1. Who we are

[Legal entity name, e.g. Cherrytag Limited] ("Cherrytag", "we", "us") operates the Cherrytag loyalty rewards platform ("Cherrytag" or the "App"), a spend-based loyalty programme for cafés and restaurants in the NZ, available at cherrytag.org and in-store as paper coupons.

NZBN: [NZBN] · Registered address: [registered address]

2. Who this policy covers

This policy applies to everyone who uses Cherrytag, including:

• Shoppers ("Members") who sign up to earn and redeem reward points; and
• Business owners ("Subscribers") who subscribe their café, restaurant or business to the Cherrytag network.

It should be read alongside our Rewards Terms & Conditions and, for participating businesses, our Business Subscriber Terms & Conditions.

3. What personal information we collect

3.1 If you're a Member (shopper)

• Your email address and a PIN (stored securely — see section 7);
• A unique member ID we generate for your account;
• Your points balance and transaction history (which participating business, date, amount spent, points earned or redeemed, coupon codes issued or cancelled). Your current points balance and visit count are retained for as long as your account is active; itemised transaction-level detail (e.g. which business, date, amount spent) is kept online for the past one (1) month only, with older detail summarised into your running balance and visit count;
• Your device's approximate location, but only if you allow it, used to centre the map on nearby participating businesses;
• Basic technical information such as browser type and device information, collected automatically when you use the app.

3.2 If you're a business Subscriber

• Contact details: first name, last name, email address, mobile number;
• Business details: business name, business address, a pin location for the map, an optional business photo, and any advertisement text you choose to publish;
• Billing details: for card payments these are collected and processed directly by our payment processor, Credit/Debit card payments — we do not see or store your full card number. For bank transfers, we ask you to upload proof of payment (a receipt), and we record the transaction reference and amount and uploaded proof of payment is deleted once bank transfer payment is validated;
• If you request a refund: your bank account number, bank name and account holder name, and a mobile number, so we can process the refund correctly and verify the request.

3.3 From everyone

We keep records of correspondence if you contact us for support, and log activity within the app (such as sign-ins) for security and fraud-prevention purposes.

4. How we collect it

• Directly from you — when you sign up, submit a business listing, make a payment, request a refund, or scan/present a QR code;
• Automatically — through your browser (e.g. session storage that keeps you signed in) and, only with your permission, your device's location services;
• From a participating business — when a business scans your reward QR code or coupon to record a visit or a redemption.

5. Why we collect and use it

We use personal information to:

• Create and manage your Member or Subscriber account and verify it's really you (e.g. by PIN or emailed reset link);
• Operate the loyalty programme — calculate points earned, track visits, issue and validate reward coupons, and process redemptions across the Cherrytag network;
• Process subscription payments, top-ups and refunds;
• Show participating businesses on the map, including any business photo and advertisement message a Subscriber chooses to publish;
• Send transactional emails, such as sign-up confirmations, PIN reset links, redemption confirmations and payment receipts;
• Keep basic administration records for our own accounting, tax and business purposes;
• Detect, investigate and prevent fraud or misuse of the programme (for example, duplicate accounts or coupon abuse);
• Meet our legal and tax obligations in New Zealand.

We do not use your information to make automated decisions that have a legal or similarly significant effect on you.

6. Who we share it with

We keep sharing to the minimum needed to run the programme:

• Participating businesses — when you present your QR code or a coupon, the business you're visiting can see enough information to record your visit and process a redemption (such as your member ID and points balance). Businesses do not receive your email address, PIN, or your activity at other businesses, beyond what the shared network points ledger requires to validate a redemption;
• Service providers who help us run Cherrytag, currently including our payment processor (Stripe or similar), our hosting/infrastructure provider, and our transactional email provider. These providers only receive what they need to do their job and are not permitted to use your information for their own marketing;
• Legal or regulatory bodies — if required by law, for example under a court order, or to protect the rights, property or safety of Cherrytag, our Subscribers or our Members;
• A new owner of the Cherrytag business, if it is sold or restructured, subject to that party agreeing to protect your information in line with this policy.

We do not sell your personal information, and we do not share it with third parties for their own direct marketing.

7. Storage, security and overseas disclosure

We use reasonable technical and organisational measures to protect your information, including encrypting data in transit, storing PINs in a hashed (non-reversible) form rather than as plain text, and restricting staff access to what's needed to provide the service.

Some of our service providers (for example, our hosting and payment providers) store or process data on servers located outside New Zealand. Where this happens, we take reasonable steps to make sure your information is protected to a standard comparable to the Privacy Act 2020, as required by Information Privacy Principle 12.

No online service can guarantee perfect security. If you become aware of any misuse of your account or a security concern, please contact us immediately using the details in section 14.

If a privacy breach occurs that we reasonably believe has caused, or is likely to cause, serious harm, we will notify the Office of the Privacy Commissioner and any affected individuals as required under Part 6 of the Privacy Act 2020.

8. How long we keep it

We keep personal information only for as long as it's needed for the purposes described in this policy, including to meet our legal, accounting and tax obligations (financial records are generally kept for at least 7 years, as required under New Zealand tax law). If you close your account, we will delete or anonymise your personal information within a reasonable period, except where we are required or entitled to keep it for legal, dispute-resolution or fraud-prevention purposes.

9. Cookies, location and device data

Cherrytag uses your browser's local storage to keep you signed in between visits — this stays on your own device and is not a tracking cookie shared with third parties. We use your device's location, only with your explicit permission, to show nearby participating businesses on the map, or to help a business owner set their map pin. You can decline location access; the map will simply default to a general map view.

10. Your privacy rights

Under the Privacy Act 2020, you have the right to:

• Ask us to confirm what personal information we hold about you and to access a copy of it;
• Ask us to correct any information that is wrong, out of date or incomplete;
• Ask us to delete your account and associated personal information, subject to the retention needs described in section 8.

To make a request, contact us using the details in section 14. We'll respond within the timeframes required by law (usually within 20 working days) and will let you know if we can't action a request and why.

11. Children

Cherrytag is intended for people aged 16 and over. If you believe a child has provided us with personal information without appropriate consent, please contact us and we will take reasonable steps to delete it.

12. Changes to this policy

We may update this policy from time to time, for example if we change how the platform works or to reflect new legal requirements. We'll post the updated version here with a new "last updated" date, and where a change is significant, we'll take reasonable steps to let you know (such as an in-app notice or email).

13. Complaints

If you're unhappy with how we've handled your personal information, please contact us first using the details below so we can try to resolve it. If you're not satisfied with our response, you can complain to the New Zealand Office of the Privacy Commissioner:

Website: www.privacy.org.nz · Phone: 0800 803 909

14. Contact us

For any privacy question, access request or complaint, contact us at:

Email: [[email protected]]