DV8 Rewards
Privacy policy
This policy explains how we collect, use, share and protect your personal data when you use the DV8 Rewards app on iPhone or Android, the DV8 Rewards web pages, and the DV8 Rewards loyalty scheme. Please read it together with our terms and conditions.
1. Who we are
DV8 Rewards is run by DV8 Bar, trading as DV8 Congleton ("DV8", "we", "us", "our"). We are the controller of the personal data described in this policy.
- Address: 6 Little Street, Congleton, Cheshire, CW12 1AR
- Email: info@dv8bar.co.uk
- Phone: 01260 278553
- Company number: [Company number to be added]
- ICO registration number: [ICO registration number to be added]
We have not appointed a Data Protection Officer because we are not required to. Please send any privacy question to the email address above.
2. What we collect, why, and our lawful basis
The table below lists the personal data we hold, what we use it for and the lawful basis we rely on under the UK General Data Protection Regulation (UK GDPR). "Contract" means we need the data to provide the loyalty scheme you signed up to under our terms.
| Data | What we use it for | Lawful basis |
|---|---|---|
| Name and email address | Creating and running your account, signing you in, verifying your email address, password resets and other account emails, showing your first name to staff so they can check it is you. | Contract |
| Mobile number, with country code | Identifying your account, and letting staff confirm it is you (they see only the last 3 digits) before any reward, free coffee, offer or prize is redeemed. Helping us prevent duplicate accounts and fraud. | Contract; legitimate interests (preventing fraud) |
| Date of birth | Checking you are 18 or over before you can join, because DV8 is a licensed venue. If you have agreed to receive offers, we also use your birthday month to send you a birthday offer. | Legitimate interests (making sure the scheme is only used by adults); consent for birthday offers |
| Company or employer name (optional) | Only if you choose to give it: inviting you to events or offers for groups from your workplace. Used for promotions only if you have agreed to receive offers. | Legitimate interests; consent for any promotion based on it |
| Password (stored only as a one way hash) and passkeys | Keeping your account secure. If you set up a passkey (sign in with Face ID, Touch ID, fingerprint or your device lock), we store only a public key and an identifier for it. Your fingerprint or face data never leaves your device and we never receive it. | Contract |
| Membership card code and referral code | Your card code is the QR code staff scan to find your account. Your referral code is the separate code you share with friends. | Contract |
| Points, VIP tier, transactions, visits and receipt items | Running the scheme: adding and taking away points, expiring points after 12 months, working out your VIP tier, recording rewards, free coffees, offers and prizes you use, showing your history, and stopping the same receipt being claimed twice. Receipt items are the dishes and drinks we read from your receipt, with the date, time and total. We also record which member of staff made each change. | Contract; legal obligation (keeping accounting records); legitimate interests (preventing fraud) |
| Coffee card stamps | Tracking your stamps and your free coffees. | Contract |
| Dish ratings and comments | Letting you rate dishes from your visits and earn points for doing so, and helping us improve our food and drink. Ratings and comments are seen only by our managers. We never publish them. | Contract (earning rating points); legitimate interests (improving our menu) |
| Bonus Wheel spins and prizes | Running the weekly free prize draw, crediting your prize and making sure each verified account spins only once a week. | Contract |
| News hearts, comments, reports and blocks | Showing which posts you hearted, showing your comments to other members with your first name and last initial, and handling reports and blocks so comments stay friendly. Deleting your account deletes your comments and hearts. | Contract; legitimate interests (keeping comments safe) |
| Gift cards | If you buy a gift card: the amount, design and message, and the name and email address of the person you are sending it to, so we can email them their gift and send you a receipt. If you receive one: which account added it and what has been spent. We do not receive or store your card number; Dojo handles the payment. | Contract; legitimate interests (delivering a gift to the person you chose, preventing fraud) |
| Referral relationships | Recording who referred whom so both of you get referral points after the friend's first qualifying visit, and checking for self referral or fraud. | Contract; legitimate interests (preventing fraud) |
| Push notification tokens | An identifier for your device that lets us send notifications to it, for example "your points have landed" or "your free coffee is ready", and offers or invites if you have agreed to them. You can turn notifications off in your device settings at any time. | Contract (service messages); consent (promotional messages) |
| Marketing choice, and records of your agreement to our policies | Remembering whether you want offers and invites, and when you said yes or no. Recording when you accepted this privacy policy and our terms, and which version, so we can show we have your agreement. | Legal obligation (showing we have consent under UK GDPR and the Privacy and Electronic Communications Regulations); legitimate interests |
| Wallet pass details | If you add your card to Apple Wallet or Google Wallet, the pass shows your name, card code, points and VIP tier, and we keep it up to date. We store a token that lets your Wallet fetch updates. | Contract (at your request) |
| Crash reports (Android app) | If the Android app crashes, Firebase Crashlytics sends us a crash report with technical details about your device and the app, and your internal account number (not your name or email) so we can find and fix the problem. | Legitimate interests (keeping the app working) |
| Technical and security logs | Our servers record technical information such as IP address, time and the request made, to keep the service secure, limit abuse (for example repeated wrong passwords) and fix faults. | Legitimate interests (security) |
| Messages you send us | Answering your questions and requests, including requests about your rights. | Legitimate interests; legal obligation (when you exercise a legal right) |
Where we rely on legitimate interests, we have balanced our interests against yours. You can ask us for more detail, and you have the right to object (see section 10).
