Privacy policy

Merchant data is processed by [Company name], [Address], as controller. Data about a merchant's customers is processed on behalf of that merchant (controller), with Renofid acting as processor. Contact: [Contact / DPO email].

Merchant accounts: name, email, phone, business details (name, type, address, phone), subscription plan and security settings. Payments are handled by Stripe; we do not store card numbers.

Merchants' customers: first and last name, email, phone, birthday (day and month), loyalty activity (points, stamps, tier, rewards, visits), bookings and orders. Wallet passes: technical identifiers needed to push pass updates. Employees: name and email.

Providing the service (contract), billing (legal obligation), security (legitimate interest), merchant notifications and birthday rewards (merchant's legitimate interest or consent), aggregated statistics (legitimate interest).

Your data is never sold. It is accessible to the relevant merchant and its authorized staff, and to our processors: hosting ([Hosting provider]), Stripe, email delivery ([Email provider]), Apple and Google for wallet passes.

Merchant accounts: subscription duration plus 3 years; accounting records: 10 years; customer data: while the membership is active, then deleted or anonymised after 3 years of inactivity; technical logs: up to 12 months.

Passwords are hashed (Argon2), traffic is encrypted (HTTPS) and two-factor authentication is available for merchant accounts.

Under the GDPR you have the right to access, rectify, erase, restrict, port and object to the processing of your data. Write to [Contact / DPO email], or to the merchant directly if you are one of its customers. You may also lodge a complaint with the CNIL (www.cnil.fr).

Renofid uses no advertising cookies. Browser local storage is only used to keep you signed in and remember your preferences.