Punchh Privacy Policy

Punchh (“Punchh,” “us,” “we,” or “our”) offers a variety of services on behalf of our business Partners (our “Partners”). We provide many of our services to you and other patrons of our Partners (“Users,” “you,” or “your”) through the Punchh website and through mobile, point of sale, and online applications provided by and on behalf of Punchh and our Partners (collectively, our “Platform”). By patronizing the businesses of our Partners, you access and use these services through our Platform.

We are committed to protecting the privacy of the users of our Platform. Punchh has prepared this Privacy Policy to describe to Users our practices regarding the collection, use, and sharing of personal information through our Platform.

This Privacy Policy is limited only to information collected through the Platform and does not cover any information collected outside of the Platform, such as the information collected by Partners. You may contact any of our Partners for a copy of their own privacy policy applicable to the information they collect directly from you.

Punchh reserves the right to, at any time, modify this Privacy Policy. If we make revisions that change the way we collect, use, or share personal information, we will post those changes in this Privacy Policy. Please review this Privacy Policy periodically to keep up to date on our most current policies and practices. We note the effective date of the latest version of our Privacy Policy at the end of this Privacy Policy.

You can jump to specific sections of this Privacy Policy by clicking the links below:

  1. Collection of Personal Information
  2. Use of Personal Information
  3. Sharing of Personal Information
  4. Access and Choice
  5. Children
  6. Security
  7. Complaints
  8. Miscellaneous
  9. Data Protection Officer, Communications, and Requests
  10. Compliance with Privacy Shield
  11. Independent Resource Mechanism

1. Collection of Personal Information

Personal information refers to information connected to Users that may be used to identify them.

Punchh collects personal information when Users voluntarily submit it to us or when Partners submit User information on their behalf. For example, we may collect or receive information from a Partner about a User when the User creates an account on our Platform, edits their profile on our Platform, uses or accesses services or content through our Platform, or otherwise interacts with us, our Partners, or other Users of the Platform. Many methods Punchh uses to collect personal information require User opt-in.

In addition to personal information that we may receive from Users or Partners, Punchh may collect other personal information about Users in the following ways:

  • Cookies. “Cookies” are small bits of information that the Platform may place on the hard drive of a computer. Cookies remember information about activities on the Platform to make future User visits to the Platform more enjoyable and valuable by customizing experiences and recognizing User preferences when they visit a Platform. If a User has chosen to disable cookies on their browser, some of the functionality of the Platform may be lost. Users can opt-out of receiving some advertising and tracking devices based upon their browsing behavior by going to the Networking Advertising Initiative and Digital Advertising Alliance websites.
  • Web Server Logs. Web server logs are records of activity created by the computer that delivers the webpages the User requests to their browser. For example, a web server log may record an entered search term or a clicked link. The web server log also may record information about User browsers, such as IP address and the cookies set on the browser by the server.
  • Device Information. We may collect information about the mobile device or computer used to access the Platform, including, without limitation, the hardware model, operating system and version, browser type, unique device identifiers, and mobile network information.
  • Social Networking Sites. If Users log into their account through other third party services not operated by Punchh or our Partners (e.g., Facebook Connect), Users give Punchh permission to access certain information about them from that social networking site, such as Facebook User ID, user profile, friends list, and profile picture.
  • Geolocation. Using the location tracking feature in a User mobile device or associated with a User’s access to the Platform may note a User’s location in order to pair the user with appropriate Partner information.

Punchh retains your personal information for as long as necessary for the purpose that it was collected, unless a different amount of time is required or allowed by law.

2. Use of Personal Information

Punchh’s primary purpose in collecting personal information is to provide Users with content and services that Users request through the Platform or that match User interests.

