Joint controller arrangement
This notice explains, in plain language, how Zeal IO Ltd ("Zeal") and the shops, cafés and restaurants that run a loyalty programme through Zeal ("merchants") share responsibility for your personal data. It is the summary of our joint controller arrangement required by Article 26(2) of the UK GDPR.
When Zeal and a merchant are joint controllers
When you join a merchant's loyalty programme through Zeal, Zeal and that merchant decide together how your data is used. This covers:
- joining that merchant's loyalty programme
- recording your purchases at that merchant
- calculating and redeeming your rewards with that merchant
- messages sent to you on behalf of that merchant
Each arrangement covers one merchant's programme only. Zeal's technology that recognises a card across different merchants is run by Zeal alone, as an independent controller, and is described in the Zeal Privacy Policy.
Who does what
| Responsibility | Zeal | Merchant |
|---|---|---|
| Privacy notice (online) | Publishes the Zeal Privacy Policy | Links to it in its own communications |
| Privacy notice (in store) | Provides template wording | Displays signage at the point of sale |
| Asking for consent | Shows prompts on the terminal or app | Staff help customers where needed |
| Requests to see your data | Answers within 30 days | Passes the request to Zeal within 5 working days |
| Deleting your data | Carries out the deletion | Passes the request to Zeal |
| Security | Secures the Zeal platform | Secures the shop's own systems |
| Rewards | Calculates and records points | Hands over the reward |
| Marketing messages | Approves and sends them | Writes the content |
| Data breaches | Reports breaches in Zeal systems | Reports breaches in its own systems |
How to use your rights
You can ask either Zeal or the merchant to see, correct or delete your data, to stop marketing, or to object to how it is used. You do not need to work out who is responsible: whoever receives your request makes sure it is dealt with.
- Email Zeal at privacy@getzeal.io, or use the data privacy request form.
- To stop Zeal loyalty messages for a business, use the opt-out page.
- Zeal's data protection officer can be reached at dpo@getzeal.io.
- You can also ask the merchant directly, in store or using the contact details it gives you.
If you are unhappy with how your data has been handled, you can complain to the Information Commissioner's Office at ico.org.uk.
Changes
If the arrangement changes in a way that matters to you, we will update this notice within 30 days and tell affected customers by email or in the app.