This Privacy Policy explains how FDS Cards Ltd ("we", "us", "our") collects, uses, shares and safeguards personal data when you use the HexaTech Loyalty mobile app (formerly Hotel Loyalty), the HexaTech Staff desk app, the legacy Hotel Staff mobile app, and the related HexaTech / Hotel Tech web platform at app.hexa-tech.uk (together, the "Service"). By using the Service you agree to the practices described below.
FDS Cards Ltd is the data controller for personal data processed through the Service.
For stays at a specific hotel, the hotel itself is a joint controller of your reservation, guest profile and any chat messages you exchange with that hotel's team. The hotel is identified inside the app (under your bookings and chat threads).
| Category | Examples |
|---|---|
| Account | Name, email, phone (optional), password (stored hashed only); profile photos only in services that provide an upload feature. HexaTech Loyalty 2.0 and HexaTech Staff do not upload photos. |
| Membership | NFC loyalty card UID (used purely as a member identifier), QR member code |
| Reservations | Stay dates, room or service selected, party size, special requests, payment status |
| Payments | When you choose online payment in HexaTech Loyalty, payment-card details and required billing-address fields are collected directly by Stripe's payment sheet. HexaTech receives payment identifiers and status, not the full card number. |
| Communications | Messages you send to the hotel team via in-app chat, support emails |
| Preferences | Language, push-notification preferences, marketing opt-ins |
| Category | Examples |
|---|---|
| Loyalty activity | Points earned and redeemed, tier progression, redeemed offers |
| Stay history | Past and upcoming bookings, check-in / check-out events |
| Notifications | Device push-notification tokens for member messages and staff request alerts, delivered through Expo, Apple APNs and Google FCM when notifications are enabled |
| Technical | IP address (for rate-limiting and abuse prevention), user agent, app version |
| Diagnostics and searches | Server-side error logs may include the request URL and account identifier, including booking availability criteria or staff search terms when a request fails. No third-party crash analytics SDK is bundled in the current native apps. |
| Payment-component activity | Stripe collects interactions with its payment components for payment functionality, analytics and fraud prevention. This is not used for cross-app advertising tracking. |
In HexaTech Loyalty and HexaTech Staff, camera access scans QR codes on the device; camera images are not uploaded. Optional Face ID or fingerprint protection is handled by your device. The apps do not receive your face or fingerprint data.
| Purpose | Legal basis |
|---|---|
| Run your loyalty membership and process your reservations | Contract (UK GDPR Art. 6(1)(b)) |
| Send transactional emails and push notifications (booking confirmations, points balance, reservation reminders) | Contract (UK GDPR Art. 6(1)(b)) |
| Send marketing communications (only if you opt in) | Consent (UK GDPR Art. 6(1)(a)) |
| Prevent fraud, secure the Service, debug technical issues | Legitimate interests (UK GDPR Art. 6(1)(f)) |
| Comply with tax, accounting and consumer-protection laws | Legal obligation (UK GDPR Art. 6(1)(c)) |
We do not sell your data. We share it only with the categories of recipients below, all of whom are bound by confidentiality and data-processing agreements:
| Recipient | Purpose | Region |
|---|---|---|
| The hotel(s) you stay at | Run your reservation, recognise you on arrival, deliver loyalty perks | Hotel's location (typically EU/UK) |
| DigitalOcean | Hosting and database storage | EU |
| Smoobu (Bookingsync GmbH) | Property-management synchronisation when your stay involves a Smoobu-managed unit | EU (Germany) |
| Stripe Payments Europe Ltd | Process payments, collect required billing details, analyse payment-component interactions and prevent payment fraud | EU (Ireland) |
| OpenAI Ireland Ltd | Generate chatbot replies when you message the hotel via the AI chat (only message content is sent — never your account credentials) | EU / US (with EU-US Data Privacy Framework safeguards) |
| Anthropic, PBC | Power the staff-side admin assistant. Member personal data is sent only when a staff user explicitly queries that member's record. | US (Standard Contractual Clauses) |
| Expo | Route the current native apps' push notifications to Apple APNs or Google FCM | See Expo's privacy policy |
| Apple Inc. / Google LLC | Deliver push notifications via APNs and FCM | US (SCCs / DPF) |
| Tax authorities, regulators, courts | When legally compelled | Jurisdiction-dependent |
Where data is transferred outside the UK / European Economic Area, we rely on the EU-US Data Privacy Framework (where applicable), the UK International Data Transfer Addendum, or Standard Contractual Clauses adopted by the European Commission.
| Data | Retention |
|---|---|
| Account profile | For the lifetime of your account, then 30 days after a deletion request |
| Booking and payment records | 7 years (statutory accounting requirement under UK Companies Act 2006) |
| Loyalty points ledger | While the account exists; an immutable audit trail is kept for 7 years for tax purposes |
| Chat messages with the hotel team | 12 months from last activity |
| Server logs (IP, user agent, request paths) | 90 days |
| Marketing-consent records | 3 years after withdrawal of consent |
Under UK GDPR and the EU GDPR you have the following rights, exercisable free of charge:
To exercise any of these rights, email vitaly@fds-cards.co.uk. We will respond within one calendar month.
You can also delete your member account directly in HexaTech Loyalty: More → Profile → Delete account. For a request outside the app, including a request about specific data, follow our data-deletion instructions.
The Service is intended for users aged 16 and over. We do not knowingly collect personal data from anyone under 16. If you believe a minor has provided personal data to us, contact vitaly@fds-cards.co.uk and we will delete it.
Our mobile apps do not use browser cookies. The web admin panel sets a single first-party
session cookie (laravel_session) that is strictly necessary for authentication
and is not used for tracking or advertising.
HexaTech Loyalty and HexaTech Staff do not track you across other apps or websites and do not request Apple's App Tracking Transparency permission. Their App Store privacy disclosures describe data used for app functionality, with Stripe payment-component analytics also disclosed for HexaTech Loyalty.
We may update this Policy when our practices change or when required by law. Material changes will be communicated to active users through an in-app notice or email at least 14 days before they take effect. The "Last updated" date at the top of this page indicates the most recent revision.
Questions, concerns or requests about this Privacy Policy or your personal data should be sent to vitaly@fds-cards.co.uk.