Legal
Privacy policy.
How we handle information about website visitors, business contacts and people using Stamp loyalty cards.
On this page
Before the customer service opens
Stamp is being prepared for launch and is not yet handling live merchant or loyalty member data. The public website and enquiries are covered by this notice now. References to subscriptions, merchant accounts and loyalty cards describe the planned service.
Before customer registration opens, we will publish the configured processing countries and applicable transfer safeguards and put the merchant data processing agreement in place. The retention periods below are the policy to be implemented for launch.
1. Who is responsible
LagiSolutions GmbH is responsible for personal data processed to run this website, answer enquiries and administer its business relationships. You can contact us about privacy at support@stamprewards.ch or at the postal address below.
- Registered name
- LagiSolutions GmbH
- Commercial register number (UID)
- CHE 289.461.929
- Address
- Loorenstrasse 33a, 8305 Dietlikon, CH
- Responsible persons
- Markus Lagler, Bea Lagler
- Issuing date
- August 15, 2025
For a merchant’s loyalty programme, the merchant decides why its customers’ data is processed and is the controller. Stamp processes that loyalty data on the merchant’s instructions. The merchant’s own privacy notice and our data processing agreement govern that relationship.
2. Information we process
- Website visits: requested pages, request time, IP address and browser or device information needed to deliver the website, diagnose errors and protect it from abuse.
- Enquiries: the name, email address, phone number, message and attachments you choose to send us, together with our replies.
- Merchant accounts: business and contact details, authorised team members, account access information, subscription status, invoices and payment references.
- Loyalty programmes: card and membership identifiers, stamp and redemption records, and technical identifiers needed to deliver and update a Wallet pass. A customer name or recovery email is optional where the programme offers it.
Information comes from you, your authorised team, the merchant whose programme you join, the device requesting the service and the service providers involved in a payment or Wallet update. Please do not send sensitive personal information that is unnecessary for your request.
3. Why we use information
We use information to respond to enquiries, provide and secure Stamp, manage access, administer subscriptions and payments, keep required business records and handle legal claims. We process loyalty data to carry out the merchant’s instructions, including recording visits and fulfilling reward redemptions.
Swiss data protection law applies. Where the GDPR also applies, our grounds are steps requested before a contract and performance of a contract, compliance with legal duties, and legitimate interests in operating and protecting the service and handling business correspondence. Where consent is required, we ask for it; you may withdraw it for the future.
4. Website analytics and cookies
This website uses Vercel Web Analytics to understand aggregate traffic. The statistics include page addresses, referrers, approximate location, browser and device type. Vercel uses a request-derived visitor identifier that is discarded after 24 hours; this is not a promise that all aggregate statistics are deleted after 24 hours.
Vercel Web Analytics does not use analytics cookies. We do not add advertising trackers to this website. The account service may use essential session technology for sign-in and security; it is separate from public website analytics. Fonts are served with the website, so loading them does not require a request from your browser to Google Fonts.
5. Who receives information
Access is limited to people and service providers who need information for the purposes described here, as well as recipients where disclosure is legally required or necessary to establish or defend a legal claim.
- Vercel provides the public website infrastructure and website analytics.
- Zoho Mail handles business email correspondence.
- For the planned customer service, Vercel will host the dashboard, Render will run the application API and worker, and Supabase will provide the database. Any authentication or storage services enabled with those providers must also be recorded in the processing agreement.
- Stripe is the selected subscription payment provider. Once purchases open, payment details entered into its checkout will be handled by Stripe; Stamp will use the payment and subscription references needed to administer your account.
- Apple and Google process information when you choose to add or use a card in their Wallet platforms. Their own privacy terms apply to their platforms.
Hosting and other providers supporting a merchant’s loyalty data must be covered by the applicable data processing agreement. That agreement must identify the authorised processing arrangements before customer data is entrusted to the service.
6. Processing outside Switzerland
Using an international provider can involve processing outside Switzerland. Vercel’s services involve processing in the United States and locations used by its service providers. The customer service’s production regions have not yet been configured. We therefore do not claim that merchant data is stored in Switzerland or in any other selected region. A specific list of storage, backup and remote-access countries will be provided before live customer processing begins. The location of business email also needs to be verified against the Zoho account configuration.
A transfer must have a permitted basis under applicable data protection law, such as an adequate level of protection or appropriate contractual safeguards, including recognised standard contractual clauses with Swiss adaptations where needed. Contact us for information about a specific recipient, destination country or applicable safeguard.
7. Retention, deletion and security
Our planned retention schedule is set out below. These are operating limits to configure and verify before launch, rather than a statement that automated deletion already runs. Information is deleted or irreversibly anonymised when its purpose ends, subject to the stated limits and narrow legal exceptions.
- Account and loyalty data: remove from active systems within 30 days after a verified deletion instruction from an authorised merchant. An earlier lawful instruction or statutory deadline takes precedence.
- Backups: expire remaining copies within a further 30 days after active-system deletion, so no later than 60 days after the verified request. During this period backups are restricted to recovery; any restoration must reapply deletions before ordinary use resumes.
- Routine operational and security logs: no more than 30 days from collection. Records needed to investigate a specific incident are separated and reviewed until that purpose ends.
- Support correspondence: no more than 24 months after the enquiry is resolved. Relevant contract, invoice or dispute evidence may be retained separately when needed for a legal obligation or claim.
- Accounting records: generally ten years from the end of the relevant financial year, as required by Swiss law. This does not justify keeping unrelated loyalty profiles for ten years.
Cancelling a subscription is different from deleting an account. While a merchant keeps its programme open for outstanding reward redemptions, necessary loyalty records remain under its instructions. We will review inactive accounts at least annually with the merchant and arrange closure when there is no remaining purpose. Outstanding rewards do not override a valid deletion instruction. Before deletion, the merchant should arrange an export and tell customers how rewards will be honoured outside Stamp.
A legal hold must identify the specific records, reason and review date. Only those records may be retained beyond the normal period, with restricted access, until the obligation or claim no longer requires them. The retention period for website analytics statistics depends on the selected Vercel plan; the 24-hour visitor identifier lifetime is separate.
We must use technical and organisational measures appropriate to the processing risk, including restricting access and protecting data in transmission. No internet service or email channel can guarantee absolute security. Contact us if you believe your account or personal data has been exposed.
8. Your rights and how to use them
Depending on the applicable law and circumstances, you may request access to your personal data, correction, deletion, restriction of processing or a portable copy. You may object to processing based on legitimate interests and withdraw consent for future processing. Legal retention duties or the rights of others may limit a request.
Send your request to the contact below and describe your relationship with Stamp. We may ask for information needed to verify your identity and authority. Access requests are generally answered free of charge within 30 days under Swiss law; we will explain any applicable exception or extension.
For a shop’s loyalty programme, contact that shop first because it is responsible for its customer data. We assist the merchant with requests concerning the information we process on its behalf. You may also raise a concern with the Swiss Federal Data Protection and Information Commissioner, or with the competent supervisory authority where the GDPR applies.
- Phone
- +41 (0)79 411 83 05
9. Changes to this policy
We update this policy when the service or its data processing changes. The date above identifies the current text. We will provide additional information and obtain consent before a new use where the law requires it. A website visit does not by itself constitute consent to processing that requires your permission.