Punchh may also use personal information for various other purposes, including without limitation to:

  • Help diagnose problems with the Platform, to improve the Platform, to administer the Platform, and to enhance the Platform for optimal User experience.
  • Identify you when you use the Platform or visit a Partner.
  • Monitor the usage and performance of the Platform, and to determine aggregate information about our Users and usage patterns.
  • Customize content and services that may be of interest to our Users.
  • Facilitate transactions and process payments.
  • Send Users materials, updates, and product information regarding the Platform or Partner services.
  • Contact Users for information verification purposes or to fulfill User requests, including employment inquiries.
  • Contact Users (or to facilitate Partner’s contact of Users) for marketing purposes.

Our collection and use of your information is based, in different contexts, upon your consent, our need to perform a contract, our obligations under law, and our legitimate interest in conducting our business.

3. Sharing of Personal Information

Except as explained herein, we do not sell, rent, share, trade or give away personal information. In accordance with Privacy Shield, we take responsibility for the processing of personal information that we transfer to third parties acting as an agent on our behalf.

Partners. We share User personal information with our Partners. In doing so, we require that our Partners use the User personal information they receive from us subject to the terms of this Privacy Policy. Please understand, however, that our Partners may also obtain User personal information directly from Users (e.g., when those Users patronize their restaurants, visit their websites, use their mobile apps, etc.). Any information collected directly by our Partners is not subject to this Privacy Policy. You may contact any of our Partners for a copy of their own privacy policy applicable to the information they collect directly from you.

Marketing. We do not share User information with third parties to directly market to Users, but Partners may market to Users using our Platform. We may market to Users on behalf of our Partners or other third parties that would like to send Users information about their products and services. For example, Punchh may offer a promotion in conjunction with a cosponsor that may have special offers or services that might be of interest to Users.

Within the Platform. Except where a User might choose to include a full name in his or her profile, a User’s email address and full name will only be used in the following circumstances:

  • When the User invites a friend via email to become a Platform User,
  • When the User sends a request to another User to add the other User to his or her friend list, or
  • When we send notifications to the User relating to their use of the Platform.

Service Providers. Punchh may share User personal information with service providers that perform services for Punchh, such as providing hosting services, marketing assistance, analyzing User data, and processing payment card information.

Sharing Without Your Consent. There may also be instances when Punchh may disclose User personal information without providing Users with a choice in order to protect the legal rights of Punchh, other affiliated companies or their employees, agents, and contractors; to honor a request that Users have made through the Platform; to protect the safety and security of other Users; to protect against fraud or for risk management purposes; in response to a request by public authorities including in national security or law enforcement scenarios, or to comply with the law.

Sharing With Your Consent. We may also ask for your consent to share your personal information in other ways.

Affiliates and Acquisitions. If Punchh sells all or part of its business or makes a sale or transfer of assets or is otherwise involved in a merger or business transfer, Punchh may transfer User personal information to a third party as part of that transaction.

Social Networking. The Platform may offer Users the ability to share personal information through a social networking site (e.g., Facebook, Twitter, LinkedIn), using such site’s integrated tools (e.g., Facebook “Like” button, or Twitter “Tweet” button). The use of such integrated tools enables Users to share personal information about themselves with other individuals or the public. For more information about the purpose and scope of data collection and use in connection with such social networking site or a site’s integrated tools, please visit the privacy policies of these social networking sites.

4. Access & Choice

Users can access, modify, and delete some types of personal information through their Platform account by contacting Punchh using the contact information in the “Data Protection Officer, Communications, and Requests” section below. You may also contact Punchh to make a request regarding your personal information, such as asking Punchh to:

  • Delete your personal information;
  • Modify or change your personal information;
  • Access your personal information; or
  • Object or revoke your consent to our processing of your personal information.

Please note that although Punchh takes all requests seriously, depending on applicable law and Punchh’s legal rights, we may not be able to grant your request. Additionally, some of your personal information may be controlled by our Partners. If your request relates to personal information controlled by our Partners, we will direct you to communicate with that Partner directly. Finally, in limited cases, under applicable law Punchh is allowed to charge for certain requests.

Promotional Emails. Users who no longer wish to receive our weekly email updates or other email notifications may opt-out of receiving these communications by following the instructions contained in the applicable email or by logging-in and changing their settings in the account settings.

