At Perkss Protocol S.L. we care about your privacy. This policy aims to explain everything you need to know about how and why we collect, process, and protect your personal data when you download, log in, and browse our application (Perkss). We manage all data in accordance with the General Data Protection Regulation (GDPR).
WHAT IS PERSONAL DATA?
Personal data refers to an identified or identifiable individual. In other words, personal data is any type of information that can be directly or indirectly attributed to a natural person.
WHO IS RESPONSIBLE FOR PROCESSING YOUR PERSONAL DATA?
Our Spanish company, Perkss Protocol S.L. is responsible for the collection and processing of your personal data (we are the Data Controller).
CIF: B44719995
Address: Avda. Del Doctor Severo Ochoa, 47, 28100, Madrid
Phone: +34 656 96 18 23
Email: support@perkss.io
CATEGORY OF DATA
MANDATORY DATA
Mandatory data is necessary only for internal purposes (see section "Why do we process your personal data?") and will not be shared with third parties. If you have logged into your customer account, you can view and modify your personal data there to keep it updated.
Identifiers
Contact information - full name, email, phone number, member ID, national identity document, address.
Device information - mobile operating system.
Financial information - your payment details will only be collected by our external payment service providers and this data will be used exclusively to process payment where applicable. These providers include Apple Pay, Google Pay, and Stripe, although these may change in the future. Perkss will not have access to your full financial data provided on the aforementioned payment platforms. If the user has given permission to Stripe, Stripe may randomly show Perkss the user's name and the last 4 digits of their card used in any interactions they have had with this entity on any other platform. At no time will Perkss have access to your complete payment data.
Navigation information: we collect this information automatically as you use the Perkss App. We may use mobile analytics software (such as Azure Insights) to better understand the functionality of our mobile application on your device. This software may track information such as how often you use our application, the average time spent in the application, in-app performance, purchasing patterns, or where you downloaded the application.
We do not link the information we store in the analytics software to any personally identifiable information you have submitted to our application. The same applies to our AI algorithms, which will help us anticipate our customers' needs and improve our services. But in no case will we make decisions based solely on automated processing.
VOLUNTARY DATA
Once you have set up your Perkss account, there will be data that you voluntarily decide to disclose and always with your consent. This data will be anonymized for third parties, so you will not be personally identifiable by them. Segmentation and/or profiling will be based exclusively on anonymous data.
Demographic data
Age
Gender
City of residence
Nationality
Postal code
General interests
Purchase history (in and out of the application)
Location information: we may collect information about your exact geolocation to inform you about products and services that may be of interest to you, but only if you specifically agree to the collection of such data in connection with this particular service. At no time will we use such information for marketing or analytical purposes.
ACCURACY OF DATA
You guarantee the veracity of the personal data provided and undertake to communicate any modifications to Perkss. You will be responsible, in any case, for the veracity of the data provided, reserving Perkss the right to exclude from the services any User who has provided false data, without prejudice to other actions that may be applicable by law.
It is recommended that you protect your data with the utmost diligence using appropriate security tools. Perkss will not be responsible for any theft, illegal modification, or loss of data directly or indirectly related to your action or inaction.
Any modification or update of the data must be communicated to Perkss through the means provided in this Privacy Policy.
REGISTRATION
You can register to join the Service (as defined in our Terms of Use) and create a profile directly through the Application by providing us with your contact information, via the user's mobile phone.
For account recovery in case of lost credentials, the process will be managed through a manual email provided by the user.
CHILDREN
Perkss App is intended for adults only. Following GDPR criteria, in Spain we do not knowingly collect or process personal data from children under 14, nor do we sell products to minors under 18. If you are a parent or legal guardian and suspect that your child may have provided us with information, please contact us.
WHY DO WE PROCESS YOUR PERSONAL DATA? ON WHAT LEGITIMACY BASIS DO WE RELY?
The main purpose of collecting and processing your personal data is for security reasons related to your account (account creation, identity verification, technical support and customer service through our command center services, credit restoration in case of device failure). The legal basis is set out in article 6.1.b) GDPR: processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
To provide the services requested in our application (Loyalty Experiences). The legal basis is set out in article 6.1.b) GDPR: processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
To manage your membership, keeping it updated to grant you your Perks (Rewards) or Loyalty Rewards. The legal basis is set out in article 6.1.b) GDPR: processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
To provide you with our Services, including the creation of a personalized content feed and offers that are unique and relevant to you. The legal basis is set out in article 6.1.a) GDPR: the data subject has given consent to the processing of his or her personal data for one or more specific purposes.
For the execution and fulfillment of the contract for the sale of products or services you have purchased, or of any other contract between you and us. The legal basis is set out in article 6.1.b) GDPR: processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
To identify and analyze how people use our Services. The legal basis is set out in article 6.1.f) GDPR: processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party.
To be able to provide you with your purchase history (in and out of the application) and order details (where applicable). The legal basis is set out in article 6.1.b) GDPR: processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
In cases where the payment gateway provides us with your name for having made more than five (5) payments. The legal basis is set out in article 6.1.c) GDPR: processing is necessary for compliance with a legal obligation to which the controller is subject.
To respond to your inquiries or support requests. The legal basis is set out in article 6.1.b) GDPR: processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
We may ask you to fill out surveys about our company, the companies we collaborate with, and our Services. The legal basis is set out in article 6.1.a) GDPR: the data subject has given consent to the processing of his or her personal data for one or more specific purposes.
