1. Scope of This Policy
This Privacy Policy applies to personal data processed through the Royalty website at getroyally.com, demo requests and business enquiries, loyalty systems operated for participating restaurants, communications sent through Royalty services, and related management, support, maintenance and analytics activities.
Where Royalty operates a loyalty program on behalf of a restaurant, that restaurant may also provide its own privacy information governing its processing of customer data.
2. Our Role and the Restaurant’s Role
Royalty may process personal data in different capacities depending on the circumstances.
When you contact Royalty directly, request a demonstration, communicate with us about our services or otherwise interact directly with our business, DAVID CRVENKOVIĆ PR FUTURIA DC generally acts as the data controller for that processing.
When Royalty provides a loyalty system to a restaurant and processes the restaurant’s customer data according to the restaurant’s instructions, the restaurant will generally act as the data controller and Royalty will generally act as a data processor.
Royalty requires access to certain loyalty-program data where necessary to operate, manage, maintain, support and secure the service. The exact responsibilities of Royalty and each participating restaurant may be further defined in the applicable service agreement and data processing agreement.
3. Information We Collect
Website and business enquiries
When you request a demo or contact Royalty, we may collect your name, restaurant or business name, city or location, email address, telephone number, preferred contact method, information included in your message, and other information you voluntarily provide.
We may also process limited technical information necessary for the secure operation of our website and systems, such as IP addresses, browser information, server logs and security-related information.
Restaurant loyalty members
When you join a loyalty program powered by Royalty, information processed through the system may include your email address, loyalty account or unique customer identifier, restaurant visits, loyalty points and rewards, reward redemption history, transaction or spending information where integrated with the restaurant’s system, preferences and engagement history, campaign interactions, dates and frequency of visits, periods of inactivity, and other information necessary to provide the restaurant’s loyalty program.
The precise information processed may differ between participating restaurants and according to the configuration of their Royalty system.
4. How We Use Personal Data
Depending on the relationship and context, personal data may be processed to create and maintain loyalty accounts; calculate and manage loyalty points and rewards; help restaurants understand customer engagement; operate, maintain, secure and support Royalty systems; provide dashboards and analytics; identify engagement patterns; generate recommendations for loyalty campaigns and offers; send permitted loyalty-related email communications; respond to demo requests and business enquiries; provide support; protect against misuse, fraud and security threats; improve service reliability and functionality; fulfil contractual obligations; and comply with applicable legal obligations.
We do not sell personal data.
5. AI Processing and Data Minimisation
Royalty uses artificial intelligence services provided through the OpenAI API to provide selected AI-powered insights and recommendations. When information is submitted to the AI service, Royalty limits the information to what is reasonably necessary for the relevant operation.
Customer behavioural information, such as visit frequency, spending or transaction patterns, inactivity periods, timing and similar loyalty activity may be processed together with an internal customer identifier.
Direct identifying information such as the customer’s name or email address is not provided to the AI service for these operations.
The internal customer identifier is used so Royalty’s system can associate the resulting insight with the appropriate loyalty account without providing the AI service with the customer’s direct identity. This data should therefore be understood as pseudonymised rather than necessarily anonymous.
AI-generated recommendations are intended to assist restaurants with loyalty, engagement and campaign decisions and are not intended to make decisions producing legal or similarly significant effects on customers.
6. Technology Providers
Royalty currently uses Bubble as part of the application infrastructure used to build, host and operate the loyalty system. Where AI-powered functionality is used, selected pseudonymised information may be transmitted through the OpenAI API for the purpose of generating the relevant analysis or recommendation.
Royalty may also use other hosting, email delivery, security, database, support and infrastructure providers where reasonably necessary to operate the service. Service providers are expected to process personal data subject to applicable contractual and data-protection obligations.
7. Email Communications
Participating restaurants may use Royalty to send loyalty-related emails, including rewards and loyalty updates, available offers, customer-specific promotions, reminders, restaurant campaigns and re-engagement offers.
