Who we are
StoreWallet, operated in the United Kingdom. Contact for anything in this policy: admin@storewallet.co.uk. We have named a data protection lead; we are not required to appoint a statutory Data Protection Officer and have not done so.
What we collect and why
| Who | What | Why | Lawful basis | Kept for |
|---|---|---|---|---|
| Owners and managers | Name, email, mobile, business name and address, sign-in records, 2FA method, billing contact | Run your account, sign you in securely, invoice you, support you | Contract | Life of the account plus 6 years for billing records |
| Staff | Name, PIN (hashed), the stamps they record | Attribute till actions, let you manage your team | Contract (with the venue) | While they are on the account plus 12 months of audit log |
| Partners | Name, business, email, bank details for payouts (not stored in StoreWallet) | Pay commission, manage the relationship | Contract | Life of the agreement plus 6 years |
| People who book a call | Name, mobile, business name and type, location, chosen time | Arrange and hold the call | Legitimate interest in responding to your enquiry | 12 months, or deleted on request |
| Website visitors | Nothing. This website sets no cookies and keeps no analytics, not even page counts | — | — | Nothing is held |
When you book a call or a setup visit on this site, we hold the time you chose and keep your name, mobile number, business name and location so we can confirm on WhatsApp and prepare. Your name and mobile number are stored encrypted, and the booking is deleted after 12 months. If our booking service can't be reached, the form instead opens WhatsApp with your message written out and nothing is stored by this website; what you send then reaches us through WhatsApp (Meta) under its own terms.
If you add a passkey as your second sign-in step, your device keeps the private key and any fingerprint or face data; we store only the passkey's public key and the name you give it.
Who receives it
Our sub-processors, listed with regions and safeguards on the sub-processors page: hosting in Frankfurt, Germany (Render), transactional email (Resend), billing (Whop), error monitoring with personal data scrubbed (Sentry). We do not sell personal data and we do not share it with advertisers.
International transfers
Data is stored in the European Union (Frankfurt, Germany), which UK law recognises as giving adequate protection. Where a sub-processor's support staff may access data from outside the UK and the EU, the transfer is covered by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or an adequacy decision.
Your rights
You can ask for access to, correction of, deletion of, or a copy of your data, object to or restrict processing, and withdraw consent where consent is the basis. Owners can delete their account from the dashboard; staff and partners can ask the venue or us. Email admin@storewallet.co.uk; we respond within one month. You can complain to the Information Commissioner's Office at ico.org.uk.
Children
The Service is for businesses and for adults; we do not knowingly hold data about anyone under 16, and the loyalty programmes venues run through us refuse under-16s at the join page.
Security
Described on the security page and the trust page.
Changes
We will post changes here with the date, and email account holders about material changes 30 days before they take effect.