Privacy Policy

Regulatory Compliance

Perkstar Ltd is committed to protecting your privacy and handling personal data responsibly. The following laws apply where relevant to the processing described in this policy:

GDPR: The UK General Data Protection Regulation (UK GDPR) and the EU General Data Protection Regulation (EU GDPR)

CCPA/CPRA: The California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA)

If you have questions about our compliance or wish to exercise your data protection rights, contact us at legal@perkstar.co.uk.

1. Introduction

This Privacy Policy explains how Perkstar Ltd (“Perkstar”, “we”, “us”, or “our”) collects, uses, shares, and protects your personal information when you use our website at www.perkstar.co.uk and our digital loyalty card platform (together, the “Services”).

We take your privacy seriously. This policy is written in plain language so you can understand exactly what happens to your data. If anything is unclear, please contact us.

Perkstar Ltd (registered in England and Wales, Company No. 16256732) is the controller for website enquiries, business-account administration, billing and our own business operations. For loyalty-card customer data processed on a business’s instructions, that business is normally the controller and Perkstar acts as its processor under our Data Processing Agreement.

2. Who This Policy Applies To

This policy explains our website and business-account processing. If you hold a loyalty card, the business running that programme controls how your information is used for its rewards and communications. Read that business’s privacy notice alongside Perkstar’s current platform Privacy Notice. Perkstar also acts as a controller for limited purposes such as security, fraud prevention and meeting legal obligations.

3. Information We Collect

3.1 Information You Give Us

When you create an account or use our Services, you may provide: your name and email address; business name and address; phone number; payment information (processed securely by Stripe — we never see your full card details); and any other information you choose to share with us.

3.2 Information We Collect Automatically

When you use our Services, we automatically collect: device information such as browser type, operating system, and device identifiers; usage data including pages visited, features used, and time spent on our platform; IP address and approximate location based on it; and referral source showing how you found us.

3.3 Information from Third Parties

We may receive information from: Google if you sign in using your Google account; payment processors when you complete transactions; and analytics providers that help us understand how people use our Services.

4. How We Use Your Information

We use your information to: provide, maintain, and improve our Services; process your payments and send transaction confirmations; respond to your questions and provide customer support; send you updates about your account and our Services; detect and prevent fraud or abuse; comply with legal obligations; and analyse how our Services are used so we can make them better.

We do not sell personal information for money. Optional advertising disclosures are explained below; some may be considered a sale or sharing under applicable US privacy laws.

5. Legal Basis for Processing

Under UK and EU data protection law, we need a lawful basis to process your personal information. Here’s how each basis applies to our processing:

Contract: Processing necessary to provide our Services to you, including managing your account, processing payments, and delivering loyalty card functionality.

Legitimate Interests: Processing for proportionate business purposes such as responding to enquiries, operating and securing our Services, and preventing fraud. We consider the impact on your rights. This is not a substitute for consent where optional cookies or similar tracking require it.

Consent: Where required for optional analytics, advertising measurement or marketing communications. You can withdraw consent without affecting the lawfulness of processing before withdrawal. Businesses operating loyalty programmes are responsible for the lawful basis of their customer communications.

Legal Obligation: Processing required to comply with laws, such as tax and accounting requirements.

6. How We Share Your Information

We share your information only in these circumstances:

Service Providers: Our website is hosted on Framer. The current platform uses Supabase for database services and Vercel for application hosting, with other processors for email delivery, payments, security and operations, including Resend and Stripe. Website analytics providers include Google Analytics and Contentsquare; Meta, Google Ads and OpenAI receive the optional advertising data described in this policy and our Cookie Policy. See the current platform sub-processor list for platform suppliers, their purposes and processing locations.

Legal Requirements: When required by law, court order, or government request, or to protect our rights, property, or safety.

Business Transfers: If Perkstar is involved in a merger, acquisition, or sale of assets, your information may be transferred. We will notify you of any change in ownership or use of your information.

With Your Permission: In any other situation, we will ask for your consent before sharing your information.

7. Cookies and Tracking Technologies

We use cookies and similar technologies to: keep you logged in; remember your preferences; understand how you use our Services; and improve your experience.

Our Cookie Settings control optional Google Analytics and Contentsquare analytics, and Google Ads, Meta and OpenAI advertising measurement. The browser tags covered by those choices are held back until the relevant permission is present. Earlier Google/OpenAI choices do not automatically authorise the additional website vendors: a fresh choice is required. OpenAI measurement remains server-side; its browser pixel is not loaded. Framer’s built-in analytics are described separately in our Cookie Policy. You can also manage cookies in your browser.

For full details, see our Cookie Policy.

