Global Privacy Policy

IGC LOYALTY APPLICATION, WEBSITE AND DASHBOARD

Effective Date: 20th December 2025
Last Updated: 16th July 2026

This Global Privacy Policy explains how IGC Marketing, trading as IGC Loyalty, together with its related entities, authorised licensees and service operators where applicable (“IGC”, “we”, “us” or “our”), collects, uses, stores, protects, discloses and otherwise processes personal information.

This Privacy Policy applies to:

1. the IGC Loyalty mobile application and any white-label or licensed version of it;

2. the IGC Loyalty website and related websites;

3. the IGC Loyalty administrative dashboard, affiliate dashboard, merchant portal and campaign-management systems;

4. augmented-reality, location-based, navigation-assistance, loyalty, promotional, marketplace and point-exchange functions;

5. customer service, marketing, demonstrations, testing and business communications; and

6. any related products, platforms, application programming interfaces, software development kits or services that link to this Privacy Policy.

Together, these are referred to as the “Services”.

By accessing or using the Services, you acknowledge that you have read this Privacy Policy. Where consent is required by law, we will request it separately and you may withdraw it as described below.

This Privacy Policy does not override any mandatory privacy rights available under applicable law.

1. WHO CONTROLS YOUR INFORMATION

Unless another entity is identified when your information is collected, the controller, business or responsible organisation for your personal information is:

[IGC Marketing Pty Ltd]
Trading name: IGC Loyalty
Country of registration: Australia
General contact: Via our website IGCloyalty.com

Some campaigns may be offered for, or jointly operated with, a retailer, shopping centre, tourism body, government authority, museum, event operator, franchise, advertiser, licensee, distributor or other organisation.

Depending on the campaign and applicable law:

1. IGC may act as the independent controller of information relating to accounts, application security, platform administration and general service operation;

2. IGC and the campaign operator may act as separate or joint controllers for campaign information; or

3. IGC may process information on behalf of the campaign operator as its service provider or processor.

The relevant campaign notice, sign-up page or collection notice may identify additional responsible organisations.

2. INFORMATION WE MAY COLLECT

The information collected depends on how you use the Services, your device settings, the permissions you grant and the campaign in which you participate.

2.1 Account and identity information

We may collect:

1. name, username, account identifier and avatar;

2. email address, telephone number and country;

3. date of birth or age-range confirmation where necessary;

4. password or encrypted authentication credentials;

5. promotional, affiliate, referral or invitation codes;

6. language and communication preferences;

7. account status, login history and verification information; and

8. information supplied through Google, Apple or another authorised login provider.

We do not receive your full password from an external login provider.

2.2 Precise and approximate location information

Because the Services may provide location-based campaigns, clues, rewards, augmented-reality experiences or navigation assistance, we may collect or infer:

1. precise or approximate GPS location;

2. latitude, longitude and altitude;

3. indoor or outdoor location estimates;

4. proximity to campaign locations, participating premises, points of interest or safety zones;

5. movement direction, speed, route progress and arrival status;

6. entry into or departure from a geofenced area;

7. floor or building-level estimates;

8. location timestamps and location accuracy measurements; and

9. location permission and service status.

Location information may be collected while the application is open. Background location will only be collected where the feature requires it, the operating system permits it and the user has granted the relevant permission.

Location technologies are not perfectly accurate. Location readings may be delayed, incorrect, incomplete or affected by buildings, weather, device quality, network conditions, interference, calibration or other environmental factors.

2.3 Device, motion and sensor information

Where enabled and supported, we may process information from:

1. accelerometers;

2. gyroscopes;

3. magnetometers and digital compasses;

4. barometers and atmospheric-pressure sensors;

5. pedometers and step counters;

6. orientation and heading sensors;

7. Bluetooth or nearby-device status;

8. camera and augmented-reality functions;

9. device motion and movement classifications;

10. network, Wi-Fi and connectivity information; and

11. other device sensors reasonably required to provide a requested feature.

Sensor information may be used to estimate direction, movement, floor changes, stairs, lifts, escalators, indoor position or route progress. It may be inaccurate and must not be treated as guaranteed navigation or safety information.

2.4 Camera, image and augmented-reality information

Where you grant camera access, the application may use the camera to:

1. display augmented-reality objects or promotional content;

2. scan QR codes, signs, campaign markers or objects;

3. recognise text or environmental anchors;

4. validate participation in a campaign;

5. support positioning or route correction; and

6. allow you to upload an image or profile picture.

Camera frames used for local augmented-reality functions may be processed temporarily on the device and may not be transmitted to us unless required for a feature, submitted by you, needed for fraud prevention or clearly disclosed at the point of collection.

You must not intentionally capture or upload another person’s image, private information, identification document or confidential material without lawful authority.

2.5 Loyalty, reward and marketplace information

We may collect:

1. points collected, transferred, redeemed, cancelled or expired;

2. digital items, rewards, vouchers and promotional codes;

3. campaign participation and completion records;

4. reward eligibility and prize information;

5. marketplace activity;

6. merchant and redemption records;

7. purchase, refund and chargeback status;

8. wallet identifiers or transaction references; and

9. anti-fraud and verification records.

Payment card details are normally processed by the relevant payment provider. We may receive a limited transaction record, such as payment status, amount, currency, payment reference and partial card information.