Do-Not-Track. Some web browsers and devices permit Users to broadcast a preference that they not be “tracked” online. At this time Punchh does not modify User experience based upon whether such a signal is broadcast.

5. Children

The Platform is not meant for or targeted to children and should not be used by children under 13.

6. Security

Punchh employs reasonable and appropriate security measures to protect personal information. While there is no such thing as “perfect security” on the Internet, we will take reasonable steps to ensure the safety of personal information. Please keep your password and account information secure, and notify us of unauthorized use of your account.

7. Complaints

User privacy is important to us and we encourage you to submit all questions and complaints to Punchh using the information in the “Data Protection Officer, Communications, and Requests” section below. However, you may also have the right to complain to a government or regulatory body about our privacy practices.

8. Miscellaneous

  • Transfers of Your Personal Information to Other Countries. Personal information may be processed in a foreign country where privacy laws may be less stringent than the laws in your country. By submitting your personal information to us you agree to the transfer, storage and processing of your information in a country other than your country of residence including, but not necessarily limited to, the United States.
  • Other Websites. This Privacy Policy does not apply to websites or applications offered by other third party companies or individuals, including third party products and services, that may be displayed as on the Platform. Punchh encourages you to read the privacy policy of any third party website or applications before transmitting information to such third party.
  • Separate Agreements. If you enter into a separate contractual relationship with Punchh which requires, or contemplates, collecting, using, or sharing information in a manner that is different than that which is described in this Privacy Policy, the terms of that agreement will apply.
  • Your California Privacy Rights. Under California Civil Code sections 1798.83-1798.84, California residents are entitled to ask us for a notice describing what categories of personal information Punchh shares with third parties or corporate affiliates for those third parties or corporate affiliates’ direct marketing purposes. That notice will identify the categories of personal information shared and will include a list of the third parties and affiliates with which it was shared, along with their names and addresses. If You are a California resident and would like a copy of this notice, please submit a written request to us at the address listed below.

9. Data Protection Officer, Communications, and Requests

Our contact information for privacy-related communications is our data protection officer, who can be reached at:


1875 S Grant St #810
San Mateo, CA 94402
United States

815 Brazos St.,
Suite 410, Austin,
TX 78701, United States

If you have questions or concerns about our Privacy Policy or any other privacy or security issue, please contact us. In certain cases, your personal information may be controlled by one of our Partners. In those scenarios we will direct you to communicate with that Partner directly.

If Punchh needs to communicate with you regarding your personal information, we may do so using any method practicable, including electronically, through the platform, through postal mail, or by telephone.

10. Compliance with Privacy Shield

Punchh complies with the EU-U.S. Privacy Shield Framework as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal information transferred from the European Union and the United Kingdom to the United States. Punchh is subject to the investigatory and enforcement powers of the Federal Trade Commission (“FTC”). Punchh has certified to the Department of Commerce that it adheres to the Privacy Shield Principles. If there is any conflict between the terms in this privacy policy and the Privacy Shield Principles, the Privacy Shield Principles shall govern. Punchh will remain liable for the transfer of data covered by the Privacy Shield program to third parties. To learn more about the Privacy Shield program, and to view our certification, please visit https://www.privacyshield.gov/

11. Independent Resource Mechanism

In compliance with the Privacy Shield Principles, Punchh commits to resolve complaints about its collection or use of your personal information. EU individuals with inquiries or complaints regarding our Privacy Shield policy should first contact Punchh at:

1875 S Grant St #810
San Mateo, CA 94402
United States
650 781 7100

Punchh has further committed to refer unresolved Privacy Shield complaints to PrivacyTrust, an alternative dispute resolution provider located in the United Kingdom. If you do not receive timely acknowledgment of your complaint from us, or if we have not addressed your complaint to your satisfaction, please contact or visit https://www.privacytrust.com/drs/punchh for more information or to file a complaint. In certain scenarios, you may be able to invoke binding arbitration against Punchh for privacy shield complaints. The services of PrivacyTrust are provided at no cost to you.

Effective as of July 2, 2018

Privacy Trust Certification