7.1 Optional Google and OpenAI Measurement for Business Signups

With your analytics choice enabled, Google Analytics 4 helps us understand visits and confirmed new business trial signups on perkstar.co.uk and merchant pages of dashboard.perkstar.co.uk. It uses pseudonymous browser identifiers. We send simplified page addresses without query strings. This measurement does not cover customer loyalty-card enrolment or the staff scanner.

With your advertising measurement choice enabled, Google Ads links permitted Google ad-click identifiers and campaign information to a confirmed new business trial and the first positive payment for a Perkstar subscription. With your explicit OpenAI advertising choice, our server sends those events with a permitted OpenAI ad-click reference, oppref, when available. If you also explicitly agree to OpenAI email matching before your first business account is provisioned, we normalise and hash your server-verified merchant-account email using SHA-256 and send the hash to OpenAI to help match these events to ads. This can support matching when no ad-click reference is available. The hash is personal data, not anonymous data. We also send an opaque event identifier, event time and, for the first payment, the actual amount and currency. We do not send raw email addresses, customer email addresses, phone numbers, postal addresses or external account identifiers for this measurement. No browser form matching is used. Google personalised advertising is disabled for this feature, and OpenAI events opt out of future user-level personalisation.

Analytics and advertising measurement are separate, optional choices. Google measurement scripts load only after the relevant choice. You can change or withdraw either choice using “Cookie Settings”. Accepting or saving the newly disclosed advertising choice covers Google Ads, Meta, OpenAI click measurement and OpenAI hashed merchant-email matching. The analytics choice also covers Contentsquare on this website. Earlier choices are not automatically upgraded: an earlier Google-only choice does not permit OpenAI measurement, and an earlier OpenAI click-measurement choice does not permit email matching. We do not backfill hashes or conversions for existing acquisition profiles. Refusing these choices does not prevent you from using Perkstar.

We remember your measurement choices for 180 days. Saved Google ad-click and campaign attribution expires no later than 90 days after capture. An OpenAI ad-click reference is valid for measurement for 30 days after capture and is removed from server attribution records by routine cleanup. The shared browser cookie may remain for up to 90 days for Google; an expired OpenAI reference is ignored and removed on the next visit. An email hash is stored only on our server for at most 90 days from capture, additionally capped at 90 days from creation of the acquisition profile; ordinary visits and reconfirmation do not extend this period. We erase the hash on withdrawal of matching or OpenAI measurement, or when its consent expires. Withdrawal stops future processing covered by that choice and queued matching exports, but does not undo data already processed. Separately permitted click-only measurement may continue if only matching permission is withdrawn. Analytics client/session identifiers are saved with Google attribution only when both relevant choices are enabled. Operational trial/payment receipts and legally required billing records follow separate retention rules.

8. How Long We Keep Your Information

We keep your information only as long as necessary for the purposes described in this policy. Specifically:

Business-account and enquiry information is retained for as long as needed to provide the Services, answer enquiries, resolve disputes and meet legal obligations. The period depends on the data, purpose and applicable requirements. Loyalty-card customer data processed for a business follows that business’s instructions and our platform retention terms, including a 90-day post-termination grace period before routine deletion or anonymisation, subject to lawful retention exceptions.

Billing, tax and accounting records are retained for the applicable statutory period. Pseudonymised loyalty-ledger records may be retained where needed for accounting or legal requirements, usually six years for UK records. These records are separate from optional advertising attribution.

Google acquisition identifiers and campaign attribution saved by Perkstar are retained for at most 90 days from capture. This is separate from Google’s own processing and from operational or billing records.

When information is no longer needed, we securely delete or anonymise it.

9. How We Protect Your Information

We use technical and organisational measures appropriate to the information and risk, including encryption in transit and at rest, access controls, monitoring and payment processing through Stripe. Our website and platform use the hosting providers described in this policy and the current platform sub-processor list. No website or online service can be guaranteed completely secure.

If a personal-data breach occurs, we assess it and notify the relevant regulator where required, without undue delay and, where feasible, within 72 hours of becoming aware of it. We notify affected individuals without undue delay where the breach is likely to create a high risk to their rights and freedoms. Where we act as a processor, we notify the relevant business controller without undue delay.

10. International Data Transfers

The marketing website is hosted by Framer. Our platform’s core database is hosted with Supabase in Ireland and application functions with Vercel in Dublin and London. Some service providers, support operations and business-selected integrations process information in other countries, including the United States. We do not promise that all UK or EU data remains exclusively in the UK or EU.

Where restricted international transfers take place, we use applicable safeguards such as an adequacy decision, the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum where needed. The safeguards depend on the recipient and transfer. Contact us for more information about safeguards relevant to your data.

