DRAFT v2026-10-11 for review. Not in effect. The controller/processor split between EBS and each café, the items in [square brackets] and the international transfer wording must be confirmed before use.
EBS Rewards privacy notice
Version 2026-10-11. This notice explains how your information is used when you join or use EBS Rewards at a participating café.
Who is responsible
EBS Labs Ltd ([registered address], ICO registration [number]) provides EBS Rewards and is the controller for your membership information. [The café you join may also be a controller for its own records of your visits.] Contact: [privacy email].
What we collect
- Your mobile number, and a record that you confirmed it by opening the link we texted you.
- Your name, only if you choose to give it. Otherwise your membership is shown as “Member ending 123”.
- Your purchases at participating cafés that earn or use points: date, amount, café and points.
- The cards you link: a code from Stripe that identifies each card (never the card number), its brand and last four digits, and when it was last used at a participating café.
- Your choices: that you accepted the programme terms, and whether you want offers.
- If you add a Wallet pass: a pass identifier and the technical details Apple Wallet uses to update it.
We never receive your full card number. Card payments are handled by Stripe.
Why we use it, and our legal basis
- To run your membership, add points and provide rewards: to perform our agreement with you (the programme terms).
- To text you the link to join and service messages about your membership: to perform that agreement.
- To recognise your linked cards at participating cafés and add your points automatically: to perform that agreement.
- To send offers, only if you choose to receive them: your consent, which you can withdraw at any time.
- To prevent fraud and misuse, keep records and fix mistakes: our legitimate interests in running a fair, secure programme.
- To meet legal and accounting obligations: legal obligation.
Who we share it with
- Each café where you are a member, so they can recognise you and honour rewards. If you pay with a linked card at another participating café, you become a member there too, and that café receives your membership details: your name if you gave one, your mobile number and your purchases there.
- Service providers who run EBS for us under contract: Supabase (database, EU), Twilio (text messages), Vercel (this website), Stripe (payments) and Apple (Wallet pass updates).
Some providers may process information outside the UK. Where they do, we rely on [UK adequacy regulations or the UK International Data Transfer Agreement / Addendum] to protect it.
We do not sell your information.
How long we keep it
While you are a member, and [24 months] after your last activity, then we delete or anonymise it. Purchase records may be kept longer where accounting law requires. An invitation link that is not used expires after 3 days.
Your rights
You can ask for a copy of your information, to correct it, to delete it, to restrict or object to our use of it, and to move it. You can withdraw consent to offers at any time. Contact [privacy email]. You can also complain to the Information Commissioner’s Office at ico.org.uk.
Changes
We will update this notice if how we use your information changes, and tell you about significant changes.