Privacy policy

1. Data controller

Klapp is a service provided by Klapp Connect, a French single-shareholder simplified joint-stock company (SASU) with share capital of €1,000, registered with the Paris Trade and Companies Register under number 106 733 512, SIRET 106 733 512 00011, with its registered office at 47 rue Vivienne, 75002 Paris, France. Contact: hello@getklapp.fr. For a customer's data at a business, the business decides how it is used: Klapp Connect acts on its behalf as a processor.

2. Data we collect

When you hold your phone near a Klapp contactless stand at a business, we collect:

• Your phone number, which uniquely identifies your loyalty card.
• Your first name, last name and email address, which you provide when you create your card, so that the business can recognise you and personalise messages.
• Your date of birth and gender (you can choose not to say), to tailor offers to your age and birthday.
• Your validated visits: the date and time of contactless visits that add a point, with a maximum of one point per day.
• Your rewards: the number of rewards earned and redeemed.
• Technical identifiers linked to your Apple Wallet or Google Wallet card, if you add it, so that we can update the card automatically.

We do not collect any bank details, postal addresses or health data, and we do not access your contacts, location or photos.

If you complete the website contact form, for example to request a demo, we collect the information you enter: first name, email address and phone number, solely to respond to your request.

3. How we use your data

• To keep your loyalty card up to date, including your visit count and rewards.
• To send you service messages on WhatsApp, such as reward confirmations and updates about your loyalty card.
• Where applicable, to send you promotional offers and follow-up messages on WhatsApp and by email, such as a welcome-back offer if you have not visited the business for some time. Each message of this kind explains how to unsubscribe in one step. You can opt out at any time, as described in section 8.
• To automatically update the card you have added to Apple Wallet or Google Wallet.

4. Legal basis

Keeping your loyalty card is based on the programme you request when you create it. The business's offers and follow-up messages, on WhatsApp and by email, are sent on the basis of the box you tick when you create your card, to agree to be contacted again by the business. This box is required to create the card. You can unsubscribe at any time without losing your card.

5. Who can access your data

Your data is accessible only to:

• The business where you use your card, to manage your loyalty programme relationship.
• Klapp, as the technical provider of the platform.
• Our technical service providers: Supabase for database hosting, Vercel for application hosting, Resend for sending emails, Amazon Web Services (Amazon SES, Paris region) for sending offers by email, WhatsApp Business API for sending messages, PostHog for cookie-free website analytics, Formspree for handling requests submitted through our contact form, and Apple Wallet and Google Wallet for updating cards.

Transfers outside the European Union: some of these providers, including Formspree, may process data outside the European Economic Area, including in the United States. These transfers are covered by appropriate safeguards, in particular the European Commission’s standard contractual clauses or an adequacy decision where applicable.

We never sell your data to third parties or use it for advertising purposes.

6. How long we keep your data

We keep your data while the business's programme is active, and for at most three years after your last visit to that business, unless the business asks for a shorter period. You can request the deletion of your card and associated data at any time, as described in section 8. Information that the law requires us to keep, such as a business's invoices, is kept for the legal period.

7. Security

Exchanges with Klapp use an encrypted connection (HTTPS). Access to data is limited to authorised people and businesses. NFC stands use signed identifiers to prevent copying.

8. Your rights under the GDPR

You have the following rights over your data at any time:

• Access: obtain a copy of your data.
• Rectification: correct inaccurate information.
• Erasure: delete your card and all associated data.
• Objection: object to the use of your data for offers and follow-up messages.
• Portability: receive your data in a reusable format.
• Withdrawal of consent: withdraw the consent you gave when creating your card at any time, without affecting the lawfulness of processing already carried out.

To exercise any of these rights, email hello@getklapp.fr. We will respond within the legal time limits, generally within one month.

If you believe your rights have not been respected, you can lodge a complaint with the French data protection authority, the CNIL.

9. Cookies

The getklapp.fr website and the app.getklapp.fr application use only two technical cookies. The klapp_phone cookie, kept for one year, remembers your phone number so that you do not need to enter it again at each visit. The klapp_appareil cookie, kept for 400 days, proves that this phone is yours: knowing your number is not enough to open your card. Our analytics tool, PostHog, operates without cookies and does not track your browsing on other websites. There are no third-party cookies or advertising trackers.

10. Changes to this policy

This policy may be updated. The last updated date at the top of this page indicates the current version.