Loyalty programme privacy policy
FOODLUS LOYALTY
Version 2.0 · in force since 22 September 2026
Data controller
- Company name
- FOODLUS SOLUTIONS, S.L.
- Tax ID (NIF)
- B06944862
- Registered address
- Calle Amezketa 21, 20010 Donostia-San Sebastián
- Contact email
- contacto@foodlus.com
1. Who processes your data
The person responsible for processing your personal data is FOODLUS SOLUTIONS SL, who acts as a loyalty and data storage service provider.
However, the business Retro food where you registered in the loyalty program will be the one who uses your data for commercial purposes, such as sending promotions, offers and personalized communications.
The controller of your data is the entity identified above (hereinafter, "the Establishment").
2. What data we process
- Registration data: first name and surname(s), date of birth, email address, telephone number and, where applicable, any additional fields that the Establishment configures in the form.
- Activity data: card and points balance, points earned and redeemed, amount of each purchase, date, time and venue where it takes place, orders, coupons and rewards history.
- Communication data: communications sent and a record of delivery and opening.
- Technical data: digital card identifier and device token, used exclusively to keep the card in your wallet up to date.
No bank details or payment card details are processed. No special categories of data under article 9 GDPR, such as health data, are requested. If any additional field configured by the Establishment could reveal such data, providing it is always voluntary.
3. Why we process your data and on what legal basis
| Purpose | Legal basis |
|---|---|
| Managing your registration and your account, issuing the digital card, earning and redeeming points, and handling your enquiries | Performance of a contract (art. 6.1.b GDPR): the Programme's Terms and Conditions |
| Sending you operational notices about your balance, your rewards and changes to the Programme | Performance of a contract |
| Sending you promotions, offers, news, birthday greetings and inactivity reminders | Performance of a contract, since receiving these communications is part of the Programme you have signed up to, and art. 21.2 of the Spanish Information Society Services Act (LSSI), as they relate to products and services similar to those you have already purchased. You can unsubscribe at any time, free of charge, via the link in any communication |
| Segmenting participants according to how often they visit and how much they spend in order to tailor communications | Legitimate interest of the Establishment in managing its Programme effectively. You may object |
| Inviting you to leave a public review | Legitimate interest. It is always voluntary |
| Complying with legal obligations and handling any claims | Legal obligation and legitimate interest |
Profiling. We group participants into segments according to their activity in order to send them better-tailored communications. No automated decisions are made that produce legal effects concerning you or similarly significantly affect you.
4. Who can access your data
- FOODLUS SOLUTIONS, S.L., as data processor.
- Technology providers involved in delivering the service, as sub-processors: cloud hosting (Amazon Web Services, Paris region, European Union), issuing and updating the digital card (Apple and Google), sending emails and analytics of website usage. The up-to-date, detailed list is available on request from contacto@foodlus.com.
- Public authorities and courts, where there is a legal obligation.
We do not sell your data or disclose it to third parties for advertising purposes.
Transfers outside the EU. Data is hosted in the European Union. However, issuing and updating the digital card involves its processing by Apple and Google in the United States, and certain email communications may be processed outside the European Economic Area. These transfers are covered by the EU-US Data Privacy Framework adequacy framework or by Standard Contractual Clauses. You can request a copy of the safeguards from contacto@foodlus.com.
5. How long we keep your data
For as long as you are a participant in the Programme and the Programme remains in force.
If you request the erasure of your data or the Establishment stops using the platform, your data will be erased within a maximum of 30 days, except for the minimum necessary to handle any claims, which will be blocked for the statutory limitation periods and then deleted.
If you unsubscribe only from commercial communications, your email address will be kept flagged as excluded so that we do not write to you again.
Technical records of the digital card are kept for 30 days.
6. Your rights
You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and you may object at any time to receiving commercial communications.
Write to the Establishment's contact email given at the top, stating the right you are exercising. If you prefer, you can contact contacto@foodlus.com and your request will be forwarded to the Establishment. You will receive a reply within a maximum of one month.
If you are not satisfied with the reply, you may lodge a complaint with the Spanish Data Protection Agency (AEPD) (www.aepd.es, C/ Jorge Juan 6, 28001 Madrid).
7. Minors
The Programme is intended for people aged 18 or over. If the registration of a minor is detected, the account will be deleted.
8. Security
Appropriate technical and organisational measures are applied: encryption of all communications using TLS, access to data restricted by role and through named accounts, a database not accessible from the Internet, and a record of communications sent.
9. Cookies
The Programme's web pages may use first-party and third-party cookies for analytics purposes. You can see the details and manage your preferences in the Establishment's cookie policy.
10. Changes to this policy
If this policy is changed, you will be informed by email or via the digital card. The version in force is always the one published at this link.