Privacy Policy

Effective from 25 October 2026

This policy explains how BonusQR s. r. o. processes personal data when operating the bonusqr.com website and the BonusQR service (the web application app.bonusqr.com, mobile apps, Apple Wallet and Google Wallet cards, bookings, the e-shop and related features). The terms Provider, Client, Manager, Staff, Customer and Service have the same meaning as in the Terms of Service.

1. Who processes your personal data

The controller is BonusQR s. r. o., registered office Bosákova 3783/7, 851 04 Bratislava – Petržalka, Slovak Republic, company ID (IČO) 57246475, registered in the Commercial Register of the Bratislava III Municipal Court, section Sro, file No. 192253/B (“BonusQR”, “we” or “us”).

You can contact us about personal data by e-mail at info@bonusqr.com or in writing at our registered office. We have not appointed a data protection officer, as the law does not require us to.

2. In which role we process your data

BonusQR is a platform that businesses (cafés, restaurants, salons, shops and other venues) use for their loyalty programmes. We therefore process your data in two roles:

• As a controller we process the data of website visitors, of Clients and Managers (registration, account, subscription, support), of your BonusQR user account (sign-in credentials, name, e-mail and profile settings) and technical data needed to operate the Service securely.
• As a processor on behalf of a business we process data about your participation in a particular business’s loyalty programme – visits, purchases, stamps, points, vouchers, bookings, purchases in its e-shop and the messages the business sends you. The controller of this data is the business whose programme you joined. If you have a question about this data or want to exercise your rights, please contact the business directly; if you contact us, we will pass your request on to it and help it respond.

3. What data we process and why

3.1 Visitors to bonusqr.com

• Technical data (IP address, browser and device type, pages visited, time of visit) – to display the website, keep it secure and fix errors. Legal basis: legitimate interest (Article 6(1)(f) GDPR).
• Choice of country and language – to show you the right language and prices in your country’s currency. We also determine the country from the IP address. Legal basis: legitimate interest.
• Contact forms and enquiries (name, e-mail, phone, message) – to answer your question or enquiry. Legal basis: steps taken before entering into a contract and legitimate interest. We protect the forms against spam with Google reCAPTCHA.
• Analytics and ad measurement (Google Analytics, Google Ads, OpenAI) and visit recording – to understand how the website is used and which campaigns work. Legal basis: consent (Article 6(1)(a) GDPR) through the cookie bar.
• Chat – if you write to us via the chat, we process the conversation and the details you give us to reply. Legal basis: legitimate interest.

3.2 Clients and Managers

• Registration and account – name, e-mail, password (stored only in encrypted form), language; when signing in with Google or Apple also the account identifier and profile photo. Purpose: creating and managing the account and providing the Service. Legal basis: performance of a contract (Article 6(1)(b) GDPR).
• Venue details – name, address and location of the venue, link to its Google Maps profile, logo, colours and images. These details are shown to Customers. Legal basis: performance of a contract.
• Subscription and payments – plan, period, payment history, the customer identifier at the Stripe payment gateway, card type and last four digits. Full card details are processed by Stripe, not by us. Legal basis: performance of a contract and the legal obligation to keep accounts (Article 6(1)(c) GDPR).
• Communication – service e-mails, onboarding e-mails with guides and monthly programme reports (you can unsubscribe from the reports with one click), communication with support by e-mail and chat. Legal basis: performance of a contract and our legitimate interest in informing Clients about the Service.
• Support – to resolve your request, a support agent may view your account. Legal basis: performance of a contract.

3.3 Business staff

We process the name, e-mail and access credentials of Staff and records of who scanned a QR code or managed a booking on behalf of the Client who gave the Staff access and is the controller of this data.

3.4 Customers – loyalty programme members

• BonusQR user account (controller: BonusQR) – name, e-mail, password in encrypted form, language, when signing in with Google or Apple the account identifier and profile photo, optionally date of birth and gender, the e-mail news subscription setting. Purpose: running the account, signing in and showing your loyalty cards with all businesses whose programmes you take part in. Legal basis: performance of the contract on the use of the account (Article 6(1)(b) GDPR).
• Participation in a business’s loyalty programme (controller: the business, we act as processor) – visits, purchases and their amounts, balances of stamps, points, cashback and credit, vouchers and rewards, referrals, group membership, purchases in the business’s e-shop and data from the business’s connected online shop (e.g. WooCommerce, Shopify – e-mail, order number and amount). The business sees the data about your participation in its own programme; other businesses do not.
• News and notifications – the business may send you news as push notifications (if you allow them on your device), by e-mail (if the subscription is turned on in your profile) or as a message on your Apple Wallet or Google Wallet card. For this we process your device and Wallet card identifiers. News e-mails include aggregated open and click measurement.
• Birthday and special-occasion offers – if you provide your date of birth, the business may automatically send you a birthday voucher.
• Review requests – after a number of visits the business may ask you once for a review on Google Maps.

