Overview 
At Extra360, your privacy is our priority. We are dedicated to safeguarding your personal information. This notice outlines how we collect, use, disclose, and store your data. We’ve designed it to be straightforward and user-friendly. If you have any questions or feedback, we’re here to help. 

1. Key Highlights: 
 

• For Merchants and Merchant Users: 
  The information we collect about merchants is primarily business-related, not personal. Any personal data we gather is used to better understand our merchants and enhance our services. 

 

• For Customers of Our Merchants: 
  We may collect your personal information when providing services to merchants, including those utilizing our loyalty programs. This data is processed on behalf of our merchants. We encourage you to review your merchant’s privacy policy and reach out to them with any inquiries or concerns. Additionally, we collect and manage personal data from customers using our services directly, such as creating or using the Extra360 wallet. 

 

• For Website and Support Service Users: 
  We collect personal information you provide directly, such as contact details, along with data gathered through cookies and similar technologies. This information helps us enhance your experience on our website and provide better support. 

2. Application of This Notice 

This notice applies to all personal data we collect, use, disclose, and store when you access our services, including but not limited to the Extra360 wallet, our loyalty programs, and any interactions on our website and mobile applications. When you create an Extra360 account, the data you provide will be covered by this notice, including any reward points information obtained from merchants. “Extra360” refers to Extra360 Technology Solutions Ltd. and its related companies worldwide. 

3. Exclusions: 

Merchants: We process personal information for merchants. Any complaints, questions, or requests about your data should be directed to them. If you are not satisfied with their response, you may contact us, but please note that we may not be able to resolve the issue. Without an Extra360 account, we do not control your reward points data. With an Extra360 account, both Extra360 and the relevant merchant manage copies of your reward points data. 

Non-Personal Information: Business-related information, including contact details, is generally not considered personal data. Anonymized data is also excluded. We may anonymize personal data, rendering it non-personal. 

In certain situations, we may rely on legal exemptions or other permissible conduct under applicable laws, including the collection, use, disclosure, or storage of personal data for purposes not outlined in this notice. We operate in multiple jurisdictions and may adopt privacy practices to comply with specific regional requirements. If you have questions about this notice, feel free to reach out. 

4. Changes to This Notice 

We may update this notice periodically to reflect changes in our privacy practices. We will notify you through a link to the new notice, by posting the updated notice on Extra360’s website, or by sending you a link via your provided contact details. Changes will take effect upon notification. Please check this notice regularly for updates. Continued use of Extra360’s services after notice constitutes acceptance of the changes. 

5. Processing of Personal Information 

Most personal data processed is essential for providing services and fulfilling contractual obligations. In other cases, we rely on legitimate interest, which may equate to “implied consent” in some regions or other legal exceptions. Specific purposes for processing personal data include: 

• Communication 

• Tracking and processing purchases 

• Administering, managing, testing, and improving services 

• Understanding services through reporting and analytics 

• Delivering content and information to third parties, including merchants and their customers 

• Marketing and advertising our services 

• Security purposes, such as detecting, preventing, and investigating potential fraud 
  In some instances, we may request your explicit consent to process your data, such as when you sign up as a merchant or user or create an Extra360 wallet. We may also anonymize data, making it non-personal, and use or disclose it for various purposes. 

6. Lawful Basis for Processing (GDPR Compliance)
 
We process personal data in accordance with the lawful bases established under applicable data protection laws, such as the General Data Protection Regulation (GDPR). These bases include, but are not limited to, contract performance, legitimate interests pursued by us or third parties, compliance with a legal obligation, consent, and vital interests of individuals. 

7. Data Subject Rights 

Depending on the applicable jurisdiction, you may have certain rights regarding your personal data, including the right to access, rectify, erase, restrict processing, object to processing, and the right to data portability. If you wish to exercise any of these rights or have any questions regarding your data, please contact our Privacy Officer at sh.support@extra360.io. We will process such requests in accordance with applicable laws. 

8. Category of Information Collected and Purposes 

• Communications: Information collected via email or other means (e.g., questions about merchants). 
  Purposes: To communicate with you and improve our services. 

• Preferences: Information about your favorite stores and budget. 
  Purposes: To tailor our services and offers to your preferences. 

• Contact Information: Name, email, mailing address, city, etc. 
  Purposes: To promote our services and communicate with you. 

• Transaction Information: Purchase orders and reward point earning events. 
  Purposes: To manage loyalty programs and display your reward points. 

• User Account Information: Name, contact details, account usage, passwords. 
  Purposes: For all purposes listed above. 

• Usage Information: Login times and account activities. 
  Purposes: To analyze user behavior and improve services. 

9. Payment Information 

We use third-party providers for payment processing and do not collect credit card or payment information directly. These providers manage this information according to their privacy policies. 

10. Sharing Your Personal Information 

We do not sell your personal information to third parties as defined under California law. “Sale” does not include situations where part or all of our business is acquired. 

11. Third-Party Sharing: 

We may share your information with: 

• Service Providers: For marketing, customer support, hosting, and analytics. 

• Merchants: For providing analytics and usage information. 

• Law Enforcement/Legal Requests: To comply with laws, enforce policies, or protect rights and safety. 

12. Data Transfers and Adequacy Decisions 

We may transfer personal information to third parties within and outside your country, including Canada and the USA. Where such transfers occur, we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) or Binding Corporate Rules (BCRs), as applicable. 

13. Tracking Technologies (Cookies, Web Beacons, etc.) 

We use cookies to enhance your experience on our website. This includes session cookies, which are deleted when you exit your browser, and stored cookies, which help us analyze usage and remember your preferences. 

• IP Addresses: We collect your IP address and browser type and retain this information for 24 months. 

• Web Beacons: We may use these in our emails to track engagement. 

• Do Not Track Signals: Currently, our website does not respond to DNT signals or other opt-out mechanisms. 

14. Exercising Your Rights to Your Information 

Depending on your location, you may have the right to access, correct, or erase your personal data. For inquiries regarding your data, please contact our Privacy Officer. Since merchants control much of the data processed by Extra360, we recommend reaching out directly to them for requests related to their data. 
For security, our Privacy Officer may need to verify your identity before processing requests. If we cannot fulfill your request promptly or must refuse it, we will provide reasons, subject to legal restrictions. 

15. Data Retention Periods 

We retain personal data only as long as necessary to fulfill the purposes for which it was collected and in accordance with our legal obligations, contractual requirements, and legitimate interests. Once no longer needed, data will be securely destroyed, erased, or anonymized. 

16. Securing Your Personal Information 

We implement physical, technical, and procedural safeguards appropriate to the sensitivity of your data to prevent loss, unauthorized access, or disclosure. However, no system is entirely secure, and we cannot guarantee complete security. 

17. Breach Notification Procedures 

In the event of a data breach involving your personal data, we will notify affected parties and relevant supervisory authorities as required by applicable data protection laws. 

18. Contacting You 

Extra360 may use your data to send promotional emails about our services. You can opt out at any time by contacting us or following the instructions in the emails. Once processed, you will no longer receive promotional emails unless you opt back in. 

19. Children’s Privacy 

We do not knowingly collect data from children under 13 without parental consent. If you believe we have collected such data, please contact us immediately. 

20. Contact Us 

If you have any concerns about this policy or believe we’ve breached it, please contact our Privacy Officer at sh.support@extra360.io. For privacy-related requests, including withdrawing consent or accessing records, reach out to us directly.