Privacy statement

Last updated on 18 October 2026.

This privacy statement explains how Loizoo handles the personal data of visitors to www.loizoo.com, users of My Loizoo and merchants who use the Customerzone.

1. Who are we?

Loizoo is a service of Compart BV, with registered office at Beukenlaan 13, 9550 Herzele and enterprise number BE0824.043.209. You can reach us at contact@loizoo.com.

We are the controller for the data of our website, for your Loizoo account and for our customer relationship with merchants. For the data within a merchant’s loyalty programme, such as your loyalty card, your points and your transactions with that merchant, the merchant is the controller and we process that data on its behalf. You can send questions about this to the merchant or to us; we will pass them on to the merchant.

2. Which data do we process?

  • Account data: name, email address, password (stored only in encrypted form), language and, if you provide them, phone number, address and profile picture. If you use two-step verification, we store the key required for it.
  • Loyalty programme data: your loyalty cards, your points balance and the points and rewards collected and redeemed, with date, time and location.
  • Merchant data: company name, legal form, VAT number, address, contact persons, email address, phone number, website and social media, logo and images, and the addresses and coordinates of locations.
  • Subscription and payment data: chosen subscription and period, amounts, payment status, payment references and invoice data. Card and account details are processed by our payment service provider; we do not store them.
  • Technical and security data: IP address, browser, operating system, login time, failed login attempts and error messages.
  • Communication: the messages you send us.
  • Analytics and marketing data: only if you give your consent (see section 7).

3. Why, and on what legal basis?

  • Providing your account and the platform and processing points and rewards: performance of the contract.
  • Subscriptions, payments and invoicing: performance of the contract and our legal accounting and tax obligations.
  • Service messages, such as activating your account, resetting your password, renewal reminders and payment notifications: performance of the contract.
  • Security, preventing fraud and misuse, and fixing errors: our legitimate interest in a secure and properly working platform.
  • Answering your questions: our legitimate interest, or steps taken at your request before entering into a contract.
  • Analysing website use and measuring our advertising: your consent, separately for each purpose, which you can withdraw at any time.
  • Establishing, exercising or defending legal claims: our legitimate interest.

We do not make automated decisions that have legal effects for you, and we do not sell your data.

4. With whom do we share data?

  • The merchant with whom you have a loyalty card sees the data needed for its programme, such as your name, your contact details, your points balance and your transactions.
  • Service providers working on our behalf: hosting, email delivery, our invoicing system and technical support.
  • MultiSafePay, for processing payments.
  • Google, for maps showing merchants’ locations, and for Google Analytics only with your consent. Meta only receives data with your consent, when we use the Meta pixel.
  • Providers of web files, such as cdnjs, jsDelivr and Google Fonts, which technically receive your IP address when a page loads.
  • Authorities, when the law requires us to.

5. Transfers outside the European Economic Area

Some service providers, such as Google and Meta, may process data outside the European Economic Area. This only happens with appropriate safeguards, such as an adequacy decision of the European Commission (for example the EU-US Data Privacy Framework) or standard contractual clauses.

6. How long do we keep data?

  • We keep account data for as long as your account exists. If you have your account deleted, we erase or anonymise your data, unless we are required to keep it longer.
  • We keep loyalty programme data for as long as the merchant offers that programme through Loizoo, or shorter if the merchant asks us to.
  • We keep invoices and accounting data for as long as the law requires, currently up to ten years.
  • We keep technical and security data only for as long as needed for security and fixing errors.

7. Cookies

  • Necessary cookies: PHPSESSID keeps your session until you close the browser. loggedInUserId, userIsLoggedIn and sessionId keep you logged in for 30 days. cookie_consent remembers your cookie choice for 6 months. These cookies do not require consent.
  • Analytics cookies (only with your consent): Google Analytics (_ga, _ga_*), to measure how the website is used. Retention: up to 2 years.
  • Marketing cookies (only with your consent): the Meta pixel (_fbp, _fbc), to measure the results of our advertising on Facebook and Instagram. Retention: up to 3 months.

Analytics and marketing cookies are off by default; you choose per purpose. You can change or withdraw your choice at any time via ‘Cookie settings’ at the bottom of every page. If you withdraw your consent, we remove the cookies concerned. After 6 months, or when our cookie policy changes, we ask for your choice again. As proof of your consent, we keep your choice with a random code, the policy version and the time, without an IP address or other identifying data.

8. Security

We protect your data with, among other things, encrypted connections (HTTPS), passwords stored in encrypted form, optional two-step verification, role-based access control and logging of logins.

9. Your rights

You have the right to access your data, to have it corrected or erased, to have its processing restricted, to object to processing based on our legitimate interest, and to receive your data in a common format. If you gave your consent, you can withdraw it at any time.

Send your request to contact@loizoo.com. We respond within one month and may ask you to confirm your identity. If the request concerns loyalty programme data, we handle it together with the merchant.

If you are not satisfied, you can lodge a complaint with the Belgian Data Protection Authority, Rue de la Presse 35, 1000 Brussels, www.dataprotectionauthority.be.

10. Minors

If you are under 13, you need the consent of a parent or guardian to create an account.

11. Changes

We may update this privacy statement. The date at the top shows when it was last changed. We will notify you of important changes by email or in the platform.