You must give us your name, email, mobile number and date of birth to join, because we cannot run your account or check your age without them. Everything else is optional or created as you use the scheme.
3. Receipt scanning
When you visit, a member of staff scans your card and takes a photo of your till receipt on a DV8 staff device. That photo is sent securely through our server to Google Cloud Vision, a text recognition service, which reads the text and sends it back. Our app then picks out the total, date, time and items, and the member of staff checks them before your points are added.
We do not keep the receipt photo. It is not saved on our server or in our database. We keep only the details read from it (date, time, total and items). Staff never photograph you, only the receipt.
4. Marketing and tailored offers
We only send you offers, promotions and event invites, by push notification or email, if you have ticked "Send me offers and invites" when you joined or turned on marketing in My Profile. Promotional messages are only ever sent to customers who have opted in.
Service messages about your own account, such as points being added, your free coffee being ready, password resets, email verification and changes to our terms, are sent to everyone because they are part of running your account. They do not contain promotions.
Tailored offers. If you have opted in to marketing, we may use your visit and order history, VIP tier, birthday month and (if given) company name to choose which offers to send you, for example an offer on a dish you often order. This is a simple form of profiling. It does not produce any legal or similarly significant effect on you, and we never do it if you have not opted in.
Changing your mind. You can switch marketing off at any time with the marketing preferences toggle in My Profile, by using the unsubscribe link in any marketing email, or by contacting us. This does not affect any reward already in your account.
5. Age restriction
DV8 Rewards is only for people aged 18 or over. We ask for your date of birth when you join and do not create an account for anyone under 18. If we learn that an account belongs to someone under 18, we will close it and delete their personal data.
6. Who we share your data with
We do not sell your personal data and we do not share it with advertisers. We use the following service providers (processors), who handle data only on our instructions and under a contract with us:
| Provider | What they do for us | Where data is processed |
|---|---|---|
| Railway | Hosts our server and database. | European Union (Netherlands data centre, europe-west4). Railway is a US company and its staff may access data for support. |
| Backblaze (B2 Cloud Storage) | Stores encrypted backup copies of our database. | United States |
| Dojo (Paymentsense Limited) | Takes card payments for gift cards bought in the app. | United Kingdom and European Economic Area |
| Resend | Sends our emails, such as email verification, password resets and, if you opted in, marketing emails. | United States |
| Google Cloud Vision (Google) | Reads the text on receipt photos taken by staff. | United States and other Google locations |
| Firebase Cloud Messaging and Firebase Crashlytics (Google) | Delivers notifications to Android devices and collects Android crash reports. | United States and other Google locations |
| Apple Push Notification service (Apple) | Delivers notifications to iPhones, and updates to Apple Wallet passes. | United States |
| Browser push services | If you use our web pages and allow notifications, your browser maker's push service (for example Google, Mozilla, Apple or Microsoft) delivers them. | Depends on your browser, often the United States |
Other organisations you choose to use. Some features involve companies that act for themselves under their own privacy policies, not as our processors:
- Apple Wallet and Google Wallet. If you add your card to a Wallet, the pass (your name, card code, points and VIP tier) is held on your device and, for Google Wallet, on Google's servers. See Apple's and Google's privacy policies.
- DesignMyNight. The Book tab shows DesignMyNight's table booking widget. Booking details you enter there go to DesignMyNight and to us as the venue, under DesignMyNight's privacy policy.
- App stores. Apple and Google handle your app download and any crash or usage data you agree to share with them through your device settings.
We may also share data where the law requires it, with the police or other authorities to prevent or detect crime or fraud, with our professional advisers, or with a buyer if our business is sold (they would have to respect this policy).