We may contact you periodically (either by email, direct mail, WhatsApp, or through push notifications) for marketing and advertising purposes, to inform you about application updates, features, products, or services that we believe may be of interest to you. The legal basis is set out in article 6.1.a) GDPR: the data subject has given consent to the processing of his or her personal data for one or more specific purposes.
We may process your anonymized data to conduct market research and optimize our services. The legal basis is set out in article 6.1.f) GDPR: processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party.
For the use of blockchain technology. The legal basis is set out in article 6.1.b) GDPR: processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
To prevent, investigate, or report fraud or any illegal or criminal activity. The legal basis is set out in article 6.1.c) GDPR: processing is necessary for compliance with a legal obligation to which the controller is subject.
To contact you when necessary for the aforementioned purposes. The legal basis is set out in article 6.1.b) GDPR: processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
DATA RETENTION POLICY
We will retain and process your personal data for the strictly necessary time, i.e., for the duration of our contractual obligations with you as a customer.
In all cases, when you unsubscribe, object to receiving promotional information and news, or revoke your consent, your data will be blocked for the legally applicable periods in case of claims and subsequently deleted after that period.
WHO DO WE SHARE YOUR PERSONAL DATA WITH?
Your personal data may be accessible exclusively to third parties (companies) who need the data to perform a service on our behalf. The GDPR considers these companies personal data processors (data processors). We follow strict policies for selecting suitable data processors who can offer guarantees regarding the security and confidentiality of your personal data.
We may also need to share data with third parties due to legal requirements (e.g., if required by public, administrative, or judicial authorities for the investigation of possible security breaches or fraud attempts, as well as to respond to any claims brought against Perkss Protocol S.L. or to protect and defend the rights of our employees and those of our customers).
Your personal data will normally be processed by us within the European Union. However, some of our service providers (data processors) may be based in other territories, such as the United States, which may not offer the same level of data protection required by the European Union. In such cases, we will ensure that these territories offer an adequate level of legal protection, such as standard contractual clauses, or that they have adhered to the U.S. Chamber of Commerce in accordance with the European Commission's adequacy decision, as well as in the case of other countries that comply with specific codes of conduct approved by the European Commission or the issuance of certifications under appropriate data protection programs.
We reserve the right to transfer your personal data only in case of merger or acquisition by a third party, always through the necessary contractual agreements to comply with the GDPR requirements.
HOW DO WE PROTECT YOUR PERSONAL DATA? (SECURITY PRACTICES)
We are committed to protecting your personal data. Any personal information you provide to us will be stored on secure servers. We take reasonable steps to establish secure environments where your information is protected from unauthorized access, unauthorized disclosure, or destruction, including (but not limited to) staff training on data protection protocols. Although zero risk does not exist, we try to implement measures to safeguard your personal data and reduce the likelihood of security risks occurring.
Our team of people and collaborators working at or for Perkss Protocol S.L. are obliged to maintain confidentiality regarding the personal data they access.
WHAT ARE YOUR RIGHTS AND HOW CAN YOU EXERCISE THEM?
Any person has the right to obtain confirmation as to whether or not Perkss Protocol S.L. is processing their personal data. In addition, any person may request to exercise the following rights before Perkss Protocol S.L. by sending a written request to the postal or email address provided in the header:
You can contact us at any time if you have any questions about our privacy policy or the processing of your personal data: support@perkss.io.
Right to be informed - you have the right to be informed about the collection and use of your personal data in clear, transparent, and easily understandable language.
Right of access - you have the right to access your personal data and to receive a copy thereof.
Right to rectification - you have the right to have your personal data rectified if it is inaccurate or incomplete.
Right to erasure - this right is also known as the "right to be forgotten" and basically means that, in certain circumstances, you can request that your personal data be erased.
Restriction of processing: you have the right to request the erasure or restriction of further processing of your personal data. This is not an absolute right and only applies in certain circumstances. If the restriction applies, we are allowed to store your personal data (duly blocked) but not to use it.
Right to data portability: you have the right to obtain and reuse your personal data across different services and for your own purposes. It allows you to easily move, copy, or transfer your personal data from one IT environment to another securely, without affecting its usability. This right only applies to information that you have previously provided to us as data controllers.
Right to object: you have the right to object to the processing of your personal data in certain circumstances. This is an absolute right when you want us to stop using your data for direct marketing. In other cases, we may continue to process your personal data as long as we can demonstrate that we have compelling legitimate grounds to do so.
Right not to be subject to individual decisions based solely on automated processing (including profiling): you have the right to object to individual decisions based solely on automated processing, including profiling, which may have legal effects or similar significant effects on you.
You can revoke the consent previously granted at any time by contacting us at the addresses mentioned above. However, please note that if you revoke your consent, we may not be able to continue providing you with certain services.
You also have the right to file a complaint about how we handle your personal data with the data protection supervisory authority in your country. The AEPD (Spanish Data Protection Agency) is the national data protection authority in Spain.
We may update our Privacy Policy from time to time. Whenever we make a change, we will post the updated Policy. We encourage you to review our Policy periodically. If we make a material change to our Privacy Policy that reduces your privacy rights, we will continue to abide by our previous Policy for information collected when it was in effect, or we will ask for your consent to the change.