Privacy policy

1. Data controller

The controller of the personal data collected on goodly.be is:

• Goodly
• Responsible person: Ermal Ibraj
• Location: Belgium
• Email: contact@goodly.be

Given the nature and scale of the processing carried out, appointing a Data Protection Officer (DPO) is not required. For any question about your data, you can write to us at any time at contact@goodly.be.

Roles: controller or processor depending on the data

• Merchant and website visitor data: Goodly acts as data controller.
• End customer data (consumers who use a loyalty card): the merchant is the data controller; Goodly acts as processor within the meaning of article 28 GDPR, on the merchant's instructions. Goodly's processing commitments are set out in article 13 of the Terms. To exercise your rights over data linked to your loyalty card, you may contact the merchant concerned or Goodly (article 9).
• Merchants' staff data (employees using the point-of-sale access): the merchant is the data controller; Goodly acts as processor, on the merchant's instructions.

2. Data collected

a) Merchants (platform users)

• Identity, email address and phone number
• Business name and address, type of activity
• Billing data (processed by Stripe; Goodly stores no payment card data)
• Sign-in data (date, IP address, device)
• Preferences (language, card personalisation, programme settings)

b) Merchants' end customers

• First name and last name (required)
• Email address (required)
• Phone number (optional; used to match sales from the connected point of sale)
• Loyalty card PIN code
• Language
• History of visits, stamps, points and rewards
• Connected point-of-sale customer ID (Lightspeed or Shopify), only if the merchant has enabled the connection
• Referral code
• Communication preferences (offers by email or notification)
• On the add-card page: country, device type and browser (audience measurement, with no IP address retained)

Geolocation: Goodly does not collect End customers' location. For proximity notifications, it is the shop's coordinates that are written into the Wallet card; proximity detection is performed locally by the device (Apple/Google), without the user's location being sent to Goodly.

The loyalty programme is reserved for people aged 13 and over. A dedicated information notice for end customers is available on the loyalty programme page.

c) Merchants' staff (employees using the point-of-sale access)

• Access code
• Actions performed (sign-in, viewing a customer record, stamp, discount, cancellation, refusal)
• Timestamp, IP address and device
• Approximate GPS location, only if the merchant has enabled proximity control

For this data, the merchant is the data controller and Goodly acts as processor. The merchant informs its staff of the existence of this activity log (purpose, data recorded, 90-day retention period).

Visitors to goodly.be

• Pages viewed, referrer, country, device type and browser, visible page time, video playback milestones and form steps without entered values — in-house audience measurement with no identifier stored on your device and no IP address retained (see the cookie policy)
• Language preference

Optional OpenAI Ads measurement

With your consent, Goodly uses the OpenAI Ads pixel to measure visits attributable to its advertising. It operates only on public marketing pages in all six languages. It is absent from the dashboard, sign-in, sign-up and account onboarding pages, and end-customer pages (loyalty cards, passes and gift cards).

The only event configured by Goodly is page_viewed. OpenAI receives the page URL and referrer (origin and path, without query parameters or fragments), browser and connection information, including the IP address, and pseudonymous browser and ad-click identifiers. These data are not anonymous.

Goodly does not explicitly provide contact data to the pixel. However, automatic advanced matching is enabled in the OpenAI configuration: after you consent, the SDK may detect supported form fields and hash email addresses, phone numbers, first names and last names in your browser before sending them to OpenAI for advertising matching. Supported country, city, region and postal-code fields may also be sent, without hashing. Hashing does not make these data anonymous.

3. Purposes of processing

• Provision and management of the digital loyalty card service (cards, stamps, points, rewards, referrals)
• Management of merchant accounts, billing and support
• Sending Wallet notifications related to the operation of the card (stamp, reward, update)
• Sending location-based notifications (if enabled by the merchant)
• Sending offers to end customers by email or notification, including through automated campaigns, only with their consent
• Matching sales from the connected point of sale (Lightspeed, Shopify) if the merchant has enabled it
• Point-of-sale access activity log (security and traceability of operations)
• Operation of the AI assistant and generation of campaign texts
• Sending transactional emails to merchants (security, billing, verification codes)
• Sending Goodly tips and offers emails to merchants (with an unsubscribe link)
• Audience measurement and service improvement
• Optional measurement of visits attributable to Goodly advertising with OpenAI Ads, with your consent
• Fraud prevention and platform security

Notifications and emails

• End customers — service notifications: notifications related to the operation of the card (stamp received, reward available, card update) are sent in the course of performing the service.
• End customers — offers: offers by email or notification are only sent with the customer's consent (checkbox at sign-up), which can be withdrawn at any time from the merchant or Goodly.
• Merchants — transactional emails: security, billing and verification-code emails are sent under the contract.
• Merchants — Goodly tips and offers: these emails include an unsubscribe link.