For current platform hosting and supplier details, see the platform Privacy Notice and sub-processor list. The marketing website uses additional services listed in our Cookie Policy.

11. Your Rights Under UK and EU Law (GDPR)

If you are in the UK, EU, or EEA, you have the following rights regarding your personal information:

Right of Access: You can request a copy of all personal information we hold about you. We will provide this within one month, free of charge.

Right to Rectification: If any information we hold is inaccurate or incomplete, you can ask us to correct it.

Right to Erasure: You can ask us to delete your personal information in certain circumstances, such as when it’s no longer needed or you withdraw consent.

Right to Restrict Processing: You can ask us to limit how we use your information while we resolve a complaint or verify accuracy.

Right to Data Portability: You can request your information in a structured, commonly used format to transfer to another service.

Right to Object: You can object to processing based on legitimate interests or for direct marketing purposes.

Right to Withdraw Consent: Where we rely on consent, you can withdraw it at any time. This won’t affect the lawfulness of processing before withdrawal.

Right to Lodge a Complaint: You have the right to complain to a supervisory authority. In the UK, this is the Information Commissioner’s Office (ICO) at ico.org.uk.

To exercise your rights, contact privacy@perkstar.co.uk or legal@perkstar.co.uk. We normally respond within one month, subject to lawful extensions or exceptions, and may ask for information needed to verify your identity. For a loyalty programme’s customer data, contact the business running that programme first; we assist that business where we act as its processor.

12. Your Rights Under California Law (CCPA/CPRA)

Where the CCPA/CPRA applies to our processing of a California resident’s personal information, the rights described in this section apply subject to the law’s scope and exceptions.

12.1 Categories of Personal Information We Collect

In the past 12 months, we have collected these categories of personal information: identifiers such as name, email address, IP address, and account name; commercial information including transaction history and products purchased; internet or network activity such as browsing history and interactions with our Services; and professional or employment information such as business name and job title.

12.2 How We Use This Information

We use this information for the business purposes described in Section 4 of this policy, including providing our Services, processing payments, improving our platform, and communicating with you.

12.3 Sale and Sharing of Personal Information

We do not sell personal information for money. With advertising permission, we disclose website or conversion information to the advertising providers identified in this policy. Depending on how the information is used, these disclosures may constitute a sale or sharing for cross-context behavioural advertising under applicable US privacy laws. You can switch off optional advertising in Cookie Settings or contact us with an opt-out request.

12.4 Your California Privacy Rights

Right to Know: You can request details about what personal information we have collected, used, disclosed, and sold in the past 12 months, including the specific pieces of personal information we hold.

Right to Delete: You can request that we delete personal information we collected from you, subject to certain legal exceptions.

Right to Correct: You can request that we correct inaccurate personal information we hold about you.

Right to Opt-Out of Sale or Sharing: Where applicable, you can opt out of advertising disclosures through Cookie Settings or send a request to privacy@perkstar.co.uk.

Right to Limit Use of Sensitive Information: We do not collect sensitive personal information beyond what is necessary to provide our Services.

Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights. You will not receive different prices, quality of service, or be denied service for making a privacy request.

12.5 How to Make a Request

To exercise your California privacy rights, you may: email us at legal@perkstar.co.uk with the subject line “California Privacy Request”; or submit a request through our website contact form.

We will verify your identity before processing your request using the email address associated with your account. You may designate an authorised agent to make a request on your behalf by providing written permission. We will respond to verifiable requests within 45 days. If we need more time, we will inform you of the reason and extension period in writing.

12.6 California “Shine the Light” Law

California residents may contact privacy@perkstar.co.uk to ask about disclosures for third-party direct marketing under California Civil Code Section 1798.83, where that law applies. Our advertising disclosures and available choices are explained above.

13. Children’s Privacy

Our business-account services are intended for business users, not children. A business operating a loyalty programme is responsible for its customer-facing privacy notice and any age or parental-consent requirements. Contact us if you believe a child’s information has been handled incorrectly; we will investigate and take appropriate action.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will: update the “Last updated” date at the top of this policy; notify you by email if we have your email address; and post a notice on our website.

We encourage you to review this policy periodically. This notice explains our data practices; continuing to use the Services does not itself give consent to optional tracking or to a new purpose that requires consent.

15. Contact Us

If you have any questions about this Privacy Policy or how we handle your information, please contact us:

Perkstar Ltd Company No. 16256732 86-90 Paul Street, 3rd Floor London, EC2A 4NE United Kingdom

Email: privacy@perkstar.co.uk or legal@perkstar.co.uk. General support: support@perkstar.co.uk.

We aim to respond to all enquiries within 5 business days.