Privacy Policy

This Privacy Notice for Punch Loyalty Ltd. (doing business as Punch) ("we," "us," or "our") describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you:

• Visit our website at https://www.punch-loyalty.app or any website of ours that links to this Privacy Notice
• Download and use our mobile application (Punch), or any other application of ours that links to this Privacy Notice
• Engage with us in other related ways, including any marketing or events

Questions or concerns? Reading this Privacy Notice will help you understand our collection and processing practices of your personal information, including your privacy rights and choices in connection with such personal information. As we are responsible for making decisions about how your personal information is processed, we – Punch Loyalty Ltd. – are the database controller of the computerized database in which your personal information is maintained, processed, and retained. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at info@punch-portal.com.

Please note that you are not legally required to provide us with any personal information. However, if you choose not to provide us with any such personal information when requested, we may not be able to offer you all of our Services, respond to your inquiries, engage with you, or allow full use of our websites or apps. Any personal information you provide is therefore given voluntarily of your own free will and with your consent.

Without prejudice to the foregoing, if you provide personal information about any third parties, you agree that you have and will remain in your possession at all times that such personal information is in our possession, all the consents required from those third parties to provide their personal information about them to us and for its processing in accordance with the terms of this Privacy Policy.

Summary of key points

This summary provides key points from our Privacy Notice, but you can find out more details about any of these topics by using our table of contents below to find the section you are looking for.

• What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use.
• Do we collect any information from third parties? We may collect information from public databases, marketing partners, social media platforms, and other outside sources.
• How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with our legal and regulatory obligations. We may also process your information for other purposes which are in line with the primary purposes for which you provided your information (or with your explicit consent where legally required). We process your information only when we have a valid legal reason to do so.
• In what situations and with which types of parties do we share personal information? We may share information in specific situations and with specific categories of third parties.
• How do we keep your information safe? We have adequate organizational and technical processes and procedures in place to protect your personal information. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information.
• What are your rights? Depending on where you are located geographically, the applicable privacy law may mean you have certain rights regarding your personal information.
• How do you exercise your rights? The easiest way to exercise your rights is by visiting info@punch-portal.com, or by contacting us. We will consider and act upon any request in accordance with applicable data protection laws.

1. What information do we collect?

Personal information you disclose to us

In Short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.

Personal Information Provided by You. The personal information that we collect depends on the context of your interactions with us and the Services, the choices you make, and the products and features you use. The personal information we collect may include the following: names, phone numbers, email addresses, birthday, usernames, passwords, debit/credit card numbers, billing addresses, job titles.

Sensitive Information. We normally do not process sensitive information. However, some of the information we process may be considered "special" or "sensitive" in certain jurisdictions, for example in Israel personal information categories such as your racial or ethnic origins, sexual orientation, religious beliefs, Internet Protocol (IP) addresses, location data and biometric identifiers are considered categories of highly sensitive personal information under the local privacy laws. We may be therefore deemed as if we are processing such sensitive information in certain jurisdictions, although we normally strive to avoid processing such information.

Payment Data. We may collect data necessary to process your payment if you choose to make purchases, such as your payment instrument number, and the security code associated with your payment instrument. All payment data is handled and stored by invoice4u and cardcom. You may find their privacy notice link(s) here: https://www.invoice4u.co.il/privacy-policy/ and Cardcom privacy policy.

Social Media Login Data. We may provide you with the option to register with us using your existing social media account details, like your Facebook, X, or other social media account. If you choose to register in this way, we will collect certain profile information about you from the social media provider, as described in the section called "HOW DO WE HANDLE YOUR SOCIAL LOGINS?" below.

Application Data. If you use our application(s), we also may collect the following information if you choose to provide us with access or permission: Geolocation Information; Mobile Device Access (Bluetooth, camera, sensors, SMS messages, NFC, storage, and other features); Mobile Device Data (device ID, model, manufacturer, operating system, IP address, etc.); Push Notifications. This information is primarily needed to maintain the security and operation of our application(s), for troubleshooting, and for our internal analytics and reporting purposes.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

Information automatically collected

In Short: Some information – such as your Internet Protocol (IP) address and/or browser and device characteristics – is collected automatically when you visit our Services.

We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity (like your name or contact information) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use our Services, and other technical information. This information is primarily needed to maintain the security and operation of our Services, and for our internal analytics and reporting purposes.

Like many businesses, we also collect information through cookies and similar technologies. You can find more information in this regard in our Cookie Policy.

