Privacy Notice

Antavo Limited (company registration number: 08046168, registered seat: 9th, Floor, 107 Cheapside, London, United Kingdom, EC2V 6DN) (hereinafter referred to as “Antavo”, “Us”, “Our”) takes privacy seriously. We design and operate our services with the protection of your privacy in mind. Please read the following to learn more about our Privacy Notice.

Introduction

Welcome and thank you for visiting the Antavo website (“Website”).

Antavo offers a hosted software as a service platform to Clients (Loyalty platform) that have contracted with Antavo Limited for User (users of Loyalty platform) data orchestration and engagement (“Clients”). Clients include our partners or resellers that offer our Services in connection or combination with services they provide to their customers, most often through their websites, webshops or social media pages. Antavo helps Clients understand their Consumers (“Consumers”) and provide their Consumers with personalized offers, campaigns, and loyalty programs. Our platform includes tools for creating reward clubs, contests, quizzes, season campaigns and audience “segments” based on information about Consumers. These tools enable Clients to send relevant communications and promotions to certain customers. Using the Loyalty Management Platform or the Contest Tools (defined below), Clients can configure and manage contests and loyalty programs on their websites, as well as offer and manage promotions and rewards.

In this Privacy Notice, we refer to the Antavo Loyalty platform and applications as our “Services”.

This Privacy Notice provides information to Clients and business partners, and other third parties concerning the processing of their data.

The applicable regulations are the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, GDPR) and the UK GDPR which means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27th April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018.

1. Data Controller

Name and contact details of the controller:

Antavo Limited
company registration number: 08046168
registered seat: 9th, Floor, 107 Cheapside, London, United Kingdom, EC2V 6DN
email: [email protected]

Data Protection Officer (DPO)
dr Annamária Nádai, [email protected]

2. Data Processing

Below, you can find the information on

• the purpose of processing;
• the data processed;
• the legal basis of processing;
• the period of processing;
• persons and entities with access to the data;

2.1. Using cookies

2.2. Contacting us

2.3. Newsletter

2.4. Booking a demo

2.5. Include Antavo in your RFP process

2.6. Registering for Antavo events

2.7. Participation in Antavo’s surveys

2.8. Participation in Antavo Academy

2.9. Providing Services to Clients

Providing our Services to Clients, we receive personal data of Clients' Users which is necessary for operating our loyalty platform.

These personal data can be the following:

Mandatory: Customer ID, Opt-in Date, Loyalty membership status, Event ID, Action name, Date of registration (event date).

Other possible data: External ID, Last name, First name, Email address, Gender, Birthdate, Age, Handler, Image, Facebook ID, Language used, Mobile phone nr, Address, IP address, Labels, number of purchases, purchase totals, last purchase date - broken down into different time periods i.e. last 12 months, last 24 months, etc, Transaction ID, Date and time of transaction, Products, services purchased, Campaign bonus, Coupons (assigned, redeemed, expired, etc.), Point history (rewarded, added, spent, redeemed, burnt, unburnt, expired, transferred, refunded, referral bonus, etc.), Tiers (current, change).

Using our Services, Clients are the data controller in relation to processing of the Client’s Users personal data, and Antavo is the data processor.

2.10. Recruitment

2.11. Required by law

Antavo may process personal data to meet applicable law, regulation, legal process or lawful government requests of any country of which Antavo will inform you immediately, unless it is required otherwise by the law.

3. Technical and organizational measure

Within the framework of its services, Antavo attributes the very highest importance to the security and integrity of its customers’ personal data.

Antavo undertakes to take all pertinent precautions in order to preserve the security of the data and, in particular, to protect them against any accidental or unlawful destruction, accidental loss, corruption, unauthorized circulation or access, as well as against any other form of unlawful processing or disclosure to unauthorized persons. To this end, Antavo implements industry-standard security measures to protect personal data from unauthorized disclosure.

In order to avoid in particular all unauthorized access, as well as to guarantee accuracy and the proper use of the data, Antavo has put the appropriate electronic, physical and managerial procedures in place with a view of safeguarding and preserving the data gathered through its services.

4. Data Subject Rights

One of the key objectives of the European General Data Protection Regulation (GDPR) was to ensure the privacy and protection of the personal data of data subjects.

To help data subjects in being assured of the protection and privacy of their personal data, GDPR empowers data subjects with certain rights. Through these rights, data subjects can make a specific request and be assured that personal data is not being misused for anything other than the legitimate purpose for which it was originally provided.

4.1. Right to information

The right to information allows data subjects to know what personal data is collected about them, why, who is collecting data, how long it will be kept, how they can file a complaint, and with whom their data will be shared.

Antavo is obligated to provide information about:

• controller’s information and contact details
• purpose of data processing
• legal basis for personal data processing
• third party details
• data retention period,
• rights granted to the data subject under the data protection law,
• the right to file a complaint,
• whether the provision of personal data is a statutory or contractual requirement,
• whether the individual is obligated to provide the personal data
• the existence of automated decision-making, including profiling

4.2. Right of access

Data subjects have a right to submit subject access requests and obtain information from Antavo Group about whether your personal information is being processed. Antavo Group is then obligated to provide a copy of personal data it has about you and additional information, including:

• what is the purpose of the processing
• what categories of personal data are they processing
• with whom the data is shared (third countries or international organizations)
• how long will the organization keep the data (data retention period)
• information about their GDPR rights (right to rectification, right to erasure, restriction of processing, etc.)
• the existence of automated decision-making, including profiling
• what is the source of collected data (if the data is not collected from the individual)

4.3. Right to rectification

The right to rectification allows data subjects to ask Antavo Group to update any inaccurate or incomplete data it has on them.

