Who is responsible
You are the controller: you decide to run a programme and what to collect. StoreWallet is your processor: we act on your instructions, and the dashboard settings are those instructions. Apple and Google are independent controllers of their own Wallet apps. This split is written into our data processing agreement, which is part of your terms.
As a controller you need to pay the ICO's data protection fee (£52 a year for most small businesses) unless you are exempt, and to show customers a privacy notice. We provide the notice; the fee is yours.
What you may collect
A first name and an email are enough to run a card, and the lawful basis is the loyalty contract itself: the customer joins a programme with terms. Phone number and birthday are optional fields you can switch on, collected with the customer's agreement. The designer refuses fields it should not have, such as health or ethnicity, and the programme refuses anyone under 16.
Pushes need consent
A message to the card is marketing. Members tick a separate, unticked box for it when they join; the card itself does not depend on that tick. They withdraw it from the back of the card without logging in, and the system will not send a campaign to anyone who has. Opening hours are enforced: messages only go out while the shop is open, and never between 10pm and 7am.
Keep it only as long as you need it
You set a retention period: never, or 12, 24 or 36 months after the last visit. A nightly job enforces it. Visit counts survive as totals without names so your history does not vanish with the people.
Rights, built into the card
The back of every card has links to see and download the data, change consent, and delete the account. Deleting removes the card from both Wallets within the hour, with no login and no email to you. If a customer asks you directly, you click Erase in their profile and the same happens. Our your data rights page spells it out for customers.
If something goes wrong
We tell you within 48 hours of becoming aware of a breach, with what we know. You have 72 hours to tell the ICO if the breach is likely to risk people's rights, and we help with the notice.
Compliance you can show
A signed DPA, a privacy notice in your name, and a register of processing generated from the code.
Questions
Do I need a Data Protection Officer?+
Almost certainly not; a DPO is required for large-scale monitoring or special-category data at scale. Name a person responsible and say so in your notice.
Can I import my existing mailing list?+
You can import names and emails, but each person gets an invitation to add the card rather than a card forced on them, and no pushes until they tick the box.