Privacy Policy
Last updated: October 2026
1. Introduction
PerkBase ("we", "us") is a loyalty and marketing platform for local businesses. This Privacy Policy explains how we collect, use, and protect personal data in accordance with the UK GDPR and the Data Protection Act 2018.
2. Data Controller and Processor
PerkBase acts as a data controller for the personal data of our business users (merchants). For the customer data that merchants upload to the platform, the merchant is the data controller and PerkBase acts as a data processor on their behalf.
3. Data We Collect
Merchant data: name, email address, business name, business details, and payment information (processed by Stripe).
Customer data (uploaded by merchants): customer name, email, phone number, date of birth, and visit history. This data is provided by the merchant with the customer's consent.
Usage data: we may collect anonymised analytics about how the platform is used to improve our services.
4. How We Use Your Data
We use merchant data to provide and manage the Service, process payments, send service-related communications, and provide customer support. We use customer data solely to provide the loyalty and marketing features requested by the merchant.
5. Legal Basis
We process personal data based on: (a) the performance of a contract (providing the Service), (b) compliance with legal obligations, and (c) our legitimate interests in operating and improving the platform.
6. Data Sharing
We do not sell personal data. We share data with the following categories of processors:
- Stripe — payment processing
- Resend — email delivery
- Cloud infrastructure providers — hosting and data storage
We may disclose data if required by law or to protect our legal rights.
7. Data Retention
We retain merchant data for as long as the account is active. Customer data is retained for as long as the merchant's subscription is active. Upon account cancellation, data is deleted within 30 days, except where retention is required by law.
8. Your Rights
Under UK GDPR, you have the right to:
- Access your personal data
- Rectify inaccurate data
- Erasure of your personal data ("right to be forgotten")
- Restrict or object to processing
- Data portability
- Withdraw consent at any time
To exercise these rights, please contact our support team.
9. Security
We implement appropriate technical and organisational measures to protect personal data, including encryption in transit and at rest, access controls, and regular security reviews. However, no method of transmission over the internet is 100% secure.
10. International Transfers
Your data may be processed by our infrastructure providers outside the UK. We ensure appropriate safeguards are in place, such as Standard Contractual Clauses, for any international transfers.
11. Children's Privacy
The Service is not directed to children under 16, and we do not knowingly collect personal data from children. Merchants are responsible for ensuring their customers have given appropriate consent for any data uploaded.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through the platform.
13. Contact
If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact our support team.