Summary of Airtime’s Data Protection Principles 

• Only those within Airtime (and the third parties listed below) who need your data to perform their role have access to it – no one else.
• If we use suppliers to help us deliver our service, we restrict their use of your data to what you allow us to do and bind them to comply with Data Protection laws.
• Airtime users must be 18 or over. If we find we have inadvertently collected data from under-18s, we delete it as soon as we are made aware.

Important information and who we are 

We are Airtime Rewards Limited (referred to as Airtime, we, us or our in this privacy policy). Airtime is the controller and responsible for your personal data. Our company registration number is 08731821, England, and our registered office is:

Airtime Rewards Limited, 

5th Floor,

Queens House,

Queen St,

Manchester, 

M2 5HT.

We created Airtime to enhance the shopping experience of our members, providing a seamless service that gives moments of joy whilst making retail purchases. We believe loyalty and rewards programmes should be powered by great technology making them simple to operate and valuable for members. To deliver a truly seamless and personalised experience, we require our members to share their Personal Data with Airtime. We do not underestimate the importance and trust our members give to us in doing so and in this Privacy Policy we aim to provide transparency around how we hold and process Personal Data. 

This Privacy Policy sets out how and on what basis Airtime collects personal data and how you and your data are protected when you use the Airtime App, services, programme and website, or otherwise interact with us (including via a third-party integration).

Airtime cannot provide its App, services, programme without access to your personal data. If you do not want Airtime to use your data, we advise that the service might not be for you and we will not be able to provide the App, services, programme if you choose to stop sharing your data at any time.

Our App, services, programme and website are not intended for children, and we do not knowingly collect data relating to children.

Important: In these terms, for ease, where we refer to “bank account”, this includes bank accounts (including when you connect with open banking) and payment service provider accounts.

Contact

If you have any questions about our privacy policy or our collection, use, or storage of your personal data, please send an email to gdpr@airtime.co.uk 

What is a Data Controller?

A Data Controller is a company or organisation that collects or stores personal data and can decide how that personal data is used. Airtime is a data controller.

A Data Processor is a company or organisation that processes personal data on behalf of a Controller with the Controller instructing the Processor what to do with that data. Where we act as a processor, this policy will not apply but the policy of the Controller will instead – please refer to the relevant third party’s privacy policy. 

What is Personal Data?

Personal data under this Privacy Policy means any information relating to an identified or identifiable natural person (data subject); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. 

Airtime obtains your personal data when you use our App, services, programme, website or otherwise interact with us. Here is a list of the data that Airtime or third parties operating on our behalf may collect about you.

• Identity Data includes first name, last name, any previous names, member identifier, marital status, title, date of birth and gender.
• Contact Data includes billing address, address, email address and telephone numbers.
• Financial Data includes information about connected bank accounts and registered payment cards (for example, bank name, sort code, account number, card scheme, expiry date, provider name, product type) and the account held with Airtime.
• Transaction Data includes information about transactions made on (i) registered payment cards and/or (ii) bank accounts connected via open banking. This will be up to three years’ worth of history.
• Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, device ID and other technology on the devices you use to access this website. 
• Profile Data includes your username and password, purchases or orders made by you, your interests, preferences, feedback and survey responses.  
• Usage Data includes information about how you interact with and use our website, App, products and Services, including any data customised by you. 
• Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences.
• Cookies Data - the information collected through the cookies and similar technologies listed in our Cookies Notice available at https://airtime.co.uk/legal/cookies.

We do not collect any special categories of personal data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data).

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during our relationship with you.

How is your personal data collected?

We collect your personal data in various ways, including:

• Your interactions with us. You may give us your personal data by filling in online forms or by corresponding with us by post, phone, email or otherwise. This includes personal data you provide when you:
• apply for our products or services;
• create an account on our website or App;
• subscribe to our service or publications; 
• request marketing to be sent to you;
• enter a competition, promotion or survey; or
• give us feedback or contact us. 
• Automated technologies or interactions. As you interact with our website, we will automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies. Please see our cookies policy at at https://airtime.co.uk/legal/cookies for further details.
• Third parties or publicly available sources. We will receive personal data about you from various third parties and public sources, including Technical Data collected from analytics providers such as Google based outside the UK.

How We Use Your Data

Airtime uses your personal data to provide our App, services, programme and website, or otherwise interact with you as set out within this Privacy Policy.

We will only use your personal data when we have a lawful basis to do so. Our lawful basis for each purpose for which we use your personal data is specified below. Most commonly we will use your personal data in the following circumstances: 

• Consent. Where you have freely consented before the processing in a specific, informed and unambiguous indication of what you want. You can withdraw your consent at any time by contacting us.
• Performance of a contract. Where we need to process your personal data to perform a contract with you or where you ask us to take steps before we enter a contract with you. Where we rely on performance of a contract and you do not provide the necessary information, we will be unable to perform your contract.
• Legitimate interests. Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by contacting us.
• Legal obligation. Where we need to use your personal data to comply with a legal or regulatory obligation. Where we rely on legal obligation and you do not provide the necessary information, we may be unable to fulfil a right you have or comply with our obligations to you, or we may need to take additional steps, such as informing law enforcement or a public authority or applying for a court order. 