The information we collect includes:

• Log and Usage Data. Service-related, diagnostic, usage, and performance information our servers automatically collect when you access or use our Services.
• Device Data. Information about your computer, phone, tablet, or other device you use to access the Services.
• Location Data. Information about your device's location, which can be either precise or imprecise. You can opt out by refusing access or disabling your Location setting on your device.

Google API. Our use of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

Information collected from other sources

In Short: We may collect limited data from public databases, marketing partners, social media platforms, and other outside sources.

In order to enhance our ability to provide relevant marketing, offers, and services to you and update our records, we may obtain information about you from other sources, such as public databases, joint marketing partners, affiliate programs, data providers, social media platforms, and from other third parties. This information includes mailing addresses, job titles, email addresses, phone numbers, intent data, IP addresses, social media profiles, and custom profiles, for purposes of targeted advertising and event promotion.

If you interact with us on a social media platform using your social media account (e.g., Facebook or X), we receive personal information about you from such platforms such as your name, email address, and gender. You may have the right to withdraw your consent to processing your personal information. Any personal information that we collect from your social media account depends on your social media account's privacy settings. Please note that their own use of your information is not governed by this Privacy Notice.

Information we may derive about you. When you use our Services, we may also process the information we collect about you to generate insights or additional information about you, both manually and through computerized and automated tools, to improve our Services and tailor them for you and your preferences.

2. How do we process your information?

In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with our legal and regulatory obligations. We may also process your information for other purposes which are in line with the purposes described in this Privacy Policy or with your prior explicit consent where legally mandated.

We process your personal information for a variety of reasons, including:

• To facilitate account creation and authentication and otherwise manage user accounts.
• To respond to user inquiries and offer support to users.
• To request feedback and to contact you about your use of our Services.
• To send you marketing and promotional communications (in accordance with your marketing preferences and where we have obtained your consent as required by applicable spam laws). You can opt out of our marketing emails at any time.
• To deliver targeted advertising to you.
• To evaluate and improve our Services, products, marketing, and your experience.
• To identify usage trends and determine the effectiveness of our promotional campaigns.

3. When and with whom do we share your personal information?

In Short: We may share information in specific situations described in this section and/or with categories of third parties for the purposes described in this Privacy Policy.

We may share your data with third-party vendors, service providers, contractors, or agents who perform services for us or on our behalf. The categories of third parties we may share personal information with include: AI Platforms, Data Analytics Services, Data Storage Service Providers, Performance Monitoring Tools, Sales & Marketing Tools, User Account Registration & Authentication Services, Website Hosting Service Providers, Payment Processors, Ad Networks, Affiliate Marketing Programs, Cloud Computing Services, Communication & Collaboration Tools, Order Fulfillment Service Providers, Product Engineering & Design Tools, Retargeting Platforms, Social Networks, Testing Tools, Government Entities, Finance & Accounting Tools.

We also may need to share your personal information in the following situations: Business Transfers; when we use Google Maps Platform APIs; with Affiliates; with Business Partners; Offer Wall (third-party offer walls in our application(s)); wherever we are legally required to do so; upon your express request.

Please note that we may, at our discretion, transfer and disclose your information with third parties as described above which are located outside the borders of the jurisdiction in which you reside or domiciled, including in countries that may provide a different level of data protection than that provided in the jurisdiction where you reside or domiciled.

4. What is our stance on third-party websites?

In Short: We are not responsible for the safety of any information that you share with third parties that we may link to or who advertise on our Services, but are not affiliated with our Services.

The Services may link to third-party websites, online services, or mobile applications and/or contain advertisements from third parties that are not affiliated with us. We do not make any guarantee regarding any such third parties, and we will not be liable for any loss or damage caused by the use of such third-party websites, services, or applications. Any data collected by third parties is not covered by this Privacy Notice. You should review the policies of such third parties and contact them directly to respond to your questions.

5. Do we use cookies and other tracking technologies?

In Short: We may use cookies and other tracking technologies to collect and store your information.

We may use cookies and similar tracking technologies (like web beacons and pixels) to gather information when you interact with our Services. Some online tracking technologies help us maintain the security of our Services and your account, prevent crashes, fix bugs, save your preferences, and assist with basic site functions. We also permit third parties and service providers to use online tracking technologies on our Services for analytics and advertising.

Specific information about how we use such technologies and how you can refuse certain cookies is set out in our Cookie Policy. We may share your information with Google Analytics. To opt out of being tracked by Google Analytics across the Services, visit https://tools.google.com/dlpage/gaoptout. For more information on the privacy practices of Google, please visit the Google Privacy & Terms page.

