SME Loyalty Privacy Policy

1. Definitions

• Platform: The SME Loyalty website, software, mobile interfaces, and related services.
• Merchant / Business / Partner: Any business subscribing to the Platform to manage its own loyalty or rewards programmes.
• Customer / User: Any individual participating in a loyalty programme offered by a Merchant through the Platform.
• Loyalty Programme / Rewards Programme: Any reward, promotion, incentive, cashback, discount, or loyalty offer created by a Merchant.

2. Categories of Data We Collect

3. How We Use Personal Data

SME Loyalty acts as a Data Processor for customer data and a Data Controller for merchant accounts. Data is used for:

• Operating and maintaining the Platform
• Enabling Merchants to manage loyalty programmes
• Sending notifications regarding rewards, promotions, and programme updates
• Providing analytics, reporting, and insights to Merchants
• Improving Platform functionality, services, and user experience
• Communication about subscriptions, support, or feedback requests
• Connecting and synchronising Merchant-authorised WooCommerce and Shopify stores, and Wix stores if a Wix connector is made available
• Matching customer identities, processing paid orders and refunds, awarding or reversing loyalty points, and creating or applying reward discounts
• Verifying webhook signatures and preventing duplicate ecommerce events
• Processing customer loyalty activity, reward allocations, automatic checkout discounts, reward redemptions, refund reversals, and loyalty synchronisation between authorised e-commerce platforms and the SME Loyalty Platform.

Data may also be used for:

• AI-powered analytics and behavioural modelling
• Automated generation of business insights and recommendations
• Customer segmentation and engagement scoring
• AI-assisted campaign generation and optimisation
• Win-back campaign recommendations and targeting
• Improving AI models, algorithms, and platform intelligence capabilities
• Detecting usage trends and improving customer engagement functionality

3.1 Automated Processing and AI-Powered Features

SME Loyalty may use automated technologies, machine learning systems, and AI-powered tools to analyse customer and platform data.

These systems may assist businesses with:

• Customer segmentation
• Behavioural analysis
• Loyalty trend identification
• Customer retention insights
• Automated campaign recommendations
• Win-back campaign generation
• Engagement optimisation suggestions

Explicit Consent: By participating in a Merchant's loyalty programme, Customers consent to the collection and processing of their personal data. Merchants are responsible for obtaining and recording this consent in compliance with POPIA. AI-generated outputs are probabilistic in nature and may contain inaccuracies, assumptions, or incomplete interpretations. SME Loyalty does not make decisions on behalf of merchants or customers and does not solely rely on automated processing for legally binding decisions affecting individuals. Businesses remain responsible for reviewing, validating, and approving all AI-generated outputs prior to use.

3.2 Profiling and Customer Targeting

The Platform may use customer activity, transaction history, engagement patterns, and loyalty behaviour to generate customer profiles, audience segments, engagement scores, or campaign targeting recommendations.

This profiling is used solely to support merchant loyalty programme management and customer engagement activities.

Merchants are responsible for ensuring they have the necessary lawful basis and customer consent required for personalised marketing and customer engagement activities under applicable laws, including POPIA.

4. Data Sharing and Third Parties

• Sub-Processors: Trusted third-party providers may be used for hosting, payment processing, messaging, and analytics. All sub-processors comply with data protection standards.
• Cross-Border Transfers: Customer and merchant data may be processed or stored outside South Africa, including in jurisdictions where cloud hosting, analytics, messaging, or AI-processing providers operate.
• Where cross-border transfers occur, SME Loyalty takes reasonable steps to ensure that adequate safeguards, contractual protections, and data protection standards consistent with POPIA are implemented.
• Aggregated Data: Anonymised and aggregated data may be used for Platform improvement, benchmarking, and research.
• No Sale of Personal Data: SME Loyalty does not sell identifiable merchant or customer information.

4.1 AI Provider Disclosure

4.2 Merchant-Authorised Ecommerce Integrations

For customer and order data received from WooCommerce, Shopify, or an available Wix connector, the Merchant remains responsible for its lawful basis, customer notices, consent choices, and instructions. SME Loyalty acts as the Merchant's technology provider and processes the data only to provide the disclosed loyalty, store-management, synchronization, discount, refund, and support functions.

• Connection credentials are not exposed to customer-facing pages and are encrypted or irreversibly hashed as appropriate.
• Incoming Shopify and WooCommerce webhook signatures are verified before platform data is accepted.
• Webhook identifiers and platform identity keys are used to prevent duplicate processing, not to create advertising profiles.
• SME Loyalty does not sell identifiable customer or Merchant data to third parties.

