Privacy

The controller of your personal data is Clean Whale Sp. z o.o., based in Kraków at ul. Grzegórzecka 43/2, 31-532 Kraków, Polska, entered in the National Court Register (KRS) under number 0000868230, NIP 6751738063, REGON 387455114 ("Punkto", "we").

For any matters relating to the processing of your personal data, you can contact us at: [email protected].

The scope of data depends on whether you use Punkto as a customer of a loyalty program or as a partner (business) running one.

Customers (users of the Punkto app)

• phone number — provided during registration and login, verified with an SMS code,
• name, email address, and profile photo — if you choose to add them in your account settings,
• data from signing in via Google, Facebook, or Apple — if you choose this login method (name, email address, account identifier shared by the provider),
• loyalty points history, referral codes, and transaction history within the Punkto program,
• device identifier and push notification token — if you agree to notifications in the app,
• information about your consent to marketing communications — if you give such consent in your account settings.

Partners (businesses using Punkto) and their employees

• business data: name, logo, business category, description, address, contact details (phone, email), links to social media and messaging apps, business hours,
• business registry data: NIP (tax identification number) and data retrieved from the GUS registry (REGON, name, address) based on the provided NIP,
• data of individuals representing the partner and employees added to the dashboard: first name, last name, email address, phone number, profile photo,
• billing data: company name, NIP, and billing address, email address for invoicing,
• payment method data — we store only the token identifier, card brand, last 4 digits, and expiry date; full payment card data is processed directly by Stripe and never reaches Punkto's servers,
• data related to orders of Punkto stickers/materials shipped to the partner: recipient's name, phone number, delivery address.

Customers of partners' online stores

If a partner connects their online store (e.g. WooCommerce, Allegro, Amazon, Shoper) or booking system to Punkto, Punkto may process that store's customer data (name, email address, phone number, order data) to the extent necessary for the loyalty program to function. In such cases, the controller of the store customer's data remains the partner (the business running the store), and Punkto processes that data as a processor, under an agreement with the partner.

Data collected automatically

Information about cookies and similar technologies that may be used while using our website is described in the Cookie Policy.

• Providing the Punkto service, managing your account, running the loyalty program, handling support requests — Article 6(1)(b) GDPR (performance of a contract).
• Issuing invoices, billing, and tax/accounting obligations — Article 6(1)(c) GDPR (legal obligation).
• Ensuring the security of the service, preventing abuse, statistical analysis of traffic for service development, contact regarding service-related matters — Article 6(1)(f) GDPR (our legitimate interest).
• Sending marketing communications and signing in via Google/Facebook/Apple — Article 6(1)(a) GDPR (your consent, which you may withdraw at any time).

Your data may be shared with entities that support us in providing the service, in particular:

• providers of the hosting infrastructure on which Punkto runs (servers located in the European Union),
• Twilio — provider of SMS codes used to verify phone numbers,
• Stripe — provider handling partners' payments,
• Expo — provider of push notification infrastructure for the mobile app,
• Google, Meta (Facebook), and Apple — in connection with signing in via these platforms, if you use this option,
• Google Analytics — for anonymous website visit statistics (details in the Cookie Policy),
• integration platforms designated by the partner (e.g. WooCommerce, Allegro, Amazon, Shoper, booking systems) — solely to the extent necessary to synchronize loyalty program data,
• our email service provider, used to send transactional messages,
• entities authorized under applicable law (e.g. tax authorities), upon their request.

We do not sell your personal data to third parties.

Some of our providers (e.g. Google, Meta, Apple, Stripe, Twilio, Expo) are based, or process data, outside the European Economic Area, including in the United States. In such cases, data transfers take place on the basis of mechanisms provided for under the GDPR, in particular standard contractual clauses approved by the European Commission.

We retain data related to your account for as long as you use Punkto, and after your account is closed, for the period necessary to handle any potential claims, no longer than the limitation period for claims under applicable law. Data contained in invoices and billing documents is retained for the period required by accounting and tax regulations. Data processed on the basis of consent (e.g. marketing) is retained until that consent is withdrawn.

In connection with the processing of your personal data, you have the right to:

• access your data and obtain a copy of it,
• rectify (correct) your data,
• erase your data ("the right to be forgotten"),
• restrict processing,
• transfer your data to another controller,
• object to processing carried out on the basis of a legitimate interest,
• withdraw your consent at any time, without affecting the lawfulness of processing carried out before its withdrawal,
• lodge a complaint with the President of the Polish Personal Data Protection Office (UODO) if you believe that the processing of your data violates the GDPR.

To exercise the rights above, write to us at [email protected]. We will respond without undue delay, and no later than one month from receiving your request.

We apply appropriate technical and organizational measures to protect your data against unauthorized access, loss, or destruction, including encrypting connections and limiting access to data to authorized personnel only.

This policy may be updated from time to time, for example due to changes in the law or the development of the Punkto service. We will inform you of any material changes in the app or by email. The current version of the policy is always available on this page.