3.5 Bookings, gift vouchers and the e-shop

• Bookings – name, e-mail, phone number, a note and any other details the business requires, confirmations and reminders by e-mail and SMS. We process them on behalf of the business.
• Gift vouchers – if you give someone a voucher, we process the recipient’s e-mail to deliver it. We process it on behalf of the business.
• A business’s e-shop – payments are received through the Stripe payment gateway. You enter your card details and, where applicable, delivery address and phone directly with Stripe; we record what you bought.

3.6 Security and operation of the Service

For security, protection against misuse, fixing errors and improving the Service we process technical records – IP address, device and browser type, records of sign-ins, scans and API calls, error reports and records of how the app is used. Legal basis: legitimate interest.

3.7 Automatic groups and profiling

A business may set up automatic grouping of Customers, for example by number of visits, spending, time of visits or inactivity, and send them offers accordingly. Such grouping has no legal effect on you and does not similarly significantly affect you.

4. Who we share data with

We do not sell personal data. We share it only to the extent needed to run the Service:

• with the business whose loyalty programme you joined, where you booked or bought – within your participation in its programme;
• with our processors who provide part of the Service for us (table below);
• with public authorities where the law requires us to.

We run the Service’s servers and databases on our own infrastructure. We send e-mails through our own mail server.

If a business connects the Service to its online shop (e.g. WooCommerce or Shopify), we exchange data with that shop on the business’s instructions.

5. Where we store data and transfers outside the EU

We store data according to the business’s region: data of businesses from Europe and their Customers is stored exclusively on servers in the European Union, data of businesses from Asia in Singapore and data of businesses from the Americas in the United States of America.

Some processors (in particular Stripe, Google, Apple, OneSignal, Sentry, MaxMind and OpenAI) may also process data outside the European Economic Area, in particular in the USA. Such transfers are based on an adequacy decision of the European Commission (e.g. the EU–US Data Privacy Framework) or on standard contractual clauses approved by the European Commission.

6. How long we keep data

• Client, Manager and Customer accounts – for as long as the account exists. After the account is closed we delete or anonymise the data within 30 days at the latest.
• Data in a business’s loyalty programme – for as long as the business keeps it, and no later than 30 days after the business’s account is closed, unless the business asks for earlier deletion.
• Accounting documents – 10 years, as required by the Slovak Accounting Act.
• Support communication and enquiries – for as long as needed to resolve them, at most 3 years.
• Technical and security records – usually no longer than 12 months.
• Data processed on the basis of consent – until the consent is withdrawn.

7. Your rights

Under the GDPR you have the right to:

• access your personal data and obtain a copy of it,
• have inaccurate or incomplete data rectified,
• have your data erased,
• restrict processing,
• data portability for the data you provided to us,
• object to processing based on legitimate interest and, at any time, to direct marketing,
• withdraw consent at any time without affecting the lawfulness of processing before its withdrawal,
• lodge a complaint with a supervisory authority – in Slovakia the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27, dataprotection.gov.sk, or the authority in the EU country where you live.

You can change your name, e-mail, date of birth, gender and news subscription in your profile in the app, where you can also delete your personal data and close your account. You can turn off push notifications in your device settings. Please send any other requests to info@bonusqr.com; we will handle them without undue delay and within one month at the latest. For requests about data in a business’s loyalty programme we proceed as described in section 2.

8. Cookies and similar technologies

The bonusqr.com website and the app use cookies and the browser’s local storage:

• necessary – sign-in, form security and the session (e.g. session cookies, XSRF-TOKEN, remembering the sign-in);
• preferences – the chosen country and language, the last opened business, your choice in the cookie bar;
• analytics and marketing – Google Analytics, Google Ads and OpenAI ad measurement;
• third-party services – the support chat, usage recording, error reporting and push notifications.

You can manage your choices through the cookie bar on the website and in your browser settings, where you can also delete cookies.

9. Data security

We protect data with appropriate technical and organisational measures: encrypted transfer (HTTPS), role- and permission-based access, storing passwords only in encrypted form, backups and restricted access to servers.

10. Children

The Service is not intended for persons under 16. If we find that a child under 16 has given us personal data without the consent of a parent or guardian, we will delete it.

11. Changes to this policy

We may update this policy, in particular when the Service or the law changes. The current version is always published on this page together with its effective date.