Privacy Policy — Loyalty v3

Version 3.0 · Effective from the date of publication · 2026-04-25 · Operator: Prime Sky Services s.r.o., Company ID (IČO): 47 064 781

This document contains supplementary provisions of the WontRip Privacy Policy for the WontRip Loyalty Engine v3. It forms an integral part of the general WontRip Privacy Policy, and in the event of conflict these special provisions for Loyalty features take precedence.

Section A — Pro Verification (special categories of personal data)

A.1 Sensitive personal data

For the purposes of the Pro Discount program (see Terms and Conditions Art. I), the Seller processes the following special categories of personal data within the meaning of Art. 9 of Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR):

  • Membership of the Armed Forces of the SR / Police / Fire and Rescue Corps / Corps of Prison and Court Guard / Slovak Information Service / Military Intelligence Service
  • Employment relationship with the Ministry of Interior / Ministry of Defence / Ministry of Justice of the SR
  • Trade union membership (Art. 9(1) GDPR — sensitive)
  • Membership of foreign armed forces (NATO/EU)

A.2 Legal basis for processing

The legal basis is the explicit consent of the data subject within the meaning of Art. 9(2)(a) GDPR, given by explicit opt-in at enrolment in the Pro program. Consent may be withdrawn at any time without negative consequences for standard Loyalty status.

A.3 Purpose of processing

Data is processed exclusively for the purpose of activating and maintaining Pro Discount within the meaning of Terms and Conditions Art. I. The data serves no other purpose — not marketing, not profiling beyond tier calculation, not sharing with third parties.

A.4 Storage & Data Minimization

The Seller undertakes to:

  • NEVER store copies of ID cards, documents or photographs evidencing membership/status
  • Store exclusively: boolean flag "is_pro: true", level (state/frontline/foreign/union), verification date, identifier of the admin employee who performed the verification, verification expiry date (24 months)
  • Verification: visual inspection of the document by an authorised admin employee in real time, WITHOUT scan/photo/upload — flag and delete

A.5 Re-verification and expiry

  • Pro status expires 24 months from the last verification (data minimisation, GDPR Art. 5(1)(e))
  • Notification 30 days before expiry with the option of re-verification
  • Without re-verification, the Pro flag is automatically deactivated

A.6 Right to erasure (GDPR Art. 17)

  • The user has the right to request instant cancellation of Pro status at any time
  • Cancellation = immediate is_pro=false; an audit trail "Pro status revoked at TIMESTAMP by USER REQUEST" is retained for accounting purposes (VAT compliance)

Section B — Loyalty Program Data Flow

B.1 Data processed

For the purposes of the Loyalty Program (member pricing, Insider Reward, Daily Brief), the Seller processes the following data:

  • Customer ID (Shopify), email, name (from standard registration)
  • Purchase history — for calculating the WRS spend factor (24-month rolling window)
  • Course completion records (for the WRS courses factor)
  • Forum activity — posts, votes, accepted answers (if the forum is active)
  • Tier / sub-status history (for audit trail and explanation of member pricing upon subsequent inquiry)
  • Daily check-in records (ONLY if opted in)
  • Insider Reward credit balance + transactions (for accounting purposes)

B.2 Legal basis

  • Performance of a contract (Art. 6(1)(b) GDPR) — for tier calculation and Insider Reward
  • Consent (Art. 6(1)(a) GDPR) — for Daily Brief, marketing communications and opt-in features
  • Legitimate interest (Art. 6(1)(f) GDPR) — for fraud prevention in Insider Reward redemption

B.3 Profiling and automated decision-making

WRS calculation and tier assignment are automated decisions within the meaning of Art. 22 GDPR. The user has the right to:

  • Request human intervention in the tier decision
  • Express their point of view and contest the decision
  • Obtain an explanation of the specific tier assignment via support@wont.rip

B.4 Retention period

  • Loyalty data: for the duration of membership + 3 years after deactivation
  • Insider Reward credit transactions: 10 years (Act No. 431/2002 Coll. on Accounting)
  • Daily check-in records: 12 months (operational)
  • Pro verification metadata: 24 months + subsequent re-verification audit trail 5 years

B.5 Recipients

  • Shopify Inc. (hosting platform — DPA signed, SCCs for USA transfer)
  • SuperFaktúra (invoicing — DPA signed, SK)
  • Stripe Inc. (payment gateway — DPA signed, SCCs)
  • Cloudflare Inc. (CDN, Worker for the Loyalty Engine — DPA signed, SCCs)
  • Klaviyo (email marketing — DPA signed, SCCs, only for opt-in marketing communications)
  • No other third parties WITHOUT the user's explicit consent

B.6 Cross-border transfers

Some recipients (Shopify, Stripe, Cloudflare, Klaviyo) have servers outside the EU (USA). The transfer is carried out on the basis of Standard Contractual Clauses (SCCs) of the European Commission and the EU-U.S. Data Privacy Framework.

Section C — Cookies & Marketing

C.1 Daily check-in cookies

  • First-party cookie "wr_dailycheckin_lastdate" — for detecting the daily check-in
  • Retention period: 30 days
  • Requires opt-in via Daily Brief activation in Your Zone

C.2 Loyalty session cookies

  • First-party cookie "wr_loyalty_tier" — caching the tier for faster display of the member price
  • Retention period: session (until the browser is closed)
  • Classified as essential — does not require separate consent (necessary for membership to function)

C.3 Push notifications

  • Push notifications for Daily Brief require explicit double opt-in (in-app + browser permission)
  • Klaviyo and Shopify push channels are integrated with the consent mechanism
  • The user may deactivate at any time without penalty via Your Zone or the Klaviyo unsubscribe link

Section D — Rights of the Data Subject

The user always has the following rights (GDPR Art. 15-22):

  • Right of access (Art. 15) — request an export of all Loyalty data
  • Right to rectification (Art. 16) — correction of inaccurate data
  • Right to erasure (Art. 17) — instant deactivation + retention of minimum data for accounting purposes
  • Right to restriction of processing (Art. 18)
  • Right to data portability (Art. 20) — JSON export
  • Right to object (Art. 21) — to profiling / Daily Brief
  • Right not to be subject to automated decision-making (Art. 22) — request human intervention for tier
  • Right to lodge a complaint with the Slovak Data Protection Authority (dataprotection.gov.sk)

Contact for exercising rights

Email: dpo@wont.rip / support@wont.rip
Response time: max 30 days (Art. 12(3) GDPR)