Privacy Policy
Last updated: 26 September 2026
KARDZA is operated by Bratim BV, located at Koensborre 92, Bus 101, 1730 Asse, Belgium. VAT number: BE1000.750.582.
Email: support.kardza@gmail.com
Website: https://kardza.vercel.app
This Privacy Policy explains how personal information is processed when you use KARDZA.
1. Information We Collect
Depending on how KARDZA is used, we may process information including:
- account information, such as an email address;
- business information, such as business name, branding, logo, loyalty card configuration and reward settings;
- customer information provided through participating businesses, such as phone numbers and loyalty progress;
- loyalty activity, such as scans, stamps, points and rewards;
- technical information required to operate and secure the service;
- usage information where analytics consent has been provided.
We do not intentionally request sensitive categories of personal data through the normal use of KARDZA.
2. How We Use Information
We process information where necessary to:
- create and manage KARDZA accounts;
- provide digital loyalty cards and reward functionality;
- process scans, stamps, points and rewards;
- operate business dashboards and related features;
- provide customer support;
- maintain the security and reliability of KARDZA;
- prevent fraud, abuse and unauthorised use;
- enforce reasonable service and usage limits;
- comply with applicable legal obligations;
- improve the service where analytics consent has been provided.
We process personal data only where an appropriate legal basis applies.
3. Businesses and Their Customers
Businesses use KARDZA to operate loyalty programs for their customers.
A participating business generally determines why it collects and uses its customers' personal information in connection with its loyalty program.
KARDZA provides the technical service used to process that information.
Customers who have questions about how a particular business uses their information should normally contact that business first.
You may also contact KARDZA at support.kardza@gmail.com where appropriate.
4. Phone Numbers
Some loyalty programs operated through KARDZA may use a customer's phone number to identify the customer and maintain their loyalty account or progress.
Phone numbers must only be used for legitimate purposes connected with the KARDZA service and the relevant business loyalty program.
5. Analytics and PostHog
KARDZA uses PostHog to understand how the service is used and to improve the product.
Where consent is required, PostHog analytics is only activated after the visitor explicitly accepts analytics.
If analytics is rejected, the core KARDZA service remains available.
Depending on configuration, analytics information may include:
- pages viewed;
- interactions with the application;
- browser and device information;
- technical usage information;
- feature usage and navigation behaviour.
Users can reject analytics or withdraw their analytics consent at any time through the Cookie settings available on the website.
KARDZA does not intentionally activate optional PostHog analytics before consent where consent is required.
6. Cookies and Similar Technologies
KARDZA uses technologies necessary to provide core functionality such as authentication, security and session management.
These necessary technologies may be used without analytics consent where they are required to provide the service.
Optional analytics technologies are handled separately and are only enabled according to the user's analytics preference.
More information is available in the KARDZA Cookie Policy.
6a. Referral partners
We process referral codes and attribution, partner identity and account information, the referred business name, signup date and account status to operate the Partner Program. Subscription status and commission-related information may be processed when paid subscriptions become available. KARDZA is currently free during Beta: referrals are tracked, but no commission is earned, accrues, is payable, or is owed for free usage.
Partners receive only the minimum information needed to track their referrals. The current portal shows business name, signup date and account status; it does not share loyalty customer data, business owner email addresses or phone numbers. Limited subscription and commission information may be shared when relevant to qualifying paid referrals.
We record the partner ID, signed-in user ID, accepted Partner Terms version and acceptance time to administer and evidence the partner agreement. We do not collect an IP address or device fingerprint for this record. Agreement to the Partner Terms is separate from optional analytics consent.
Partner account and agreement records are processed to perform and administer the partner contract. Referral attribution and fraud prevention support our legitimate interests in operating the program, subject to applicable rights; accounting information may be retained to meet legal obligations. Referral device storage requires a separate, optional opt-in through Cookie settings; rejecting it does not prevent signup. Records are kept only as needed for these purposes and proportionate dispute or legal requirements, as described below.
With your consent to Referral / affiliate tracking, a signed first-party referral cookie remembers attribution for up to 30 days. You can withdraw that consent in Cookie settings to remove the cookie and stop future device tracking. Existing analytics consent does not grant referral consent. Once finalised at signup, the business attribution remains linked to the partner, including throughout Beta and after partner deactivation, subject to lawful data retention and deletion requirements. Expiry or deletion of the cookie does not undo an attribution already saved to an account. See the Cookie Policy and Partner Terms.
7. Service Providers
We use third-party providers to operate KARDZA.
These may include providers of:
- database infrastructure;
- authentication;
- storage;
- website and application hosting;
- analytics;
- security and technical infrastructure.
These providers may process information where necessary to provide their services to us and subject to their applicable contractual and data-protection obligations.
8. Data Retention
We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including where necessary to:
- provide the KARDZA service;
- maintain account and loyalty functionality;
- comply with legal obligations;
- resolve disputes;
- enforce agreements;
- maintain security.
Different categories of data may have different retention periods.
9. Account and Data Deletion
KARDZA does not currently provide automated account deletion inside the application.
Account holders can request deletion of their account and associated personal information by contacting:
Where possible, requests should be sent from the email address associated with the KARDZA account.
We may need to verify the identity of the person making the request.
Certain information may be retained where required by law or where necessary for legitimate legal, security or accounting purposes.
10. Your Data Protection Rights
Depending on applicable law, including the GDPR, you may have rights including the right to:
- request access to your personal data;
- request correction of inaccurate personal data;
- request deletion of personal data;
- request restriction of certain processing;
- object to certain processing;
- request data portability where applicable;
- withdraw consent where processing is based on consent.
To exercise a privacy right, contact:
You also have the right to lodge a complaint with the competent data-protection authority.
11. Security
We use reasonable technical and organisational measures designed to protect information processed through KARDZA.
However, no online service can guarantee absolute security.
Users are responsible for keeping their own account credentials secure.
12. International Data Processing
Some infrastructure or service providers may process information outside Belgium or outside the European Economic Area.
Where required by applicable law, appropriate safeguards will be used for international transfers of personal data.
13. Children
KARDZA is primarily a business loyalty platform and is not designed to intentionally collect personal information from young children independently of a participating business.
Businesses using KARDZA are responsible for ensuring that their loyalty programs comply with applicable requirements concerning minors.
14. Changes to This Privacy Policy
We may update this Privacy Policy as KARDZA develops or where required by law.
The latest version will be published on this page with an updated revision date.
15. Contact
For privacy questions or requests:
Bratim BV VAT number: BE1000.750.582.
Koensborre 92, Bus 101
1730 Asse
Belgium
Email: support.kardza@gmail.com
Website: https://kardza.vercel.app