Usuals is a service of [statutaire naam], registered with the Dutch Chamber of Commerce (KvK) under number [KvK-nummer], located at [straat en huisnummer], [postcode en plaats] (Usuals, we or us). This statement explains which personal data we process, why, for how long, and what your rights are. This is a translation; the Dutch version prevails.
Questions about privacy? Email privacy@joinusuals.com.
1.Who this statement is for
Usuals deals with three groups of people:
- Business owners and their staff with a Usuals account. For their data we are the controller.
- Customers of those businesses who add a card to their Wallet (end customers). For their data the business is the controller and we are the processor. We only process that data on behalf of the business, under the data processing agreement.
- Visitors of joinusuals.com.
Are you an end customer? Then the place where you collect stamps is your first point of contact. You can always come to us as well: we help you, or pass your question on to the business.
2.Which data we process
From business owners and staff:
- Name, email address and password. We only store a hash of the password, never the password itself.
- Business details: business name, addresses of your locations, logo, colours and card designs.
- Your role (owner or staff) and what you do in the dashboard, the scanner and the app, such as stamps added and messages sent.
- Subscription and payments: your plan, your invoices, and the customer and mandate details Mollie returns to us, such as the account holder's name and the last digits of your IBAN. Mollie processes the full payment details, we don't.
- Technical data: IP address, browser and device, login sessions and, if you use the Usuals app, a push token for notifications.
- What you write to us when you get in touch.
From end customers, on behalf of the business:
- First name.
- Email address and birthday (day and month), only if the customer fills them in.
- Language, and whether the customer wants to receive messages, with the time of that consent.
- Loyalty data: stamps or points, rewards, the time of each visit, the location and the staff member who added the stamp.
- Wallet data: the card's serial number, for Apple Wallet a device ID and push token, for Google Wallet an object ID.
- An encrypted device key, to recognise double sign ups on one device.
- The messages sent to the card.
A nearby message is shown by the phone itself, based on the locations on the card. We do not receive or store the phone's location.
From website visitors we only process technical data in server logs (IP address, browser, page requested), to keep the site secure and available. This site uses no analytics and no advertising cookies.
3.Why we process data and on what legal basis
| Purpose | Legal basis |
|---|---|
| Creating your account and providing the service: cards, scanner, messages, reports and the app | Performance of the contract (Art. 6(1)(b) GDPR) |
| Subscriptions, payments and invoices | Performance of the contract and legal obligation, such as the tax retention duty (Art. 6(1)(b) and (c) GDPR) |
| Service emails, such as a password reset link, an invoice or a notice about a failed payment | Performance of the contract (Art. 6(1)(b) GDPR) |
| Security, preventing abuse and finding errors, with log files and limits on sign up, login and scanning | Legitimate interest: a secure and reliable service (Art. 6(1)(f) GDPR) |
| Support, including when we look into your account at your request | Performance of the contract and legitimate interest (Art. 6(1)(b) and (f) GDPR) |
| The AI assistant on the paid plans | Performance of the contract (Art. 6(1)(b) GDPR); for end customer data on behalf of the business |
| News about Usuals by email | Consent (Art. 6(1)(a) GDPR); unsubscribe at the bottom of every email |
For end customer data the business decides the purpose: offering a loyalty card and, with the customer's consent, sending messages. We never use that data for our own purposes, never sell it and never contact end customers ourselves.
4.How long we keep data
- Account data: as long as your account exists. After you cancel or delete it, we erase it within 30 days.
- Invoices and payment records: 7 years, because of the tax retention duty.
- The log of actions in your account: as long as your account exists.
- End customer data: as long as the business offers the card, until the customer or the business deletes it. When a customer deletes their card through the link on the card, we erase the data right away. When the business stops using Usuals, we erase the customer data within 30 days.
- Server log files: up to 90 days, unless we need them to investigate abuse.
- Backups: these are overwritten after 35 days at most.
6.Data outside the EU
Our database and files are stored in the EU. A few providers, such as Resend, Apple, Google, Anthropic and Expo, are US companies or have a US parent company. Because of that, data may also be processed in the United States. That only happens with appropriate safeguards: the EU-US Data Privacy Framework for certified companies, or the European Commission's standard contractual clauses, with additional measures where needed.
7.How we secure data
- All connections are encrypted (TLS).
- We only store passwords as a hash.
- The QR code on a card holds a signed code, never a customer number.
- Access is per business and per role. Staff only see what belongs to their own business.
- Limits on sign up, login and scanning keep abuse out.
- Important actions are recorded in a log, including when our support team looks into your account at your request.
- We make backups and keep our software up to date.
Notice something that isn't right? Report it to privacy@joinusuals.com.
8.Your rights
You have the right to access your data, have it corrected or deleted, restrict its processing, object to processing based on legitimate interest, and receive your data in a common format. If you gave consent, you can always withdraw it.
As a business owner you handle much of this yourself in your dashboard: change your details, export your customers and delete your account. As an end customer you see and delete your data through the link on the back of your card.
Doesn't that work? Email us at privacy@joinusuals.com. We respond within a month. To make sure nobody else requests your data, we may ask you to confirm who you are.
9.Making a complaint
Please tell us if you are unhappy about something, so we can put it right. You also have the right to lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.
11.Automated decisions
We make no decisions with legal effects based solely on automated processing. The AI assistant makes suggestions; the business decides. The business uses customer groups such as active or at risk to choose who gets a message. No legal effects are attached to that.
12.Young people
Are you under 16? Then ask your parent or guardian for permission before you create a card or turn on messages.
13.Changes
We update this statement when our service or the law changes. We tell business owners about important changes by email in advance. The date at the top shows when the statement was last updated.