PRIVACY POLICY

1. Introduction

Low6 Limited (“Low6”, “we”, “us”, “our”) of 1 Cranmore Drive, Shirley, Solihull B90 4RZ is committed to protecting and respecting your privacy. Low6 is committed to the protection of the personal data that we process in line with the data protection principles set out in the European Union General Data Protection Regulation 2016 (“GDPR”) and the Data Protection Act (2018).

This privacy notice explains what personal data we collect from individuals who use the Low6 App. It also explains what information we collect automatically when you use our App.

Low6 is the data controller for the purposes of the GDPR in instances where you make an enquiry with us, registered as such with the Information Commissioner’s Office, registration number ZA790666.

As an information-led business, we place great importance on ensuring the quality, confidentiality, integrity, and availability of the data we hold and in meeting our data protection obligations when processing personal data. Low6 are committed to protecting the security of your personal data. We use a variety of technical and organisational measures to help protect your personal data from unauthorised access, use or disclosure.

We update this privacy notice from time to time in response to changes in applicable laws and regulations, to our processing practices and to the products and services we offer. When changes are made, we will update the date at the top of this document. Please review this privacy notice periodically to check for updates.

2. What information do we process?

Personal data is any information relating to an identified or identifiable natural person. We process the information you give us, whether through interactions with our app, our website or by any other form of correspondence.

Information you provide to us

The categories of personal data we process include:

Contact details (title/name/address/email address/phone number)

Date of Birth

Gender

Bank details (name/account number/sort code)

Any information you share through our social media channels

Information we collect from you

When you use our app, we may collect:

Device details

App login information – when creating an account user name, we strongly advise you not to use your real name or any other information specific or personal which may identify you.

App usage data

Location data

Information required for legal and regulatory compliance

We may use tools to personalise the user experience of our App, which may be disabled at any time using the Privacy Settings in the App or on your device.

3. Purposes and bases for processing your personal data

We may use your data for the following purposes and on the following lawful bases:

Purpose	Lawful Bases for Processing
Delivery and performance of our App services in accordance with our Terms and Conditions	It is necessary to process your personal data to facilitate performance of the service contract
Providing information on your account, such as transaction history, cashback rewards and spending trends	It is necessary to process your personal data to facilitate performance of the service contract
Prevention and detection of crime including money laundering, fraud or other crimes	We have a legal obligation to report any such activity to the relevant authorities and regulators
Compliance with sector-specific laws, regulations, and guidelines	We have a legal obligation to provide our services within the law and regulations set down by our Regulators
Providing you with updates about our App, additional features, and providing you with exclusive promotions and deals	It is our legitimate interest to provide accurate and up-to-date information to App users and to increase features of the App in order to continually improve and expand the services we provide
Delivering the benefits of our App by connecting you to the services and products of our merchants	It is our legitimate interest to promote our services and products
Improving our App and website and the overall App user and website visitor experience	It is our legitimate interest to allow analytics and search engine providers to help improve and optimise our website and App
Ensure maintenance of a secure connection between the App and your device	It is our legitimate interest to ensure the integrity and security of personal data flowing through our systems
Initiate action against any user who acts outside any laws, regulations or our Terms and Conditions or Terms of Use policies	It is our legitimate interest to ensure protection of our company products, services, and reputation
Analyse and track use of the App for reporting and analytical purposes	It is our legitimate interest to monitor App usage in order to continually improve the user experience

Where personal data is processed because it is necessary for the performance of a contract to which you are a party, we will be unable to provide our services without the required information.

4. Sharing your information

We will share your personal data outside the United Kingdom (UK) or the European Economic Area (EEA). This is necessary for the purposes of providing our services to you, but we will only share it where appropriate safeguards are in place to ensure your personal data is protected to the same standard expected within the UK and EEA.

We may share your data with service providers and suppliers to our business who process data on our behalf. In such cases, our service providers and suppliers are data processors and may only use the data in line with our instructions and not for any other purpose. This and other obligations are agreed in the contract between Low6 and the service providers and suppliers.

Our App includes links to our social media pages which enable you to view our content through selected sites. These applications may collect your IP address or Device ID and may set a cookie on your device. When you use one of these links, you are sharing information to another website or service and this privacy policy will no longer apply. Please read the privacy notices provided by the particular social media website you are sharing through before posting any personal information using these links.

Please see the below list of key external providers with whom we share your data, the purpose of this sharing and where possible a link to their privacy policy.

Provider	Purpose of sharing	Privacy policy
GB Group	We share full details including name, address and date of birth. This is necessary to verify customer account details and confirm customers are over 18 years of age.	www.gbgplc.com/privacy-policy
Worldpay	We share payment and personal details relating to your account and payment methods. This is necessary to process payments to and from customer accounts and in order to facilitate the product and contract.	www.fisglobal.com/en-gb/privacy
Facebook	We share marketing and demographic information. This is necessary to create exemption lists to optimise and remove certain customers from marketing campaigns.	en-gb.facebook.com/privacy/explanation
Xtreme Push	To trigger in-app messages, push notifications and text messages to users	xtremepush.com/privacy-policy
Lotame	Lotame analyses the information it collects and receives, and organises it into user groups and audiences, based on factors such as age, gender, geography, interests and online actions. We then use the Lotame-created user groups and audiences, along with information about the possible relationships among different browsers and devices, to design and deliver customized advertising campaigns or other relevant content to users on their computers, phones, and other mobile devices.	https://www.lotame.com/about-lotame/privacy/lotames-products-services-privacy-policy/
White label partners	Where a customer has signed up via one of our white label partners, both Low6 and the partner will be joint data controllers and have access to the information you have provided. This is necessary to facilitate the product and contract.	This privacy policy will apply.

5. Your rights

The GDPR provides you with certain rights in relation to the processing of your personal data, including to:

Request access to personal data about you (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you, and to check that we are lawfully processing it.

Request rectification, correction, or updating to any of the personal data that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected

Request personal data provided by you to be transferred in machine-readable format (“data portability”)

Request erasure of personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove personal data where you have exercised your right to object to processing (see below)

Request the restriction of processing of your personal data. This enables you to ask us to suspend the processing of personal data about you (e.g. if you want us to establish its accuracy or the reason for processing it)

Object to the processing of your personal data in certain circumstances. This right may apply where the processing of your personal data is based on the legitimate interests of Low6

Some of these rights are not absolute and are subject to various conditions under applicable data protection and privacy legislation and the laws and regulations to which we are subject. If at any time you decide that you no longer wish to be contacted for marketing purposes, or if you would like to exercise any of your rights as set out above, you can contact us at privacy@low6.co.uk . You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

In addition to the above, please note that you have the right to make a complaint at any time to the Information Commissioner’s Office if you are concerned about the way in which we are handling your personal data.

6. Data retention period

We will retain your personal data for as long as is necessary to provide you with our products and ongoing services and for a reasonable period thereafter, to enable us to meet our contractual and legal obligations and to deal with complaints and claims.

In some circumstances we are legally obligated to retain information to comply with legal obligations relating to crime prevention or gambling specific regulations.

At the end of the retention period, your personal data will be securely deleted in accordance with the Low6 Personal Data Retention and Destruction Policy and Schedule.