This Privacy Notice informs you about the nature and extent of processing of your personal data by Cardlytics. Personal data is information that can be directly or indirectly related to you, as defined in Article 4 of the General Data Protection Regulation, (EU) 2016/679 (“GDPR”).

Who processes your personal data?

This Privacy Notice applies to Cardlytics UK Ltd., located at Portland House, Bressenden Place, London, SW1E 5BH, United Kingdom (“Cardlytics“), and its processing of your personal data.

What personal data do we process?

Cardlytics processes de-identified transaction data that is controlled by our banking partners, including Santander and Lloyds. Our banking partners strip out personally identifiable information, like your name and account number, and provide us with the de-identified transaction data. This data shows us where and when you make payments. We collect this data from our banking partners and, at times, their third-party service providers. Because the personally identifiable information has been stripped out, we are not able to identify any particular customer from our de-identified transaction data set.
We also process certain information related to your interactions with these cash-back offers, such as information that shows if you have been served with a cash-back offer, if you activated the cash-back offer, and if you spent at the applicable merchant after receiving the cash-back offer.

How do we collect this information?

We collect de-identified transaction data from our banking partners and, at times, their third-party service providers. We collect information regarding your interactions with the cash-back offers, such as serves and activations, through our in-house proprietary technology.

What do we do with this information?

We use this de-identified transaction information to target certain customers with cash-back offers at places we think you’d like to shop. If you are opted in to the cash-back program at our bank partners, you can see these offers through your online and mobile banking platforms.

We also use this information to create insights regarding consumer spend that we share with our advertisers and, at times, news outlets and other media organizations.

Who do we share this information with?

We share insights that we create from our de-identified transaction data with our advertisers as well as news outlets and other media organizations.

On what grounds does Cardlytics process this information?

Cardlytics processes this data on the basis of the consent that has been given by the customers to our banking partners.

What rights do I have with respect to the processing of this information?

You have a variety of statutory rights under the GDPR, including the right to restriction of processing of your personal data by Cardlytics.

Who can I contact about this Privacy Notice?

For questions about this Privacy Notice or Cardlytics’ processing of your personal data, please contact GDPR@cardlytics.com.

 

Revised 25 May 2018