Privacy Policy

1. Who we are

This Privacy Policy explains how personal data is processed in connection with the Montipass service (the “Service”), operated by Monti Labs Ltd Şti (“we”, “us”, “our”). Our role under the EU General Data Protection Regulation (GDPR) and the UK GDPR depends on whose data it is:

• Business account holders and their team members: we are the controller. We decide why and how this data is processed.
• Customers who join a business’s loyalty programme: the business is the controller. It decides to run the programme and what to send to its customers. We process this data on the business’s behalf and on its instructions, as its processor, under the data processing terms in section 8 of our Terms of Service.

Tax number: [TAX NUMBER]
Address: [ADDRESS]
Email: [email protected]

2. The data we collect

The Service has two kinds of users, and we collect different data from each.

2.1 Business account holders

• First name and last name
• Email address
• Business details (name, logo, brand colours)
• Location (branch) details
• Account activity records (sign-ins, use of the dashboard)

2.2 Customers taking part in a loyalty programme

• First name
• Email address (optional; stored only if you enter it yourself on the sign-up screen, and used only to restore your card if you change devices)
• Visit and reward history
• Wallet card registration details (Apple Wallet or Google Wallet device identifier)
• Location data (collected only if the business has turned on location-based notifications and your device allows it; this feature is off by default)

Please note: only a first name is required to join a loyalty programme. The email address is optional and is used only to restore your card on another device. We do not ask for a phone number or a password.

3. Why we use the data, and the legal basis

Under the GDPR, each use of personal data needs a legal basis.

3.1 Business account holders (we are the controller)

• Providing the account and the business dashboard: performance of a contract (Article 6(1)(b) GDPR).
• Keeping the Service secure and preventing misuse: our legitimate interest in protecting the Service and its users (Article 6(1)(f)).
• Meeting legal obligations, such as tax and accounting records or requests from authorities: legal obligation (Article 6(1)(c)).

3.2 Loyalty programme customers (the business is the controller)

We use this data only to provide the Service to the business: recording stamps and rewards, keeping the wallet card up to date and delivering the notifications and campaigns the business sends. The business is responsible for having a legal basis for this processing. Typically this is the performance of the loyalty programme you joined (Article 6(1)(b)), and your consent for location-based notifications, given through your device’s permission settings (Article 6(1)(a)), which you can withdraw at any time in your device settings.

We also process this data to keep the Service secure and to prevent misuse, which is part of the security we provide to the business as its processor.

We do not sell your data to third parties for marketing purposes.

4. Who we share data with

We share personal data only to the limited extent described below. When we process loyalty programme data on behalf of a business, the providers listed here act as our sub-processors; businesses authorise them under our data processing terms.

• Apple Inc. and Google LLC: to provide wallet card services (PassKit and the Google Wallet API).
• Hostingdünyam: our server provider. The database and the application are hosted on a server we rent in Türkiye.
• Cloudflare, Inc.: for domain management, traffic security (DNS, CDN, DDoS protection) and storing backups. Every request to the site passes through Cloudflare. Daily database backups are stored on Cloudflare R2 within the European Union.
• Resend Inc.: to send account emails such as address verification and password reset.
• Competent authorities, where we are required to do so by law.

5. International transfers

If you are in the European Economic Area or the United Kingdom, your data is transferred outside it: the Service is hosted in Türkiye, and some of the providers listed above are based in the United States. Türkiye does not have an adequacy decision from the European Commission.

For transfers from the EEA we rely on the standard contractual clauses adopted by the European Commission (Implementing Decision (EU) 2021/914). Between a business and us, these are part of our data processing terms. For transfers from the United Kingdom we rely on the International Data Transfer Addendum issued by the UK Information Commissioner. Where a provider in the United States is certified under the EU-US Data Privacy Framework, transfers to it may rely on that framework instead. You can ask us for a copy of the safeguards that apply to a particular transfer.

6. How long we keep data

We keep your data for as long as your account is active and for as long as necessary to meet our legal obligations. When you ask us to delete your account, your data is deleted or anonymised within a reasonable period.

7. Your rights

Subject to the conditions set out in the GDPR and the UK GDPR, you have the right to:

• access the personal data we hold about you and receive a copy of it;
• have inaccurate or incomplete data corrected;
• have your data erased;
• restrict how we process your data;
• receive your data in a portable format and have it transmitted to another provider;
• object to processing based on our legitimate interests;
• withdraw your consent at any time, where processing is based on consent;
• lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work.

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

If you have a business account, write to [email protected] or use our contact page to exercise any of these rights. We will reply within one month.

If you joined a business’s loyalty programme, the business is the controller of your data, so please send your request to that business. If you write to us instead, we will pass your request on to the business without delay and help it respond. A business can also erase a customer’s data directly from its dashboard.

8. Security

We use industry-standard security measures to protect your data: encrypted data transfer (HTTPS/TLS), access control at database level (Row Level Security) and regular security reviews.

9. Children

The Service is not intended for anyone under 18. We do not knowingly collect data from anyone under 18.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will let you know about significant changes. The current version is always published on this page.

11. Contact

For questions about privacy, reach us through our contact page or at [email protected].