4.4. Right to be forgotten

The right to be forgotten is also known as the right to erasure. This right allows data subjects to ask for their ur personal data to be deleted if:

• personal data is no longer necessary
• They have withdrawn their consent
• the personal data have been unlawfully processed
• they have objected to the processing, and Antavo Group has no reason to continue processing
• data erasure is necessary for compliance with a legal obligation (EU law or national law)

Although there are situations where Antavo Group can decline the request. For instance, for reasons in the public interest or compliance with legal obligations.

If data subjects exercise their right to erasure, Antavo Group has to notify any third parties with whom the data was shared and request the erasure of data.

Antavo Group has to comply unless it can prove that the request would require a disproportionate effort or if it is impossible to comply.

4.5. Right to restrict processing

Data subjects can request that Antavo Group limits the way it uses their personal data. Antavo Group is not automatically obligated to delete the data. However, it has to refrain from processing it in certain situations:

• if the data is inaccurate (during the verification process);
• if the processing is unlawful, but you do not want the data to be erased and request restriction (which is different from the right to be erased);
• Antavo no longer needs data, but they want the data to be preserved so the legal claim can be exercised;
• Antavo is taking measures to verify the data erasure request.

Once the data is restricted, Antavo Group is not allowed to process it unless it has the data subject’s consent, it needs it for legal claims or to protect the rights of other individuals.

4.6. Right to data portability

Data portability allows data subjects to obtain personal data they have previously provided to Antavo Group in a structured, commonly used, and machine-readable format.

Data subjects can also request for their data to be transferred directly to another organization. However, it can only be applied to the data if processing is carried out by automated means, no papers.

4.7. Right to withdraw consent

The data subject has the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent.

4.8. Right to object to processing

Data subjects have the right to object, on grounds relating to their particular situation, at any time to processing of personal data concerning them which is based on the following legal grounds:

• necessary to perform a task in the public interest ; or
• necessary for Antavo’s or a third party's legitimate interests.

Antavo Group shall no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of you or for the establishment, exercise or defense of legal claims.

4.9. Right to object to automated processing

The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.

4.10. Exercising the rights

If you wish to exercise any of these rights, please contact us at [email protected].

Information will be provided at the earliest convenience, but at a maximum of 30 days from the date the request was received.

Where the retrieval or provision of information is particularly complex or is subject to a valid delay, the period may be extended by two further months where necessary. However, this is only done in exceptional circumstances and you will be kept informed in wiring throughout the retrieval process of any delays or reasons for delay.

If for any reason, Antavo is unable to act in response to a request a written explanation to you will always be provided and you will be informed of your right to complain to the Supervisory Authority and to a judicial remedy.

Information provided, and any communication and any actions taken under shall be provided free of charge.

Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, Antavo may either:

(a) charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or

(b) refuse to act on the request.

Where Antavo has reasonable doubts concerning the identity of the natural person making the request, it may request the provision of additional information necessary to confirm the identity of the data subject.

If Antavo does not comply with a request, it shall inform you without delay and at the latest within one month of receipt of the request of the reasons for not taking action and on the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.

4.11. For EEA countries

Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes GDPR.

The list of the European supervisory authorities can be found here.

Right to an effective judicial remedy against a supervisory authority

Without prejudice to any other administrative or non-judicial remedy, each natural or legal person shall have the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them.

Without prejudice to any other administrative or non-judicial remedy, each data subject shall have the right to an effective judicial remedy where the supervisory authority which is competent does not handle a complaint or does not inform the data subject within three months on the progress or outcome of the complaint lodged to it.

Proceedings against a supervisory authority shall be brought before the courts of the Member State where the supervisory authority is established.

Right to an effective judicial remedy against a controller or processor

Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority, you have the right to an effective judicial remedy where you consider that your rights under GDPR have been infringed as a result of the processing of your personal data in non-compliance with GDPR.

Proceedings against a controller or a processor shall be brought before the courts of the Member State where the controller or processor has an establishment. Alternatively, such proceedings may be brought before the courts of the Member State where you have your habitual residence.

4.12. For UK

You have the right to complain to an organization if you think it has not handled personal information in compliance with the UK GDPR.

You should give the organization you’re unhappy with a chance to sort things out before bringing your complaint to the supervisory authority.

Give the organization one month to respond to your complaint or request. Ask the organization involved for clarification if you don’t understand or you’re unhappy with their response. Organizations have an obligation to clearly explain why they are using your information in the way they are doing or why they have refused a request.

If you have followed these steps or the organization is refusing to respond to you, you can complain to the supervisory authority.

The name and contact details of the supervisory authority:

Information Commissioner's Office (ICO)
seat: Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF
telephone: 0303 123 1113
fax: 01625 524510
website: www.ico.org.uk

You have the right to an effective judicial remedy against a legally binding decision of the ICO. You can apply to the High Court, or the Court of Session in Scotland, for a judicial review where the complaints process has been exhausted. You may also proceed to take the controller or processor to court for the matter, and the court may take a differing view from any ICO decision.

You have the right to an effective judicial remedy if the ICO does not handle the complaint or provide you with a progress update within three months.

You may apply to the First Tier Tribunal to make an order against the Commissioner.

You have a right to seek a judicial remedy against a controller or processor. The DPA 2018 empowers courts to make an order for compliance, requiring controllers to take or refrain from taking specific steps where a data subject’s rights, under data protection legislation, have been infringed.

5. List of sub-processors

Entry into force

This Privacy Notice may be changed unilaterally by the data controller at any time.
Changes to this Privacy Notice will be published on this page.
This Privacy Notice enters into force on February 07, 2024.

You can download this document by clicking here.