7. International transfers
Some of our providers process data outside the UK. When they do, we make sure your data is protected to UK standards in one of these ways:
- Adequacy. The UK recognises the European Economic Area as giving adequate protection, so data hosted by Railway in the Netherlands is covered by UK adequacy regulations.
- UK-US data bridge. Where a US provider is certified under the UK Extension to the EU-US Data Privacy Framework, we rely on UK adequacy regulations for that provider.
- Contract safeguards. Otherwise we rely on the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses, built into the provider's data processing terms, together with a transfer risk assessment.
You can ask us for more information about the safeguards for any provider using the contact details in section 13.
8. Cookies and storage on your device
We do not use advertising cookies, analytics cookies or any tracking across other apps or websites.
The apps and our web pages store a small amount of information on your device that is strictly necessary to provide the service you asked for. Under the Privacy and Electronic Communications Regulations this does not need your consent. It includes:
- your sign-in token, so you stay signed in (held in your device's secure storage in the apps, and in your browser's local storage on our web pages);
- a copy of your card and recent account details, so your card still shows without signal;
- staff actions waiting to be sent when signal returns (staff devices only);
- small settings such as which pop-ups you have already seen.
This information is removed when you sign out or delete the app.
Booking widget. The Book tab and our booking page load DesignMyNight's booking widget, which may set its own cookies or use similar storage on your device. These are controlled by DesignMyNight, not by us. See DesignMyNight's cookie policy for details. In the iPhone app the booking page runs in a temporary browsing session that is cleared when you leave it.
9. How long we keep your data
- Your account: for as long as your account is open.
- Points: each batch of points expires 12 months after the date it was added. The record that they were added and expired stays in your history.
- Inactive accounts: if there has been no sign-in, visit or other activity on your account for 3 years, we will close it and anonymise it in the same way as a deleted account.
- Deleted accounts: when you delete your account, we immediately remove or overwrite your name, email, mobile number, date of birth, company, password, card and referral codes, referral links, rating comments, push tokens, passkeys and Wallet links. We keep your points, visit and transaction history and star ratings in anonymised form, which can no longer be linked to you, for up to 6 years for accounting and tax purposes.
- Backups: encrypted database backups are kept for 30 days and then deleted. Data you delete will therefore disappear from backups within 30 days.
- Receipt photos: not stored by us at all (see section 3).
- Crash reports: kept by Firebase Crashlytics for up to 90 days.
- Server logs: kept by our hosting provider for a short period, normally no more than 30 days.
- Password reset and email verification links: expire after a short time and are deleted.
- Emails you send us: for as long as we need them to deal with your request, and normally no more than 2 years.
10. Your rights
Under UK data protection law you have these rights. Many of them you can use yourself in the app:
- Access and portability: get a copy of your data. Use "Download my data" in My Profile to download it in a machine readable format, or ask us.
- Rectification: correct inaccurate data. You can change your email and mobile number in My Profile. To correct your name or date of birth, contact us.
- Erasure: delete your account and personal data. Use "Delete account" in My Profile, or the web form at loyalty.dv8bar.co.uk/delete-account, or contact us. Unused points, rewards and prizes are lost when you delete your account.
- Object to marketing: you can stop marketing at any time with the marketing toggle in My Profile. This includes the profiling described in section 4.
- Object to other processing based on legitimate interests, and restrict how we use your data in some circumstances.
- Withdraw consent at any time, without affecting what we did before.
To use a right that is not in the app, contact us using the details below. We may need to confirm your identity. We will reply within one month, and there is normally no charge.
We do not make any decision about you based only on automated processing that has a legal or similarly significant effect on you. Bonus Wheel prizes are chosen at random.
11. Security
Passwords are stored only as a one way hash that cannot be turned back into your password. All connections between the apps and our server are encrypted. Staff see only what they need to serve you: your first name, the last 3 digits of your mobile number, points, tier and rewards. Access to the full customer list is limited to managers and admins, and backups are encrypted. No system is perfectly secure, but if a breach affecting your data happens we will tell you and the Information Commissioner's Office where the law requires.
12. Changes to this policy
We may update this policy, for example when we add a feature. We will change the effective date and version at the top, and if the change is significant we will tell you in the app or by email before it takes effect.
13. Contact us and complaints
DV8 Bar, trading as DV8 Congleton
6 Little Street, Congleton, Cheshire, CW12 1AR
Email: info@dv8bar.co.uk
Phone: 01260 278553
If you are unhappy with how we have handled your data, please tell us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint, telephone 0303 123 1113, or write to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.