SME Loyalty Privacy Policy

1. Definitions

• Platform: The SME Loyalty website, software, mobile interfaces, and related services.
• Merchant / Business / Partner: Any business subscribing to the Platform to manage its own loyalty or rewards programmes.
• Customer / User: Any individual participating in a loyalty programme offered by a Merchant through the Platform.
• Loyalty Programme / Rewards Programme: Any reward, promotion, incentive, cashback, discount, or loyalty offer created by a Merchant.

2. Categories of Data We Collect

3. How We Use Personal Data

SME Loyalty acts as a Data Processor for customer data and a Data Controller for merchant accounts. Data is used for:

• Operating and maintaining the Platform
• Enabling Merchants to manage loyalty programmes
• Sending notifications regarding rewards, promotions, and programme updates
• Providing analytics, reporting, and insights to Merchants
• Improving Platform functionality, services, and user experience
• Communication about subscriptions, support, or feedback requests

Data may also be used for:

• AI-powered analytics and behavioural modelling
• Automated generation of business insights and recommendations
• Customer segmentation and engagement scoring
• AI-assisted campaign generation and optimisation
• Win-back campaign recommendations and targeting
• Improving AI models, algorithms, and platform intelligence capabilities
• Detecting usage trends and improving customer engagement functionality

3.1 Automated Processing and AI-Powered Features

SME Loyalty may use automated technologies, machine learning systems, and AI-powered tools to analyse customer and platform data.

These systems may assist businesses with:

• Customer segmentation
• Behavioural analysis
• Loyalty trend identification
• Customer retention insights
• Automated campaign recommendations
• Win-back campaign generation
• Engagement optimisation suggestions

Explicit Consent: By participating in a Merchant's loyalty programme, Customers consent to the collection and processing of their personal data. Merchants are responsible for obtaining and recording this consent in compliance with POPIA. AI-generated outputs are probabilistic in nature and may contain inaccuracies, assumptions, or incomplete interpretations. SME Loyalty does not make decisions on behalf of merchants or customers and does not solely rely on automated processing for legally binding decisions affecting individuals. Businesses remain responsible for reviewing, validating, and approving all AI-generated outputs prior to use.

3.2 Profiling and Customer Targeting

The Platform may use customer activity, transaction history, engagement patterns, and loyalty behaviour to generate customer profiles, audience segments, engagement scores, or campaign targeting recommendations.

This profiling is used solely to support merchant loyalty programme management and customer engagement activities.

Merchants are responsible for ensuring they have the necessary lawful basis and customer consent required for personalised marketing and customer engagement activities under applicable laws, including POPIA.

4. Data Sharing and Third Parties

• Sub-Processors: Trusted third-party providers may be used for hosting, payment processing, messaging, and analytics. All sub-processors comply with data protection standards.
• Cross-Border Transfers: Customer and merchant data may be processed or stored outside South Africa, including in jurisdictions where cloud hosting, analytics, messaging, or AI-processing providers operate.
• Where cross-border transfers occur, SME Loyalty takes reasonable steps to ensure that adequate safeguards, contractual protections, and data protection standards consistent with POPIA are implemented.
• Aggregated Data: Anonymised and aggregated data may be used for Platform improvement, benchmarking, and research.
• No Sale of Personal Data: SME Loyalty does not sell identifiable merchant or customer information.

4.1 AI Provider Disclosure

5. Data Retention and Deletion

• Customer and Merchant data is retained only as long as necessary for service provision or legal compliance.
• Merchant Data: Retained until account deletion plus one (1) year for backup, legal, or regulatory purposes.
• Customer Data: Retained for the duration of participation in a loyalty programme plus one (1) year for legal compliance.
• Upon account deletion, all associated data is permanently removed and cannot be recovered.

Aggregated, anonymised, or de-identified data may be retained for longer periods for:

• Platform improvement
• AI model optimisation
• Analytics and reporting
• Security monitoring
• Product development and benchmarking

Such data will not identify individual customers or merchants.

6. Security of Data

SME Loyalty implements reasonable technical and organisational measures, including:

• Encrypted data storage and secure communication channels
• Access controls and authentication measures
• Regular monitoring and vulnerability assessments

Note: Absolute security cannot be guaranteed, but SME Loyalty strives to protect all personal data against unauthorised access, loss, or misuse. Security measures also apply to AI-processing environments, analytics systems, automated technologies, and cloud-based infrastructure used to support Platform functionality.

7. Data Breach Notification

In the event of a data breach that affects personal information:

• SME Loyalty will assess the risk and notify affected merchants/customers without undue delay.
• Relevant authorities, including the Information Regulator, will be informed as required by POPIA.

8. User Rights

Merchants and Customers have the right to:

• Access: Request access to personal information held by SME Loyalty.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of personal data (subject to legal obligations).
• Withdrawal of Consent: Withdraw consent for processing of personal information.
• Objection / Complaint: Object to processing or lodge complaints with SME Loyalty or the South African Information Regulator.

8.1 Automated Processing and Profiling Rights

Subject to applicable law, users may:

• Request information regarding automated processing activities
• Object to certain forms of profiling or automated segmentation
• Request human review of significant automated recommendations where applicable
• Certain automated processing may remain necessary for Platform functionality and loyalty programme operations.

How to Exercise Rights: Contact us at info@smeloyalty.co.za with your request. We will respond within a reasonable time in accordance with POPIA.

9. Cookies and Tracking

• Cookies improve Platform functionality and user experience.
• Cookies may track login sessions, preferences, and feature usage.
• Users can disable cookies in browser settings, but some Platform features may not function correctly.

10. Marketing and Communications

• Customers may receive notifications about rewards, programme updates, or relevant Platform announcements.
• Marketing communications outside of reward notifications will only be sent with explicit consent.
• Users may opt-out of marketing messages at any time via provided unsubscribe links or by contacting info@smeloyalty.co.za.
• Marketing and customer engagement communications may include AI-assisted or automated campaign recommendations generated through the Platform on behalf of merchants.
• Merchants are solely responsible for ensuring that all marketing communications comply with applicable consent and communication requirements.

10.1 Customer Consent for Campaigns and Engagement

Merchants using AI-powered campaign tools warrant that they have obtained all necessary customer consents and lawful grounds required to send promotional communications, loyalty notifications, personalised offers, or engagement campaigns.

SME Loyalty acts solely as a technology provider and does not independently verify customer consent obtained by merchants.

11. Third-Party Links

The Platform may contain links to third-party websites or services. SME Loyalty is not responsible for the privacy practices or content of these third parties.

12. Minors

• The Platform is intended for users 18 years or older.
• SME Loyalty does not knowingly collect personal information from minors.

13. Updates to this Privacy Policy

• This Privacy Policy may be updated from time to time.
• Updated policies will be published on www.smeloyalty.co.za.
• Continued use of the Platform constitutes acceptance of the revised Privacy Policy.

14. AI-Powered Features Disclaimer

AI-powered insights, recommendations, segmentation outputs, behavioural analysis, and campaign suggestions are generated automatically using algorithms, data models, and available platform information.

Such outputs:

• may not always be accurate, complete, or suitable
• may contain assumptions, biases, or inaccuracies
• should not be relied upon as professional, financial, legal, or marketing advice

Businesses remain solely responsible for reviewing and validating all AI-generated outputs before use or implementation.

15. Contact Information

For any questions, concerns, or requests regarding this Privacy Policy or personal data:

SME Loyalty (Pty) Ltd
Website: www.smeloyalty.co.za
Email: info@smeloyalty.co.za