Where consent is required by applicable law for promotional electronic communications, such communications should only be sent where the required consent or another appropriate lawful basis exists. Recipients may unsubscribe from marketing communications using the unsubscribe method provided in the relevant email or by contacting the responsible restaurant.
Service-related communications necessary to operate a loyalty account may be treated separately from optional marketing communications where permitted by applicable law.
8. Legal Bases for Processing
Where applicable data-protection law requires a legal basis, personal data may be processed on the basis of consent; performance of a contract or steps taken before entering into a contract; legitimate interests, where those interests are not overridden by the individual’s rights and freedoms; or compliance with legal obligations.
For loyalty-program data processed by Royalty on behalf of a restaurant, the restaurant is responsible for determining the appropriate legal basis where it acts as controller.
9. Sharing of Personal Data
Personal data may be shared with or made accessible to the participating restaurant operating the relevant loyalty program, authorised Royalty personnel, hosting and infrastructure providers, email delivery providers, database and technology providers, AI service providers for the limited purposes described above, security and technical support providers, professional advisers where necessary, and public authorities where disclosure is required by law.
We do not sell restaurant customer databases or loyalty-member personal data to third parties for their independent advertising purposes.
10. International Data Transfers
Some technology providers used to operate Royalty may process or store information outside Serbia or outside the country in which a loyalty member is located. Where an international transfer is subject to applicable data-protection requirements, Royalty will use appropriate legal mechanisms and safeguards as required, which may include contractual safeguards or other recognised transfer mechanisms.
11. Data Retention
We retain personal data only for as long as reasonably necessary for the purpose for which it was collected and as required by applicable law. Retention periods may depend on the duration of the relationship with a restaurant, whether a loyalty account remains active, instructions received from a participating restaurant where Royalty acts as processor, contractual requirements, security and dispute-resolution requirements, and legal, accounting or regulatory obligations.
When personal data is no longer required, it will be deleted, anonymised or otherwise handled in accordance with applicable requirements.
12. Data Security
Royalty takes reasonable technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration, loss, misuse or destruction. Access to restaurant customer information is limited to circumstances where access is reasonably necessary for operation, management, maintenance, support or security of the Royalty service.
No online service or method of electronic storage can guarantee absolute security.
13. Your Privacy Rights
Depending on applicable law and the circumstances, you may have rights to request access to personal data, correction of inaccurate information, deletion, restriction of processing, objection to certain processing, data portability, withdrawal of consent where processing is based on consent, and the right to lodge a complaint with a competent data-protection authority.
If your request concerns a loyalty program operated by a particular restaurant, you should normally contact that restaurant where it acts as the controller. Royalty will assist participating restaurants with appropriate data-subject requests where Royalty acts as their processor.
For personal data for which Royalty is the controller, requests can be sent to info@getroyally.com. We may need to verify your identity before completing certain requests.
14. Cookies and Website Analytics
Royalty may use cookies or similar technologies that are technically necessary for the website to function correctly, maintain security, remember essential preferences or provide requested functionality.
At the date of this Privacy Policy, Royalty does not currently use Google Analytics, Meta Pixel or similar advertising analytics technologies on the website. If non-essential analytics, advertising or tracking technologies are introduced in the future, this Privacy Policy and, where appropriate, our cookie notice and consent mechanism will be updated.
15. Children’s Privacy
Royalty is designed as a restaurant loyalty and business technology service and is not specifically directed at children. Participating restaurants are responsible for ensuring that their loyalty programs are operated in accordance with applicable age, consent and data-protection requirements.
If we become aware that personal data has been collected in circumstances that do not comply with applicable requirements, appropriate steps will be taken to address the issue.
16. Third-Party Services and Links
The Royalty website or loyalty systems may contain links to websites or services operated by third parties. Royalty is not responsible for the privacy practices of independent third-party websites or services. We encourage users to review the applicable privacy information before providing personal information to those services.
17. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes to Royalty, our technology, participating services or applicable legal requirements. The latest version will be published on our website with an updated “Last updated” date. Where required by applicable law, we will provide additional notice of material changes.