a platform for business customers ("merchants"). Two roles under data protection law must be distinguished:

1. For merchant data (account, contract and billing data) we are the controller within the meaning of Art. 4 (7) GDPR.
2. For the data of the merchants' end customers (loyalty card holders) we act as a processor within the meaning of Art. 4 (8), Art. 28 GDPR. The controller for this data is the merchant that issued the loyalty card. End customers should primarily address access, erasure and other data subject requests to their merchant; the merchant's contact details are shown on the back of the loyalty card and on the claim page. We support merchants in answering such requests (see section 9).

Processing on behalf of merchants is governed by a data processing agreement pursuant to Art. 28 (3) GDPR between us and the respective merchant.

3. Merchant account data (we as controller)

When registering for and using the merchant dashboard, we process:

• name, business e-mail address, company details, team member roles (owner/manager/staff),
• login and session data (session cookie, timestamps, IP address for security-relevant events),
• contract and billing data (plan, payment status; payment details themselves are collected by our payment provider Stripe, see section 12).

Legal basis: Art. 6 (1)(b) GDPR (performance of a contract or pre-contractual measures, including the free trial). Statutory retention obligations (e.g. under commercial and tax law) are based on Art. 6 (1)(c) GDPR; security-related logging on Art. 6 (1)(f) GDPR (legitimate interest in secure operation).

4. End-customer data processed on behalf of merchants (we as processor)

When an end customer claims a merchant's loyalty card, we process the following data categories on behalf of the merchant:

• name (optional), e-mail address (optional),
• birthday (day and month only; only with separate consent for birthday campaigns),
• stamp/points and visit history of the loyalty card,
• the end customer's preferred language,
• technical pass-delivery data (serial number, wallet registration, push logs).

Purposes: issuing and updating the loyalty card, crediting stamps/points, redeeming rewards and — only with consent — marketing messages. The legal bases are determined by the respective merchant as controller (typically Art. 6 (1)(b) and (a) GDPR).

5. Consent records

When an end customer grants or withdraws a consent (e.g. marketing push, birthday campaign), we store a consent record as evidence pursuant to Art. 7 (1) GDPR, containing: the type of consent, granted/withdrawn, the version of the consent text shown at the time, a timestamp, and the IP address and browser identifier of the declaring device. If an end-customer profile is erased, these records are retained as consent history (Art. 17 (3)(e) GDPR).

6. Cookies

We only use technically necessary cookies:

• a session cookie (httpOnly) for signing in to the merchant dashboard and the scanner,
• where applicable, a cookie storing the language preference.

Legal basis: Section 25 (2) no. 2 TDDDG in conjunction with Art. 6 (1)(b) and (f) GDPR. There is no tracking; no analytics, advertising or third-party cookies are set by default. Should consent-requiring cookies be added in the future, they will only be set after active consent via a banner whose default setting is "decline".

7. Wallet platforms (Apple Wallet, Google Wallet)

If the end customer chooses to add the loyalty card to Apple Wallet or Google Wallet, the pass data (card content, serial number, updates) is transmitted to the respective platform:

• Apple Distribution International Ltd. / Apple Inc. ("Apple Wallet", push delivery via Apple's push service APNs),
• Google Ireland Ltd. / Google LLC ("Google Wallet").

Apple and Google process this data as independent controllers within the scope of the respective user account and operating system; their privacy policies apply. The transfer only takes place upon the end customer's active decision to add the pass to the wallet (Art. 6 (1)(b) GDPR in the relationship between end customer and merchant). A web pass without wallet integration is available as an alternative.

8. Push messages

Marketing push messages to the loyalty card (e.g. promotions, inactivity reminders, birthday greetings) are sent only with the end customer's prior consent (Art. 6 (1)(a) GDPR). Birthday campaigns additionally require the separate birthday consent. A frequency cap is enforced technically: at most 3 push messages within 7 days per end customer. Every send decision (sent/skipped and why) is logged. Consent can be withdrawn at any time via the self-service portal (section 9).

9. Self-service portal for end customers

The back of every loyalty card contains a signed link to the self-service portal ("My data"). There, the end customer can, without creating an account:

• retrieve a complete copy of their data in a structured, machine-readable format (Art. 15, Art. 20 GDPR),
• have their profile erased (anonymisation of personal data, revocation of the card; Art. 17 GDPR),
• view, grant and withdraw consents (Art. 7 (3) GDPR).

The portal fulfils these requests automatically on behalf of the respective merchant. In addition, the end customer may contact the merchant as controller directly at any time.

10. Retention periods

These periods are enforced by an automated erasure/anonymisation job.

11. Data residency

Hosting and data storage take place exclusively on servers in Germany or the European Union. As a rule, no transfers to third countries take place; exceptions (e.g. wallet platforms under section 7, individual service providers under section 12) occur only on the basis of an adequacy decision (in particular the EU-US Data Privacy Framework) or EU Standard Contractual Clauses pursuant to Art. 46 GDPR.

12. Recipients and sub-processors

We use the following service providers:

A current list of sub-processors for processing on behalf of merchants is provided to merchants as part of the data processing agreement.

13. Your rights (Art. 15–21 GDPR)

You have the following rights vis-à-vis the respective controller:

1. access to the data processed (Art. 15 GDPR),
2. rectification of inaccurate data (Art. 16 GDPR),
3. erasure (Art. 17 GDPR),
4. restriction of processing (Art. 18 GDPR),
5. data portability (Art. 20 GDPR),
6. objection to processing based on Art. 6 (1)(f) GDPR (Art. 21 GDPR),
7. withdrawal of consent with effect for the future (Art. 7 (3) GDPR).

Merchants should send requests to office@nebold.com. End customers should use the self-service portal (section 9) or contact their merchant; end-customer requests sent to us are forwarded to the responsible merchant.

14. Right to lodge a complaint with a supervisory authority

Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority, in particular at your habitual residence, your place of work or the place of the alleged infringement (Art. 77 GDPR). The authority competent for us is: The Hessian Commissioner for Data Protection and Freedom of Information (HBDI), Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany.

15. Changes to this privacy policy

We update this privacy policy when the processing or the legal situation changes. The version published on this page applies; the date of the last update is stated above.