Purposes for processing data

We have set out below, in a table format, a description of all the ways we plan to use the various categories of your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.

If tables fail to load in app, please see - https://airtime.co.uk/legal/privacy

Delivery and improvement of our App and purchases

Account management and profiling

Direct marketing

Troubleshooting, improvement and security

Rights and obligations

Cookies and personalisation

Other communications

Personal data sharing

Automated decision making and profiling

We retain your information on our systems to match your details with new offers, retailers and to provide a gift card service. We use automatic processing or profiling to make automated decisions about you that generate and display these offers in our applications.

We want to share the benefits that Airtime can bring to all its consumers, so the data we collect might be used anonymously and aggregated in communications such as:

• Blog posts and infographics,
• Emails,
• Social media posts, and
• Marketing campaigns.

Any data we use to support the uses set out in the above bullet points is always anonymised and aggregated and can never be tracked to you personally.

Your Key Rights

You have a number of rights under data protection laws in relation to your personal data as more particularly described below. If you wish to exercise any of the rights set out below, please contact us. Please note, these rights are not always absolute rights and there may be occasions where we cannot agree or do not agree with your request – we will let you know where this is the case. 

You have the right to:

• Request access to your personal data (commonly known as a "data subject access request"). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
• Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
• Request erasure of your personal data in certain circumstances. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
• Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) as the legal basis for that particular use of your data (including carrying out profiling based on our legitimate interests). In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your right to object.
• You also have the absolute right to object at any time to the processing of your personal data for direct marketing purposes. 
• Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
• Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.
• Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in one of the following scenarios: If you want us to establish the data's accuracy; Where our use of the data is unlawful but you do not want us to erase it; Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or You have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
• Complain to the UK data protection regulator. If you are unhappy with how we process your personal data, we ask that you contact us first using the details below so that we have the chance to put it right. However, you also have the right to make a complaint to the ICO at any time. Please refer to the Complaints process below.

If you wish to exercise any of the rights set out above, please email us at gdpr@airtime.co.uk . We aim to respond to all requests within one month. Occasionally, it may take us longer than a month if your request is particularly complex or you have made several requests. In this case, we will notify you and keep you updated.

There is generally no fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive. Alternatively, we may refuse to comply with your request in these circumstances. We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

Airtime may need to request specific information from you to help us confirm your identity and ensure your right to access your personal information (or to exercise any of your other rights). This security measure ensures that personal information is not disclosed to anyone with no right to receive it. We may also contact you for more information regarding your request to speed up our response.

In some circumstances, Airtime may not comply with personal requests to release or delete information if they conflict with Airtime’s obligation to comply with the company’s legal obligations or to establish, exercise, or defend legal claims.

Personal Data Storage, Security and International Transfers 

Your personal data is processed and stored on secure computer systems located in the UK and European Economic Area – details of our service providers as at the date of this Privacy Policy are set out below. 

If we provide any personal data about you to any of the below suppliers, we will take appropriate measures to ensure that the recipient protects your personal data adequately under this Privacy Policy. These measures may include the following:

• Ensuring that there is an adequacy decision by the UK Government in the case of transfers out of the UK, which means that the recipient country is deemed to provide adequate protection for such personal data.
• Having in place standard model contractual arrangements with the recipient which have been approved by the UK Government, these model contractual clauses include certain safeguards to protect personal data.
• Establishing suitable physical, electronic, and operational procedures to prevent unauthorised access to or disclosure of your personal data. We protect your personal data by deploying a secure sockets layer (a security protocol) and high-standard encryption algorithms. We also ensure that we meet security standards imposed by law applicable to Airtime's operation.

Sharing Your Personal Data

We require all third parties to respect the security of your personal data and to treat it in accordance with the law.

We may also disclose and use anonymised, aggregated reporting and statistics about our applications and website to report to third parties for industry analysis (we might be paid for this) and for our marketing and promotion purposes. None of these anonymised, aggregated reports or statistics will enable our users to be personally identified.

In using the App, website, and Services, you understand that this will involve third party elements, including payment service providers, network operators and retailers. Where relevant, you will comply with such third party’s terms and policies, for example information about Mastercard’s privacy practices is available in Mastercard’s loyalty privacy notice.

• Payment Service Providers

When you register (i) a payment card or (ii) your bank account via open banking, in connection with transaction monitoring, you authorise us to collect, process and share your payment card or bank account transaction information (as applicable) with our partners, as well as Visa, MasterCard, and/ or if you sign up to Airtime Up with open banking providers and bank account providers, and whichever Airtime service you sign up to with other necessary payment service providers (in this Privacy Policy, we refer to these organisations as the Payment Service Providers). We may not be able to provide our Services to you if you do not give your consent to such use of your personal data at the time of registration, or if you revoke your consent at any time. 

