Privacy Notice

1. Who is responsible for your data

The controller of the personal data described in this notice is To be confirmed: registered legal name, a company incorporated in To be confirmed under company registration number To be confirmed, with its registered office at To be confirmed ("Chokla", "we", "us").

Where a brand club or merchant determines for itself why and how member data is used for its own programme, that club or merchant acts as a separate controller for those activities and its own privacy notice applies alongside this one. Chokla acts as a processor on their behalf for those activities and only on documented instructions.

2. What this notice covers

This notice applies when you:

• visit this corporate website at chokla.biz;
• create an account and use the Chokla mobile application;
• administer a club or merchant location through Chokla Office;
• contact us, apply for a role, or deal with us as a partner or supplier.

It does not cover third-party sites or apps we link to. Once you follow a link to a merchant's own site or app, that organisation's privacy notice governs what happens there.

3. Data we process

We collect only what a given function needs. Not every category applies to every person. A visitor to this website is covered by the first row alone.

What we do not collect

We do not collect special category data (health, biometric, religious or political data) and ask you not to send it to us. We do not track your precise device location in the background; where a feature needs location, it is requested in the moment and only for that purpose.

4. Why we process it, and on what lawful basis

Every use of personal data below rests on a specific lawful basis. Where the basis is consent, you may withdraw it at any time without affecting processing carried out before you did so.

Automated decision-making

Offer eligibility is evaluated automatically against the club's published rules: for example whether you hold the required tier. This is a mechanical application of stated terms and produces no legal or similarly significant effect on you. We do not carry out profiling that has such an effect, and we do not sell personal data.

5. Cookies and device storage

This website uses browser storage rather than tracking cookies for its own functions. Nothing beyond the strictly necessary category is written or activated before you have made a choice, and you can change that choice at any time.

Most browsers also let you block or clear storage directly. Blocking the strictly necessary category will stop parts of this site from working.

6. Who we share data with

We share personal data only where there is a reason to, and only as far as that reason requires:

• Brand clubs and merchants. When you join a club or redeem an offer, the relevant club and the redeeming merchant receive what they need to honour and reconcile it: typically your membership identifier, tier, and the offer and redemption details. They do not receive your full contact record unless you ask us to share it.
• Service providers acting on our instructions. Cloud hosting and database services, email and notification delivery, payment processing, error monitoring and customer support tooling. Each is bound by a written contract that limits them to our instructions and requires appropriate security.
• Professional advisers (auditors, accountants and lawyers), under a duty of confidentiality.
• Authorities, where we are legally required to disclose, or where disclosure is necessary to establish, exercise or defend legal claims. We satisfy ourselves that a request is valid before responding.
• A successor entity, if the business or part of it is reorganised, merged or sold. Any successor remains bound by this notice until you are told otherwise.

We do not sell personal data, and we do not share it with third parties for their own independent marketing.

7. International transfers

Chokla operates on cloud infrastructure that may place data in a country other than the one you live in. Where personal data leaves its country of origin, we rely on a lawful transfer mechanism: an adequacy decision covering the destination, or Standard Contractual Clauses with the recipient together with an assessment of the safeguards actually available there.

Primary hosting region: To be confirmed. You can request a copy of the safeguards applied to a specific transfer by writing to support@chokla.biz.

8. How long we keep it

We keep personal data for as long as it serves the purpose it was collected for, then delete or irreversibly anonymise it. Where a legal retention period applies, that period governs.

9. How we protect it

The measures below are in force across the platform:

• Data is encrypted in transit with TLS, and at rest in our managed databases and object storage.
• Passwords are never stored in a readable form, only as a salted hash.
• Access is granted on a least-privilege basis and reviewed; administrative access is logged.
• Application secrets and keys live in a managed parameter store, never in source control, and can be rotated without redeployment.
• Services are isolated by network boundary; only a small, authenticated public surface is reachable from the internet.
• Inputs are validated at every entry point, database access is parameterised, and rate limiting protects against abuse.
• Development, staging and production are fully separated, and changes ship through automated pipelines with health checks.

No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours of becoming aware of it, and notify you directly without undue delay where the risk is high.

10. Your rights

Depending on where you live, you hold some or all of the following rights over your personal data:

• Access: a copy of the personal data we hold about you, and confirmation of how it is used.
• Rectification: correction of anything inaccurate or incomplete. Most account fields you can correct yourself in the app.
• Erasure: deletion, where we no longer need the data and no legal obligation requires us to keep it. You can request this yourself at any time from Delete your account.
• Restriction: a pause on processing while an accuracy or objection question is resolved.
• Portability: the data you gave us, in a structured, commonly used, machine-readable format.
• Objection: to processing based on legitimate interests, and at any time and absolutely to direct marketing.
• Withdraw consent: at any time, where consent is the basis, without affecting what was lawful beforehand.
• Complain: to the data protection authority in your country of residence or place of work.

How to exercise them

Write to support@chokla.biz from the email address on your account, or use the account settings in the Chokla app. We respond within one month; if a request is complex we may extend by a further two months and will tell you why within the first month. There is no charge unless a request is manifestly unfounded or excessive.

We may need to verify your identity before acting, so that we do not disclose your data to someone else. Any information asked for in that step is used only to verify the request.

11. Children

Chokla is not directed at children. Accounts require you to be at least 16 years old, or older where local law sets a higher age for the services you use. We do not knowingly collect data from children below that age; if we learn we have, we delete it promptly. A parent or guardian who believes a child has provided us with data should contact support@chokla.biz.

12. Changes to this notice

This notice is versioned and dated at the top of the page. When it changes we publish the new version here and move the version number. For changes that materially affect how your data is used we give notice in the app or by email before the change takes effect, and where the change relies on consent we ask again. An agreement recorded against older wording does not carry forward.

Previous versions are available on request from support@chokla.biz.

13. How to contact us

Full registered entity details are published under Contact.