Privacy Policy | ClubWallet

At PZ Producciones S.A. we process personal data with confidentiality, necessity and proportionality. This policy explains what data ClubWallet processes, why, for how long and how you can exercise your rights under Costa Rican law.

1. Data Controller

Controller: PZ Producciones S.A.
Address: Escazú, San José, Costa Rica
Privacy email: privacidad [at] clubwallet.biz
Website: clubwallet.biz

For the data of each business's end customers, PZ Producciones S.A. acts as a data processor on behalf of the business (see section 4).

2. Data We Process

People who contact us or request a demo or trial: name, email, phone, country, business type and their message.
Businesses using ClubWallet: account and representative data, business data (name, logo, card settings) and data needed to bill the service.
Businesses' end customers: name, phone, email (optional), stamp or point balance, earning and redemption history, and technical identifiers of the digital card and device needed to update it.
Technical data: IP address, browser and access time, used for security and to prevent form abuse.

3. Purposes and Legal Basis

Handling contact, demo and free trial requests, based on the consent of the person submitting them.
Providing the service to businesses (account, dashboard, cards, billing and support), based on the contract governed by the Terms and Conditions.
Issuing and updating loyalty cards for end customers in Apple Wallet or Google Wallet, on behalf of the business and with the consent given when enrolling.
Protecting the service against fraud, unauthorized access and automated submissions, as a legitimate security interest.

We do not sell personal data or use it for third-party advertising.

4. Data of Businesses' Customers

When a person joins a business's loyalty program, the business is the data controller and decides how the data is used within its program. PZ Producciones S.A. acts as data processor, processing the data only to provide ClubWallet to the business, following its instructions and the Terms and Conditions.

Requests to access, correct or delete this data can be sent to the business or to privacidad [at] clubwallet.biz; we will forward them to the business where appropriate.

5. Retention

Contact or demo requests: up to 24 months from the last interaction, unless you ask us to delete them earlier.
Business and end-customer data: while the business account is active. After cancellation, data is deleted after one (1) year.
Technical security data: the minimum time needed to prevent abuse, generally no longer than 30 days.
Where a legal obligation requires longer retention (e.g. accounting or tax), only the necessary data will be kept.

6. Providers and International Transfers

To operate ClubWallet we use the following providers, which may process data outside Costa Rica (mainly in the United States) with appropriate safeguards:

Namecheap (United States): website, database and email hosting.
Apple (Apple Wallet): issuing, storing on the device and updating cards on iPhone.
Google (Google Wallet): issuing and updating cards on Android.
Calendly (United States): demo scheduling, only if you choose to open the calendar and book a meeting.
Meta (Meta pixel): measuring our ads on Facebook and Instagram (visits and form submissions), only if you accept cookies.
Card payment processor: card payments for the plans. Card details are entered directly in the processor's secure form; ClubWallet never receives or stores them.

7. Cookies and Local Storage

Essential: the business dashboard session cookie and the one that remembers your cookie choice. They do not require consent because they are needed for the website to work.
Third-party (Calendly): the Calendly calendar only loads when you click "Book a demo" and may set its own cookies.
Advertising (Meta pixel): only if you click "Accept" in the cookie notice. It measures visits and whether a form was submitted, so we know which ads work. If you reject, it is not loaded.

You can accept or reject non-essential cookies in the notice shown when you visit the site, and delete cookies in your browser settings.

8. Your Rights as Data Subject

You may exercise your rights of access, rectification, deletion and objection at any time, and withdraw your consent, by writing to privacidad [at] clubwallet.biz with your request and a way to verify your identity. We will respond within the time limits set by Law No. 8968.

9. Minors

ClubWallet is not directed at minors. If a business enrolls a minor, the business is responsible for obtaining authorization from their legal representative.

10. Information Security

We apply reasonable technical and organizational measures: encrypted connections (HTTPS), credentials stored outside public folders, per-business access control and protection against automated submissions. No system is infallible; if we detect an incident affecting your data, we will act in accordance with applicable law.

11. Changes to this Policy

We may update this policy to reflect legal or service changes. The date of the last update appears at the end of this document.

12. Contact and Competent Authority

Privacy questions: privacidad [at] clubwallet.biz · Escazú, San José, Costa Rica.

If you believe the processing does not comply with the law, you may contact Costa Rica's Data Protection Agency (PRODHAB). Applicable framework: Law No. 8968 and its Regulations.