Luna Loyalty

Privacy

Privacy Policy for LunaLoyalty

Effective Date: 4 October 2026

This Privacy Policy explains how LunaLoyalty collects, uses, and protects your personal data. LunaLoyalty is a digital rewards platform operated by Elliott Digital Solutions LTD. We provide loyalty scheme infrastructure for independent hospitality venues across the UK.

We are committed to protecting your privacy and ensuring your personal data is handled securely and in accordance with United Kingdom data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Data Controller and Data Processor

For the purposes of data protection law, responsibilities are divided between LunaLoyalty and the independent venues you visit:

  • Data Controller (The Venue): When you join a specific venue’s rewards scheme via our platform, that specific venue (e.g., the pub or bar) acts as the Data Controller. They determine the rules of their rewards programme and how your data is used for their marketing.
  • Data Processor (LunaLoyalty): Elliott Digital Solutions LTD, trading as LunaLoyalty, acts as the Data Processor. We operate the technical platform, infrastructure, and application that runs the rewards scheme on behalf of the venues.
  • Data Protection Officer (DPO): Cameron Elliott serves as the DPO for the LunaLoyalty platform. You can contact the DPO regarding any platform-level data privacy matters at [email protected].

2. What Information We Collect

We only collect information that is strictly necessary to operate the platform, verify your eligibility, and provide support.

  • Identity and Contact Data: Your first name, last name, and email address.
  • Security Data (Your Global Account): Your password. This is stored exclusively in a scrambled (hashed) format; neither venue staff, venue management, nor our platform administrators can read it. Your login constitutes a global LunaLoyalty account, allowing you to use the same email and password to open separate loyalty cards at different participating venues. Please note: Each venue maintains its own separate card; venues cannot see your stamps, balances, or transaction history at other participating venues.
  • Age Verification Data: Your date of birth. Because many of our partner venues are licensed premises, we collect this solely to verify that you are 18 years of age or older.
  • Transaction Data: Details of your rounds at participating venues, including timestamps, items purchased, stamps earned, rewards redeemed, and the specific staff member who recorded the transaction.
  • Support and Technical Data: If you report an issue, we collect the contents of your report, any provided screenshots, the URL of the page you were on, your device type, and your browser type. To prevent spam, our support forms utilise Cloudflare Turnstile to verify human interaction.
  • Marketing Data: If you opt into promotional communications for a specific venue, we record your agreement, the exact timestamp of your consent, and the specific wording you agreed to.

3. Why We Process Your Data (Lawful Basis)

We process your personal data on behalf of our partner venues under the following lawful bases:

  • Contractual Necessity: To administer the loyalty accounts you have joined, maintain your point balances, and send essential account emails (such as address confirmations, password resets, and requested sign-in links).
  • Legal Obligation: To verify your age (18+) for the promotion of alcohol on behalf of licensed premises.
  • Consent: To allow individual venues to send you occasional promotional offers via email. You may withdraw this consent for any individual venue at any time via your account settings.
  • Legitimate Interests: To diagnose technical issues, fix platform bugs, ensure network security, and prevent spam or fraudulent activity on the application.

4. Who Can See Your Data

We do not sell your personal data to third parties. Access to your information is strictly limited based on operational requirements:

  • Venue Staff: When you present your digital card, bar staff at that specific venue can only see your first name and your current card balance for their venue.
  • Venue Management: The owners/managers of a venue have access to the full member details of users who have explicitly joined their specific rewards scheme to oversee operations and correct stamp mistakes. They cannot see your activity at other LunaLoyalty venues.
  • Platform Administrators: LunaLoyalty (Elliott Digital Solutions LTD) processes the data centrally to maintain, secure, and host the application.

Third-Party Sub-Processors To deliver the service reliably, LunaLoyalty utilises the following trusted infrastructure providers:

  • OVHcloud: Server hosting and database infrastructure.
  • Cloudflare: Security, page delivery, and Turnstile spam protection.
  • Resend: Delivery of transactional and marketing emails.
  • Google Wallet: Integration services (applicable only if you actively choose to add your loyalty card to your Google Wallet).

Where any of these providers handle data outside the UK, they are required to do so under the strict legal safeguards mandated by UK data protection law (such as Adequacy Decisions, the UK Extension to the EU–US Data Privacy Framework, or Standard Contractual Clauses).

5. Data Retention

We keep your personal data only for as long as necessary to fulfil the purposes outlined in this policy:

  • Account Inactivity: If your LunaLoyalty account remains entirely unused across all venues for 24 consecutive months, we will send you an email notification. If no action is taken, we will permanently delete your name, email address, and date of birth 30 days later.
  • Support Reports: Problem reports, including screenshots and technical data, are permanently deleted 90 days after the support ticket is marked as closed, or immediately upon the deletion of your account.
  • Anonymised Data: Once your personal details are deleted, we retain anonymous, aggregated totals (e.g., total number of stamps recorded across the platform) for accounting and business analytics. This data can no longer be linked to you.

6. Your Data Protection Rights

Under UK data protection law, you possess the following rights regarding your personal data:

  • Right of Access: You can request a copy of the personal data held about you.
  • Right to Rectification: You can ask for any inaccurate or incomplete data to be corrected.
  • Right to Erasure: You can request the deletion of your personal data ("the right to be forgotten").
  • Right to Withdraw Consent: You can turn off marketing emails for any venue at any time via your account settings.

To exercise any of these rights regarding a specific venue's rewards scheme, you may speak to the management of that venue directly. For global account queries, or to exercise your rights platform-wide, email us at [email protected].

If you are dissatisfied with how your personal data has been handled, you have the right to lodge a formal complaint with the Information Commissioner's Office (ICO). You can contact them at ico.org.uk.