Punchh (“Punchh,” “us,” “we,” or “our”) offers a variety of services on behalf of our business Partners (our “Partners”). We provide many of our services to you and other patrons of our Partners (“Users,” “you,” or “your”) through the Punchh website and through mobile, point of sale, and online applications provided by and on behalf of Punchh and our Partners (collectively, our “Platform”). By patronizing the businesses of our Partners, you access and use these services through our Platform.
Personal information refers to information connected to Users that may be used to identify them.
Personal information refers to information connected to Users that may be used to either directly or indirectly identify them.
Punchh may collect personal information about Users in the following ways:
Punchh may collect personal information about other third parties, including our Partners, in the following ways:
Punchh retains your personal information for as long as necessary for the purpose that it was collected, unless a different amount of time is required or allowed by law. If we have collected your information on behalf of a Partner, the Partner determines how long we keep your personal information.
Punchh’s primary purpose in collecting personal information is to provide our Partner’s with the services they have contracted with Punchh for, such as providing Users with services, loyalty programs, and rewards programs that Users request through the Platform or that match User interests.
In addition to the uses stated above, Punchh may use personal information for various other purposes, including without limitation to:
Our collection and use of your information is based, in different contexts, upon your consent, our need to perform a contract, our obligations under law, and our legitimate interest in conducting our business. When we collect information on behalf of our Partners, our Partners determine the basis for that collection and processing.
In accordance with Privacy Shield, we take responsibility for the processing of personal information that we transfer to third parties acting as an agent on our behalf.
Marketing. We do not share User information with third parties to directly market to Users, but Partners may market to Users using our Platform. We may market to Users on behalf of our Partners or other third parties that would like to send Users information about their products and services. For example, Punchh may offer a promotion in conjunction with a cosponsor that may have special offers or services that might be of interest to Users.
Within the Platform. Users may have the ability to share information within the Platform, either with other Users or with individuals who are not yet Users. For example, information may be shared within the Platform in the following circumstances:
Service Providers. Punchh may share User personal information with service providers that perform services for Punchh, such as providing hosting services, marketing assistance, analyzing User data, and processing payment card information.
Sharing Without Your Consent. There may also be instances when Punchh may disclose User personal information without providing Users with a choice. This may happen if we need to protect the legal rights of Punchh, other affiliated companies or their employees, agents, and contractors; honor a request that Users have made through the Platform; protect the safety and security of other Users; protect against fraud or for risk management purposes; if required to do so by court order, subpoena, or warrant; or to comply with the law or national security requirements.
Sharing With Your Consent. We may also ask for your consent to share your personal information in other ways.
Affiliates and Acquisitions. If Punchh sells all or part of its business or makes a sale or transfer of assets or is otherwise involved in a merger or business transfer, Punchh may transfer User personal information to a third party as part of that transaction.
Social Networking. The Platform may offer Users the ability to share personal information through a social networking site (e.g., Facebook, Twitter, LinkedIn), using such site’s integrated tools (e.g., Facebook “Like” button, or Twitter “Tweet” button). The use of such integrated tools enables Users to share personal information about themselves with other individuals or the public. For more information about the purpose and scope of data collection and use in connection with such social networking site or a site’s integrated tools, please visit the privacy policies of these social networking sites.
Users can access, modify, and delete some types of personal information through their Platform account or by contacting Punchh using the contact information in the “Data Protection Officer, Communications, and Requests” section below. If we have collected your information on behalf of one of our Partners, we will direct your request to our Partner for fulfillment. We recommend that Users reach out directly to the Partner rather than to Punchh.
You may also contact Punchh to make a request regarding your personal information, such as asking Punchh to:
As required by law, we will require you to prove your identity. We verify identity by comparing the information you provide when submitting your request with the information in our database. Depending on your request, we may ask for additional information such as the email address you used to place an order. We may also ask you to provide a signed declaration confirming your identity.
In some circumstances, you may designate an authorized agent to submit requests to exercise certain privacy rights on your behalf. We will require verification that you provided the authorized agent permission to make a request on your behalf. You must provide us with a copy of the signed permission you have given to the authorized agent to submit the request on your behalf and verify your own identity directly with us. If you are an authorized agent submitting a request on behalf of an individual you must attach a copy of the following information to the request:
If we do not receive both pieces of information, the request will be denied.
Please note that although Punchh takes all requests seriously, depending on applicable law and Punchh’s legal rights, we may not be able to grant your request. Additionally, some of your personal information may be controlled by our Partners. If your request relates to personal information controlled by our Partners, we will direct you to communicate with that Partner directly. Finally, in limited cases, under applicable law Punchh is allowed to charge for certain requests.
Promotional Emails. Users who no longer wish to receive our weekly email updates or other email notifications may opt-out of receiving these communications by following the instructions contained in the applicable email or by logging-in and changing their settings in the account settings.
Do-Not-Track. Some web browsers and devices permit Users to broadcast a preference that they not be “tracked” online. At this time Punchh does not modify User experience based upon whether such a signal is broadcast.
The Platform is not meant for or targeted to children and should not be used by children under 13.
Punchh employs reasonable and appropriate security measures to protect personal information. While there is no such thing as “perfect security” on the Internet, we will take reasonable steps to ensure the safety of personal information. Please keep your password and account information secure, and notify us of unauthorized use of your account.
In the event that we are required by law to inform you of a breach to your personal information we may notify you electronically, in writing, or by telephone, if permitted to do so by law.
User privacy is important to us and we encourage you to submit all questions and complaints to Punchh using the information in the “Data Protection Officer, Communications, and Requests” section below. However, you may also have the right to complain to a government or regulatory body about our privacy practices.
Our contact information for privacy-related communications is our data protection officer, who can be reached at:
1. PUNCHH, INC.
1875 S Grant St #810
San Mateo, CA 94402
2. PUNCHH, INC.
815 Brazos St.,
Suite 410, Austin,
TX 78701, United States
If Punchh needs to communicate with you regarding your personal information, we may do so using any method practicable, including electronically, through the platform, through postal mail, or by telephone.
We commit to subject to the Principles all of the personal data received from the EU, and the United Kingdom, respectively, in reliance on the Privacy Shield. In the context of an onward transfer, Punchh has responsibility for the processing of personal information it receives under the Privacy Shield and subsequently transfers to a third party acting as an agent on its behalf. Punchh shall remain liable under the Principles if its agent processes such personal information in a manner inconsistent with the Principles if we are responsible for the event giving rise to the damage.
The Federal Trade Commission has jurisdiction over Punchh’s compliance with the Privacy Shield.
In compliance with the Privacy Shield Principles, Punchh commits to resolve complaints about its collection or use of your personal information. EU individuals with inquiries or complaints regarding our Privacy Shield policy should first contact Punchh at:
1875 S Grant St #810
San Mateo, CA 94402
650 781 7100
Punchh has further committed to refer unresolved Privacy Shield complaints to PrivacyTrust, an alternative dispute resolution provider located in the United Kingdom. If you do not receive timely acknowledgment of your complaint from us, or if we have not addressed your complaint to your satisfaction, please contact or visit https://www.privacytrust.com/drs/punchh for more information or to file a complaint. In certain scenarios, you may be able to invoke binding arbitration against Punchh for privacy shield complaints. The services of PrivacyTrust are provided at no cost to you.
An individual has the possibility, under certain conditions, to invoke binding arbitration for complaints regarding Privacy Shield compliance not resolved by any of the other Privacy Shield mechanisms. For additional information, please visit: https://www.privacyshield.gov/article?id=ANNEX-I-introduction
For information for California residents, go here.