4. Legal basis for processing

• Performance of the contract (art. 6.1.b GDPR): processing of merchant data necessary to provide the service (registration, account management, billing, support, transactional emails); service notifications related to the operation of the card.
• Legitimate interest (art. 6.1.f GDPR): in-house audience measurement without identifiers stored on the device, technical and security logs, fraud prevention, tips emails to merchant customers (you may object at any time).
• Consent (art. 6.1.a GDPR): offers sent to end customers by email or notification, marketing emails, enabling location-based notifications; optional OpenAI Ads measurement and automatic advanced matching.
• End customer and staff data: Goodly acts on the instructions of the merchant, who is the data controller and determines the applicable legal basis.
• Legal obligation (art. 6.1.c GDPR): retention of billing data in accordance with Belgian accounting and tax obligations.

5. Recipients and processors

Data may be shared with the following processors, strictly for the purpose of providing the service:

Your customers' data is only sent to Lightspeed or Shopify if you enable the connection to your point of sale yourself. The SumUp integration has been announced but is not active: no data is sent to SumUp at this time, and this list will be updated before any activation.

Goodly does not sell or rent your personal data. With your consent, the advertising measurement data described above are sent to OpenAI. Its use of the data is described in its privacy policy.

6. Transfers outside the European Union

Some processors are located outside the European Union (United States, Canada). These transfers are governed by:

• The EU-US Data Privacy Framework, for processors certified under it (Vercel, Stripe, Apple, Google)
• The standard contractual clauses (SCC) adopted by the European Commission (Resend, Anthropic, Supabase)
• The European Commission's adequacy decision for Canada (Lightspeed)

Goodly ensures that each processor offers appropriate safeguards in accordance with articles 44 to 49 GDPR.

Data sent to the OpenAI pixel may be processed outside the European Union, including in the United States. OpenAI’s privacy policy describes its processing and the protections applicable to international transfers.

7. Retention period

• Merchant accounts: retained for as long as the Account exists. The merchant may delete their Account at any time from their settings; Goodly performs no automatic deletion for inactivity. Billing data is retained for 10 years in accordance with Belgian accounting and tax obligations.
• End customer data: retained for as long as the customer's card exists; deleted at the request of the merchant (dashboard tools) or the customer (article 9), or together with the merchant's account.
• Staff activity log: 90 days.
• Sales events sent by the connected point of sale: 24 months.
• Verification codes: 24 hours.
• Technical and security logs: 12 months.
• In-house audience measurement: 12 months, with no IP address.
• OpenAI Ads measurement: your Goodly choice is valid for 30 days; cookie and storage lifetimes are detailed in the cookie policy. These lifetimes do not determine retention of data already received by OpenAI, which is described in its privacy policy.

8. Your rights

In accordance with the GDPR (articles 15 to 22), you have the following rights:

• Right of access: obtain confirmation that data concerning you is being processed and receive a copy of it
• Right to rectification: have inaccurate or incomplete data corrected
• Right to erasure: request deletion of your data, subject to legal retention obligations
• Right to portability: receive your data in a structured, commonly used, machine-readable format
• Right to object: object to processing of your data based on legitimate interest
• Right to restriction: request restriction of processing in certain cases
• Right to withdraw consent: at any time, without affecting the lawfulness of processing carried out before withdrawal

9. Exercising your rights

To exercise your rights, send an email to contact@goodly.be stating your identity and the nature of your request. Goodly undertakes to respond within 30 days.

If you believe your rights are not being respected, you may lodge a complaint with the Belgian Data Protection Authority (DPA):

• Data Protection Authority
• Rue de la Presse 35, 1000 Brussels
• www.dataprotectionauthority.be
• Email: contact@apd-gba.be

10. Cookies

The website uses functional cookies for sign-in and your preferences, in-house audience measurement without cookies and, only with your consent, the OpenAI Ads pixel on marketing pages. The banner offers equally prominent options to allow measurement or reject it. The public site’s “Cookie preferences” control lets you change your choice or withdraw consent at any time.

For more details, see our cookie policy.

11. Security

Goodly implements technical and organisational measures to protect your data:

• Encrypted connections via HTTPS/TLS
• Encryption of sensitive data at rest
• Row Level Security (RLS) to isolate data per merchant
• Restricted access to production data
• Hashed passwords (never stored in plain text)
• Payments processed by Stripe (PCI DSS certified), with no bank data stored on our servers

12. Artificial intelligence

The assistant available on the website and in the dashboard is an automated conversational agent (artificial intelligence) based on the Claude API from Anthropic PBC. Conversations with the assistant, as well as the elements needed to generate campaign texts, are sent to Anthropic to produce the responses; they are processed in accordance with Anthropic's contractual commitments and are not used to train models.

At the request of an authorised administrator, Anthropic also processes only functional journey indicators (page count, visible page time, form and account steps, error categories and video milestones) to prioritise technical issues to investigate. No visitor identifier, URL, email address or entered content is transmitted for this analysis. The proposed issues are not established causes of an interrupted journey.

In accordance with article 50 of the European Artificial Intelligence Act, interactions with an AI system are clearly identified as such in the interface (« AI » assistant). The assistant's responses and suggestions are decision support: they have no contractual value, do not bind Goodly and do not result in any automated decision producing legal effects on individuals. Only these documents and exchanges with the Goodly team are authoritative.

13. Changes to this policy

Goodly reserves the right to amend this privacy policy at any time. Substantial changes will be communicated by email. The date of the last update is shown at the top of this page.

14. Contact

For any question about the protection of your personal data: contact@goodly.be