4.3 Merchant-Managed E-Commerce Rewards

Where a Merchant enables e-commerce loyalty functionality through the SME Loyalty Platform, loyalty points, rewards, vouchers, discounts, and promotional offers may automatically be earned, redeemed, or applied during the Merchant's online checkout process.

SME Loyalty provides only the technology required to facilitate this functionality.

The Merchant is solely responsible for determining:

• the rewards offered;
• discount values and percentages;
• loyalty earning and redemption rules;
• eligibility criteria;
• expiry dates;
• promotional terms; and
• the accuracy of all reward configurations.

SME Loyalty does not determine, approve, modify, or control any rewards, discounts, promotions, or pricing displayed to customers during checkout.

4.4 Customer Information Processed During Checkout

To facilitate e-commerce loyalty functionality, SME Loyalty may process customer information received from the Merchant's authorised e-commerce platform, including:

• customer identification information;
• loyalty membership information;
• order identifiers;
• transaction values;
• products purchased where required for reward calculations;
• reward balances;
• loyalty points earned or redeemed;
• reward discount information; and
• refund or order reversal information where applicable.

Only the minimum information reasonably necessary to provide loyalty functionality will be processed.

4.5 Merchant Instructions and Lawful Processing

SME Loyalty processes e-commerce customer information solely on the documented instructions of the Merchant for the purpose of operating the Merchant's loyalty programme.

The Merchant remains responsible for ensuring that:

• it has a lawful basis to process customer information;
• customers receive appropriate privacy notices;
• any required consent has been obtained where applicable; and
• all applicable data protection legislation, including POPIA, is complied with.

4.6 Customer Enquiries

Customers acknowledge that enquiries relating to:

• discounts applied during checkout;
• reward eligibility;
• loyalty points;
• reward balances;
• reward redemption;
• pricing;
• products;
• refunds; or
• promotional offers,

must be directed to the relevant Merchant. SME Loyalty does not determine reward eligibility, approve discounts, or resolve disputes relating to merchant loyalty programmes.

4.7 Accuracy of Merchant Data

SME Loyalty relies on information received from the Merchant's e-commerce platform.

SME Loyalty does not verify the accuracy, completeness, or correctness of customer information, transaction data, pricing, reward values, or loyalty configurations supplied by the Merchant or its connected systems.

4.8 Third-Party E-Commerce Platforms

E-commerce functionality may rely upon third-party platforms, APIs, plugins, payment providers, or software services.

Customer information may be processed through these providers only to the extent necessary to deliver Merchant-authorised loyalty functionality.

SME Loyalty is not responsible for the privacy practices, security measures, availability, or performance of third-party e-commerce platforms or software providers, each of which is governed by its own privacy policy and terms of use.

4.9 Data Minimisation

SME Loyalty is committed to the principle of data minimisation and processes only the personal information reasonably necessary to:

• identify loyalty members;
• calculate loyalty rewards;
• process reward redemptions;
• reverse rewards following refunds or cancellations;
• synchronise loyalty activity;
• provide reporting and analytics to Merchants; and
• operate Platform functionality.

Personal information will not be processed for unrelated purposes without an appropriate lawful basis.

4.10 Merchant Responsibility for Customer Privacy Notices

Merchants integrating their e-commerce platforms with SME Loyalty are responsible for updating their own Privacy Policies, Terms and Conditions, cookie notices, and customer disclosures to accurately inform customers that loyalty programme information may be processed through the SME Loyalty Platform.

SME Loyalty is not responsible for ensuring that a Merchant's privacy documentation complies with applicable legal or regulatory requirements.

5. Data Retention and Deletion

• Customer and Merchant data is retained only as long as necessary for service provision or legal compliance.
• Merchant Data: Retained until account deletion plus one (1) year for backup, legal, or regulatory purposes, subject to the configured deletion and backup lifecycle.
• Customer Data: Retained for the duration of participation in a loyalty programme plus one (1) year for legal compliance, unless a valid deletion, redaction, or objection requires earlier action.
• Connected ecommerce data: Connection-scoped credentials, platform identities, webhook events, external orders and reward reservations are deleted or redacted when the connection is disconnected, the app is uninstalled, or a platform privacy request requires it. Shopify compliance requests are handled through the mandatory privacy webhook flow.
• After an account or connection is deleted, backups and legally required records may remain until their approved retention period expires. Shared records are retained only where another active relationship requires them and are anonymised to the extent reasonably possible.