6. Do we offer artificial intelligence-based products?

In Short: We offer products, features, or tools powered by artificial intelligence, machine learning, or similar technologies.

As part of our Services, we offer products, features, or tools powered by AI ("AI Products"). These tools are designed to enhance your experience. The terms in this Privacy Notice govern your use of the AI Products within our Services. We provide the AI Products through third-party service providers (including Google Cloud AI, Anthropic, Amazon Web Services (AWS) AI, Groq and OpenAI). Your input, output, and personal information may be shared with and processed by these AI Service Providers. Certain aggregated, statistical, or pseudonymized data may also be shared with our AI Service Providers as further described in our Cookie Policy. We do not intentionally share personal information with them for AI training purposes. Our AI Products are designed for functions such as AI insights. All personal information processed using our AI Products is handled in line with our Privacy Notice and our agreements with third parties.

7. How do we handle your social logins?

In Short: If you choose to register or log in to our Services using a social media account, we may have access to certain information about you.

Our Services offer you the ability to register and log in using your third-party social media account details (like your Facebook or X logins). Where you choose to do this, we will receive certain profile information about you from your social media provider. The profile information we receive may vary depending on the social media provider concerned, but will often include your name, email address, friends list, and profile picture. We will use the information we receive only for the purposes that are described in this Privacy Notice or that are otherwise made clear to you on the relevant Services. We do not control, and are not responsible for, other uses of your personal information by your third-party social media provider.

8. How long do we keep your information?

In Short: We keep your information for as long as necessary to fulfill the purposes outlined in this Privacy Notice unless otherwise required by law.

We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law. When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize such information, or, if this is not possible, we will securely store your personal information and isolate it from any further processing until deletion is possible.

9. How do we keep your information safe?

In Short: We aim to protect your personal information through a system of organizational and technical security measures.

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. However, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.

10. What are your privacy rights?

In Short: You may review, change, or terminate your account at any time, depending on your country, province, or state of residence.

Withdrawing your consent: If we are relying on your consent to process your personal information, you have the right to withdraw your consent at any time by contacting us using the contact details provided in the section "HOW CAN YOU CONTACT US ABOUT THIS NOTICE?" below. This will not affect the lawfulness of the processing before its withdrawal.

Opting out of marketing and promotional communications: You can unsubscribe from our marketing and promotional communications at any time by clicking on the unsubscribe link in the emails that we send, or by contacting us using the details provided below. However, we may still communicate with you for service-related messages that are necessary for the administration and use of your account.

Account Information: If you would at any time like to review or change the information in your account or terminate your account, you can log in to your account settings and update your user account, or contact us using the contact information provided. Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. However, we may retain some information in our files to prevent fraud, troubleshoot problems, assist with any investigations, enforce our legal terms and/or comply with applicable legal requirements.

Cookies and similar technologies: Most Web browsers are set to accept cookies by default. If you prefer, you can usually choose to set your browser to remove cookies and to reject cookies. If you choose to remove or reject cookies, this could affect certain features or services of our Services. You may also opt out of interest-based advertising by advertisers on our Services.

If you have questions or comments about your privacy rights, you may email us at info@punch-portal.com.

Right to review and request correction or deletion (in certain circumstances): In certain jurisdictions you may have certain rights in connection with your personal information in accordance with applicable privacy laws. For example, according to the Israeli Protection of Privacy Law, 5741-1981, every person is entitled to inspect the information about them held in a computerized database, and if upon inspecting the information the person finds that it is inaccurate, incomplete, unclear, or outdated, such person is entitled to request to correct or delete such information. If the information is used for direct marketing, such person is entitled to request (in writing) that the information relating to them will be deleted or no longer used for direct marketing purposes. If you use our Services in or from Israel, you may exercise your privacy rights under the Israeli Protection of Privacy Law by contacting us at Section 13 below.

11. Controls for do-not-track features

Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage, no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this Privacy Notice.

12. Do we make updates to this notice?

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated "Revised" date at the top of this Privacy Notice. If we make material changes to this Privacy Notice, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this Privacy Notice frequently to be informed of how we are protecting your information.

13. How can you contact us about this notice?

If you have questions or comments about this notice, including for exercising privacy rights you may be entitled to under applicable laws in connection with your personal information, you may email us at info@punch-portal.com or contact us by post at:

Punch Loyalty Ltd.,
Halperin 8
Tel Aviv 6340410
Israel

14. How can you review, update, or delete the data we collect from you?

You may request to review, update, or delete your personal information by contacting us at the details provided in Section 13 above. We will respond in accordance with applicable data protection laws.