Privacy policy

Who is responsible

WeFid is run by WeFid [to be completed before launch], address [to be completed before launch], company number [to be completed before launch]. For any question about your data, write to [to be completed before launch].

What WeFid keeps about customers

When you create an account, you give:

• your first and last name;
• your email address and a password (the password is stored only in a scrambled form that nobody can read, not even us);
• your date of birth, your gender (you may answer “Prefer not to say”) and your postal code;
• your phone number, if you choose to give it;
• whether you agreed to receive offers and news.

While you use WeFid, it also keeps:

• the loyalty cards you joined and when;
• the stamps and points you received, the rewards you earned and used, and when;
• for points cards, the amount of the purchase the business typed in;
• a personal QR code, which contains a random code and none of your details;
• the language you last used on the website, so emails WeFid sends you are written in it.

What WeFid keeps about businesses

A business account holds the business name, an email address and password, and what the business adds itself: logo, category, website, phone number, address, and its loyalty programs.

Businesses on WeFid’s premium plan that have a running loyalty program are shown to all WeFid customers on the Partners page, with their name, logo, website, town and position on the map (worked out from their address), so customers can find the ones near them. A business can switch this off in the app.

To place a business on the map, WeFid sends its address (never anything about a person) to the OpenStreetMap service Nominatim when the address is saved.

Why WeFid keeps it

• To run your account and your loyalty cards: this is needed to provide the service you signed up for.
• To check that you are at least 16.
• To show each business anonymous statistics about its customers as a group (age groups, gender, postal codes): this is in the legitimate interest of the businesses and of WeFid, and is done in a way that does not single you out (see below).
• To give you a status at each business (Gold, Silver, Bronze) from how often you visit it, and to tell that business which regular customers have stopped coming: this is part of the loyalty service, in the legitimate interest of the businesses. It only uses your visits to that business, never your personal details, and has no effect beyond that business’s loyalty program.
• To email you the special offers of the businesses whose cards you hold (for example −30 % for a few days), only if you agreed to receive offers: at sign-up, or later under “Offers by email and in Google Wallet” on the Account page, where you can also stop them. Each email says how to stop them. If you added your card to Google Wallet, the offer is also put on it, with a notification. The business never gets your email address: WeFid sends the email for it.
• If you agreed to receive offers: to send you the emails that a business where you hold a card writes to its customers (for example a new dish or a closed day), at most a few a month. WeFid sends them for the business, which never gets your email address; you stop them the same way.
• If a business where you hold a card gives birthday gifts: to give you its gift around your birthday (from 3 days before to 7 days after), using your date of birth, and to email you about it (and put it on your Google Wallet card, with a notification) if you agreed to receive offers. The business never sees your date of birth; when it scans your code during that period, it sees that a birthday gift is waiting for you.
• To keep the service secure and prevent abuse.

What a business can see about you

A business only sees customers who joined one of its own programs, and only what happens at that business:

• your first and last name;
• your card at that business, your stamps or points, your rewards, and the dates of your visits;
• your status there, worked out from those visits by rules the business chooses (how many visits in how many days): Gold, Silver or Bronze, or “dormant” when a regular customer has not come for a while. You see your own status on your card, except “dormant”;
• the purchase amounts it entered itself.

A business never sees your email address, phone number, date of birth, gender or postal code, and never sees your cards or visits at other businesses. (If it gives birthday gifts, a scan during your birthday period shows that a gift is waiting for you, nothing more.)

Statistics about age, gender and postal code are only shown for groups of at least 5 customers. Smaller groups are merged, so a number never points to one person.

A business can download its statistics, and a list of its customers without names or contact details (for each: status, cards, number of visits, last visit, when they joined, rewards waiting), for example to open them in a spreadsheet or to ask an AI tool for advice. It is then responsible for what it does with them. WeFid never puts your name, email, phone number, date of birth, gender or postal code in these files.

Who else receives data

WeFid does not sell your data and does not share it with advertisers.

On the Partners page you can sort businesses by distance. If you allow it, your browser gives your position to the page, which works the distances out on your phone: your position is never sent to WeFid or stored. If you don’t, distances are measured from the centre of your postal code; to find that centre, WeFid sends only the postal code, nothing else about you, to the OpenStreetMap service Nominatim, once per postal code.

If you choose “Add to Google Wallet”, your name and your personal QR code are sent to Google so that the card can be kept in your Google Wallet. This only happens when you tap that button; Google then handles the card under its own terms.

Once you have added it, WeFid can put short messages on that card, which your phone shows as notifications: when you earn a reward at a business on WeFid’s Premium plan (a few minutes later, once the business can no longer take the entry back), and, if you agreed to receive offers, a special offer or a birthday gift from a business where you hold a card. A message says which business and what the reward or offer is, nothing else about you; Google delivers it. To stop them, turn off the card’s notifications in Google Wallet or remove the card.

WeFid uses service providers to host the service and to send emails such as password resets. They only act on WeFid’s instructions. The list of providers and where they store data: [to be completed before launch].

How long WeFid keeps it

WeFid keeps your data for as long as you have an account. You can delete your account yourself on the Account page of the website (customers). It is closed at once: you are logged out and your QR code stops working. If you log in again within 15 days, it is kept as it was; otherwise, after 15 days, your name, email address, date of birth, gender, postal code, phone number and QR code are erased for good. The record of stamps, points and rewards stays, without anything that identifies you, so businesses keep correct totals; you no longer appear in their list of customers.

A business can delete its account itself in the WeFid app, in the same way: it is closed at once (no new customers can join, and it leaves the Partners page) and erased after 15 days unless it logs in again. Its name, logo and contact details are then erased and its loyalty programs closed. Its customers receive an email saying so; their cards and unused rewards at that business disappear, and their history keeps those visits under “Deleted business”.

Cookies

WeFid uses one cookie, to keep you logged in. It is required for the service to work. WeFid uses no advertising or tracking cookies.

Your rights

You can ask to see your data, to correct it, to delete it, to receive a copy of it, or object to how it is used. You can withdraw your agreement to receive offers at any time, yourself, under “Offers by email and in Google Wallet” on the Account page. For anything else, write to [to be completed before launch]; we answer within one month.

If you are not satisfied with the answer, you can complain to the Belgian Data Protection Authority (www.dataprotectionauthority.be).

Changes

If this policy changes in a way that matters to you, WeFid will tell you before the change applies.