Aggregated, anonymised, or de-identified data may be retained for longer periods for:

• Platform improvement
• AI model optimisation
• Analytics and reporting
• Security monitoring
• Product development and benchmarking

Such data will not identify individual customers or merchants.

6. Security of Data

SME Loyalty implements reasonable technical and organisational measures, including:

• Encrypted data storage and secure communication channels
• Access controls and authentication measures
• Regular monitoring and vulnerability assessments
• Application-level encryption for sensitive ecommerce credentials and irreversible hashing for credentials that only need comparison
• Role-based access to Merchant and customer records, with audit events for customer list, lookup, and detail views that do not store the accessed email address or phone number
• Separate Laravel testing configuration and dedicated test database, isolated from development and production data
• Documented data-loss-prevention and security-incident response procedures

Note: Absolute security cannot be guaranteed, but SME Loyalty strives to protect all personal data against unauthorised access, loss, or misuse. Security measures also apply to AI-processing environments, analytics systems, automated technologies, and cloud-based infrastructure used to support Platform functionality. Database-at-rest encryption, encrypted backups, staff multi-factor authentication, and host-level data-loss-prevention controls are deployment and operational controls that are reviewed separately for each environment.

7. Data Breach Notification

In the event of a data breach that affects personal information:

• SME Loyalty will assess the risk and notify affected merchants/customers without undue delay.
• Relevant authorities, including the Information Regulator, will be informed as required by POPIA.

8. User Rights

Merchants and Customers have the right to:

• Access: Request access to personal information held by SME Loyalty.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of personal data (subject to legal obligations).
• Withdrawal of Consent: Withdraw consent for processing of personal information.
• Objection / Complaint: Object to processing or lodge complaints with SME Loyalty or the South African Information Regulator.

8.1 Automated Processing and Profiling Rights

Subject to applicable law, users may:

• Request information regarding automated processing activities
• Object to certain forms of profiling or automated segmentation
• Request human review of significant automated recommendations where applicable
• Certain automated processing may remain necessary for Platform functionality and loyalty programme operations.

How to Exercise Rights: Contact us at info@smeloyalty.co.za with your request. We will respond within a reasonable time in accordance with POPIA.

9. Cookies and Tracking

• Cookies improve Platform functionality and user experience.
• Cookies may track login sessions, preferences, and feature usage.
• Users can disable cookies in browser settings, but some Platform features may not function correctly.

10. Marketing and Communications

• Customers may receive notifications about rewards, programme updates, or relevant Platform announcements.
• Marketing communications outside of reward notifications will only be sent with explicit consent.
• Users may opt-out of marketing messages at any time via provided unsubscribe links or by contacting info@smeloyalty.co.za.
• Marketing and customer engagement communications may include AI-assisted or automated campaign recommendations generated through the Platform on behalf of merchants.
• Merchants are solely responsible for ensuring that all marketing communications comply with applicable consent and communication requirements.

10.1 Customer Consent for Campaigns and Engagement

Merchants using AI-powered campaign tools warrant that they have obtained all necessary customer consents and lawful grounds required to send promotional communications, loyalty notifications, personalised offers, or engagement campaigns.

SME Loyalty acts solely as a technology provider and does not independently verify customer consent obtained by merchants.

11. Third-Party Links

The Platform may contain links to third-party websites or services. SME Loyalty is not responsible for the privacy practices or content of these third parties.

12. Minors

• The Platform is intended for users 18 years or older.
• SME Loyalty does not knowingly collect personal information from minors.

13. Updates to this Privacy Policy

• This Privacy Policy may be updated from time to time.
• Updated policies will be published on www.smeloyalty.co.za.
• Continued use of the Platform constitutes acceptance of the revised Privacy Policy.

14. AI-Powered Features Disclaimer

AI-powered insights, recommendations, segmentation outputs, behavioural analysis, and campaign suggestions are generated automatically using algorithms, data models, and available platform information.

Such outputs:

• may not always be accurate, complete, or suitable
• may contain assumptions, biases, or inaccuracies
• should not be relied upon as professional, financial, legal, or marketing advice

Businesses remain solely responsible for reviewing and validating all AI-generated outputs before use or implementation.

15. Contact Information

For any questions, concerns, or requests regarding this Privacy Policy or personal data:

SME Loyalty (Pty) Ltd
Website: www.smeloyalty.co.za
Email: info@smeloyalty.co.za