Privacy policy

Effective 1 October 2026

1. Who we are

Loyo Rewards Limited ("Loyo", "we", "us") is a company registered in Kenya with its registered office at Westlands, Nairobi, Kenya. We provide a digital stamp-card and gift-voucher platform used by businesses ("merchants").

2. Who is responsible for your information

• Loyalty programs and gift vouchers: the merchant whose program you join decides why and how your information is used. We process it for the merchant using our platform.
• Our own services: we are responsible for information from our website enquiry form, merchant and staff accounts, and the security of our platform.

This policy covers both. A merchant may also have its own privacy notice.

3. What we collect

• Customers: your mobile phone number; your name, if you give it; your stamps, rewards, vouchers and visit history with a merchant; records of the SMS we send you; basic device and browser details when you open your card link; and a record of when you accepted the terms and which version.
• Merchants and staff: business name, contact name, phone number and email; staff phone numbers and PINs (stored securely); the browsers registered for each shop; and activity records, such as who issued a stamp and when.
• Website visitors: the details you type into the walkthrough request form (name, business name, phone or WhatsApp number, and optionally email and type of business) and cookie or analytics data.

We do not sell personal information. We send marketing messages only if you have agreed.

5. Who we share it with

• The merchant whose program you joined.
• Service providers who help us run the platform, such as SMS provider Tiara and hosting provider DigitalOcean, under contracts that require them to protect your information.
• Authorities, courts or regulators, when the law requires it.
• A buyer or successor, if our business is sold or restructured, who must keep this policy's protections.

We do not share your information with other merchants without your consent.

6. Transfers outside Kenya

Some providers may store or process information outside Kenya. If so, we do this only with the safeguards Kenyan law requires.

7. How long we keep it

• Program data: while your card is active and for 24 months after your last activity, then we delete or anonymise it.
• Walkthrough enquiries: 12 months unless you become a merchant.
• Records we must keep by law: for as long as the law requires.

8. Security

We protect information with access controls, individual staff PINs, registered shop browsers, encryption in transit and monitoring. If a breach is likely to harm you, we will tell the ODPC and the people affected, as the law requires.

9. Your rights

Under the Data Protection Act, 2019, you have the right to be informed about how your information is used, to see it, to have it corrected or deleted, to object to or restrict its use, to receive a copy in a usable format, and to withdraw your consent at any time (this does not affect past use). To use these rights, contact the merchant for program data, or contact us at info@loyorewards.com. We may ask you to confirm who you are, and we will respond within the time the law requires.

10. Children

Our services are for adults. We do not knowingly collect information from anyone under 18 years of age.

11. Complaints

Please contact us first so we can fix the problem. You also have the right to complain to the Office of the Data Protection Commissioner.

12. Changes

We will post any change on this page with a new date, and tell you directly about important changes.