You authorise the Payment Service Providers relevant to you to monitor transactions on your (i) registered card(s) or (ii) bank account(s) registered via open banking (as applicable), in each case (i) and (ii) to identify purchases in order to determine whether you have qualified for or earned an offer linked to your payment card or bank account (as applicable), and for such Payment Service Providers to share such transaction details with us to enable your card-linked offer(s) and target offers that may be of interest to you. 

You may opt-out of transaction monitoring on the payment card(s) or bank accounts registered via open banking (as applicable) you have registered at any time by removing your payment card or bank account (as applicable) from your account. You can do this via the wallet section of the App. If you do this, we will no longer be able to provide the App, services and programme.

Information about Mastercard’s privacy practices is available in Mastercard’s loyalty privacy notice.

• Other Service Providers

We may share your personal data with our service providers (including their subcontractors). This may happen when they help us run our service or the technology systems needed to operate our website, applications, and services. These are:

• Regulators, and Law Enforcement

We may also share your data with:

• Regulators, in connection with their duties
• Fraud prevention agencies and law enforcement agencies, where we’re required to help them do their job
• Mobile Network Operators

Details of approved operators can be found on the supported network page in the App, and currently includes o2, EE, Three, Vodafone and giffgaff (Mobile Network Providers).

Where you sign up for our App, programme and / or services, you agree to share your App and Account data with your Mobile Network Provider, which are Airtime's partners, to allow for the application of credit to your mobile account. 

We may also use your data to facilitate in-depth customer satisfaction analysis, including Net Promoter Score (NPS). Airtime and the Mobile Network Operators have a legitimate interest (to allow us to improve services) in ascertaining whether these customers score more highly than non-Airtime users. All data used for this purpose is anonymised and aggregated and so does not constitute personal data.

Airtime will also share the data with Mobile Network Operators for marketing purposes. This data is limited to the customer's phone number, whether a card or open banking provider account (as applicable) has been added to the account, whether a transaction has been made, the date of the last transaction, whether a redemption has been made and when, if applicable. You may opt out of this sharing arrangement at any time by contacting us at support@airtime.co.uk. 

• Other Third Parties

We may share your data with parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this Privacy Policy.

Save as expressly set out in this Privacy Policy, we will never share, sell, or rent your personal data to any third party without notifying you and, where necessary, obtaining your consent. 

Marketing

• Direct Marketing

During the registration process, when your personal data is collected, you will be asked to indicate your preferences for receiving direct marketing communications from us via email, SMS, the App or push notifications. You may also receive marketing communications from us if you have requested information from us or used our programme / services, and you have not opted out of receiving the marketing.

We may also analyse your Identity, Contact, Technical, Usage and Profile Data to form a view which products, services and offers may be of interest to you so that we can then send you relevant marketing communications.

• Opting out of marketing 

You can ask to stop sending you marketing communications at any time through the control setting within your profile page, the link in the relevant email footer or the link in the marketing SMS.

If you opt out of receiving marketing communications, you will still receive service-related communications that are essential for administrative or customer service purposes for example relating to redemption confirmations, updates to our Terms and Conditions, or checking that your contact details are correct.

Aggregated Data

We may disclose and use anonymised, aggregated reporting and statistics about our applications and website to report to third parties for industry analysis (we might be paid for this) and for our marketing and promotion purposes. None of these anonymised, aggregated reports or statistics will enable our users to be personally identified and so do not contain any personal data.

Airtime may also:

• provide information on Airtime marketing campaigns to different network providers with the results for measurement of performance;
• create aggregated market research from which all personal data is removed to other businesses in return for revenue; and
• create aggregated market research from which all personal data is removed to provide customers and potential customers with generic insights.

Again, this data will not identify individuals and so does not contain personal data.

How Long Do We Keep Your Data?

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements. This ranges from between 90 days to up to five years, depending on the nature of the data.

When you close your account, Airtime anonymise and archives all personal data, which is kept for six months to fulfil legal and regulatory requirements. Airtime will do this if there is no conflict with our legal obligations.

Complaints Process

If you are unhappy with how we process your personal data, we ask that you contact us first either by completing the form in the contact section on the App or contacting us by emailing support@airtime.co.uk so that we have the relevant details for the chance to put it right. We will respond within 30 days of your submitting your information, which may include asking for more information or informing you on the progress of our review of the complaint. However, you also have the right to make a complaint to the ICO at any time.

You have the right to make a compliant at any time to the Information Commissioner’s Office (ICO), the UK regulator for data protection issues (www.ico.org.uk).

The ICO address is as follows:

Information Commissioners Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Phone: 0303 123 1113

Links to Third Party websites

The App and website may include:

• links to third-party websites, plug-ins and applications (for example social media platforms, apparel purchasing websites etc.); or
• affiliate links to third party websites to obtain certain rewards.

Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy policy of every website you visit. Unless otherwise set out in Sharing your Personal Data, we do not share any personal data with these parties. 

Changes to Airtime’s Privacy Policy

We may update our Privacy Policy from time to time. Any changes we make to it in the future will be posted on this page and, where a material update is made, provided to you by email, via the App or in another appropriate manner. You may be required to read and acknowledge the changes to continue your use of the Airtime apps, websites, or services – continued use will constitute your acceptance of the updated policy.