Guest Privacy Notice

Guest Privacy Notice

BuzzAgent Ltd

This notice is for guests: people who have a guest card at a venue that uses BuzzAgent and save it to their mobile number. It explains what we keep when you save your card, why we keep it, and what you can do about it. Our Privacy Policy covers the rest of what we do, and our Guest Terms of Use cover saving your card.

1. Who we are

BuzzAgent Ltd ("BuzzAgent", "we", "us", "our") is a company registered in England and Wales under company number 16562822, with its registered office at 86-90 Paul Street, London, EC2A 4NE, United Kingdom.

If you have a question about this notice or about your data, email us at hi@buzzagent.co.

2. Your card and your account

When you scan a venue's BuzzPad and start a guest card, the card is kept in your browser. Each venue holds its own card's record - your visits, stamps, treats and rewards there - and we keep that record for the venue, on its instructions.

When you save your card to your mobile number, confirmed by a code we text to it or, where we offer it, by a message you send from your own WhatsApp, we open a guest account for you. The account is ours, not the venue's: we hold it as the controller of your data. Our legal basis is your consent, which you give by saving your card.

Your account finds your cards at every venue, so that you can get all of them back in another browser or on a new phone by confirming the same mobile number. We use it only to show you your own cards.

3. What we keep

• Your mobile number, and when you confirmed it.
• Your card id: the random identifier your browser keeps for your cards. Every browser where you get your cards back shares it, so anyone using one of those browsers can open your saved cards.
• Code requests and checks: each request for a code, with the network address it came from, and each check of one, so we can limit how often a number can be texted or tried. We never keep a code we text you.
• Your WhatsApp message: if you save with WhatsApp, the message you send to BuzzAgent's WhatsApp number, with your WhatsApp number and the profile name your WhatsApp shows.

We keep nothing else: no email address, no password, no location, and no name beyond the profile name your WhatsApp shows.

4. How we use it

• To give you your cards back in any browser where you confirm your mobile number. Legal basis: your consent.
• To confirm your mobile number. We send it the code you ask for and a message confirming it with the address of your cards, and nothing else. Legal basis: your consent.
• To keep the service secure, by limiting how often a number can be texted or tried. Legal basis: legitimate interests.

What we never do:

• We never send you marketing, and no venue can message you through your account.
• We never give your mobile number to a venue, and we never sell it.
• We never use your account to build a profile of you or of the places you visit, and we never tell a venue where else you have a card.
• Your account has no settings to change: it is private from the start.

5. What a venue sees

The most a venue sees is the record of its own card: when you first and last visited, how many visits, and the stamps, treats and rewards on it, shown under a reference. From your card and your account it never sees your name, your mobile number, whether you saved your card, or your cards at other venues.

6. Who handles your data for us

• Twilio sends our texts, from the sender name "BuzzAgent".
• Meta carries WhatsApp messages for us. If you save with WhatsApp, your message and our reply also pass through WhatsApp on your own phone, under WhatsApp's own terms and privacy policy.
• Our other service providers host and secure the service.

They act on our instructions and are listed, with where each processes data, at buzzagent.co/legal/sub-processors. Some process data outside the United Kingdom, including in the United States; Section 10 of our Privacy Policy explains how we protect it there.

7. How long we keep it

• Your mobile number, when you confirmed it, and your card id: until you remove your mobile. Your account has no expiry date.
• Your WhatsApp message: until you remove your mobile, except as Section 8 says.
• Each code request and each check of a code: deleted a day after it is made. Twilio keeps a record of each text for 7 days.

8. Removing your mobile

You can remove your mobile at any time from your card: press "Remove my mobile". We then delete your mobile number and your card id from your account, and the messages you sent to BuzzAgent's WhatsApp number, unless the same WhatsApp also receives our alerts for a business. Your cards stay in the browsers that already hold them until you forget them there, but they no longer come back on a new phone.

You can also ask us to remove it by email at hi@buzzagent.co.

9. Your rights

Under UK data protection law you can ask us to:

• show you the data we hold about you;
• correct it;
• delete it;
• restrict or object to how we use it;
• give it to you in a form you can take elsewhere.

You can withdraw your consent at any time by removing your mobile, without affecting what we did before. To use any of these rights, email hi@buzzagent.co. A venue's own record of your card is the venue's to decide on: we pass your request to the venue and act on it ourselves where we can.

10. Your age

You can save a card to your mobile if you are 13 or over. We rely on your own statement and do not check your age. If you are under 13, please do not save a card.

11. Complaints

If you are unhappy with how we handled your data, tell us first at hi@buzzagent.co. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk or 0303 123 1113. You do not have to come to us first.

12. Changes to this notice

We may update this notice from time to time. We will post the updated version here, and the date shown at the top of this page changes with it.

13. Contact

BuzzAgent Ltd 86-90 Paul Street, London, EC2A 4NE, United Kingdom Email: hi@buzzagent.co