2.6 Usage and technical information

We may automatically collect:

1. IP address;

2. device identifiers and advertising identifiers where permitted;

3. device model, manufacturer and operating system;

4. application version and language;

5. browser type;

6. session, screen-view and feature-interaction information;

7. referral source;

8. crash reports, diagnostic logs and performance information;

9. timestamps and authentication events;

10. cookie and similar-technology information;

11. security, fraud and abuse indicators; and

12. aggregated or statistical activity information.

2.7 Dashboard and business-user information

For merchants, administrators, affiliates, licensees, agencies, campaign managers and other dashboard users, we may collect:

1. business name, role and job title;

2. business email address and telephone number;

3. account permissions and access level;

4. organisation, branch, campaign or territory assignment;

5. campaign settings, locations, clues, media and reward rules;

6. affiliate and commission information;

7. payment and tax information where required;

8. dashboard access and audit logs;

9. support communications and instructions;

10. documents submitted for business verification; and

11. actions taken within the dashboard.

2.8 Communications and support information

We may collect information you send through:

1. email;

2. in-app support;

3. website forms;

4. surveys;

5. social media;

6. telephone calls;

7. demonstrations, meetings and trade events; and

8. complaints, privacy requests or dispute processes.

Calls or demonstrations may only be recorded where lawful and appropriate notice is provided.

2.9 Information from third parties

We may receive information from:

1. login providers;

2. campaign partners and participating merchants;

3. payment providers;

4. analytics and advertising providers;

5. application stores;

6. fraud-prevention and cybersecurity providers;

7. affiliates and referral partners;

8. business customers and licensees;

9. public databases; and

10. government or law-enforcement authorities where lawful.

A business customer must have a lawful basis and all required permissions before entering, uploading or disclosing personal information through the dashboard.

2.10 Sensitive information

We do not intentionally request health, biometric, racial, religious, political, sexual-orientation, criminal-record or other legally sensitive information unless:

1. it is strictly necessary for a disclosed feature;

2. collection is lawful;

3. appropriate consent or another lawful basis has been established; and

4. enhanced safeguards are applied.

Users and dashboard operators must not upload sensitive information unless expressly authorised by IGC and legally permitted.

3. HOW WE USE INFORMATION

We may use personal information to:

1. create, authenticate and administer accounts;

2. provide location-based, augmented-reality and loyalty functions;

3. display nearby clues, offers, campaigns, rewards and participating locations;

4. estimate route progress, heading, floor level and proximity;

5. process points, rewards, vouchers, referrals and redemptions;

6. operate marketplace and promotional functions;

7. personalise language, content and application settings;

8. provide customer and technical support;

9. communicate service, account, security and campaign information;

10. administer competitions, promotions and reward eligibility;

11. manage merchants, dashboard users, affiliates, campaigns and permissions;

12. process payments, commissions, refunds and financial reconciliation;

13. maintain audit trails and business records;

14. analyse performance, usage and campaign effectiveness;

15. identify faults and improve accuracy, reliability and usability;

16. protect users, businesses, IGC and the public from fraud, abuse, cheating, spoofing, bots and unauthorised access;

17. enforce our Terms and Conditions and other agreements;

18. investigate suspected misconduct, complaints or security incidents;

19. comply with laws, court orders and lawful government requests;

20. establish, exercise or defend legal claims;

21. complete corporate transactions, audits, insurance or due diligence; and

22. perform other purposes disclosed when the information is collected.

We may combine information collected through different parts of the Services where lawful and reasonably necessary for these purposes.

4. LOCATION AND SAFETY DATA

The Services may process location and sensor information to support navigation assistance, augmented-reality experiences, geofencing, floor estimation, rewards and safety-related notifications.

However:

1. the Services are not an emergency service;

2. the Services are not a certified navigation, evacuation, traffic, aviation, maritime, medical or personal-safety system;

3. location, direction, floor and hazard information may be inaccurate, delayed, unavailable or incomplete;

4. a warning not appearing does not mean that an area is safe;

5. a warning appearing does not mean that the danger has been independently verified; and

6. users must remain aware of roads, vehicles, water, cliffs, stairs, escalators, lifts, platforms, balconies, windows, glass doors, glass barriers, construction, private property, restricted areas and all other surrounding conditions.

Location and sensor information may be retained where reasonably necessary to validate rewards, prevent fraud, investigate an incident, analyse application accuracy or maintain legal records.

Where feasible, analytics are aggregated, de-identified, truncated or otherwise reduced.

5. LEGAL BASES FOR PROCESSING

Where applicable law requires us to identify a legal basis, we rely on one or more of the following:

5.1 Contract

Processing may be necessary to provide the Services, administer an account, process rewards, fulfil campaign rules or perform an agreement with a user or business customer.

5.2 Consent

We may rely on consent for precise location, background location, camera access, certain communications, advertising technologies, sensitive information or other activities where consent is legally required.

Consent may be withdrawn through device settings, account settings or by contacting us. Withdrawal does not affect processing already lawfully performed.

5.3 Legitimate interests

We may process information for legitimate interests including:

1. operating and improving the Services;

2. protecting accounts and systems;

3. preventing fraud, cheating and misuse;

4. understanding campaign performance;

5. communicating with business customers;

6. maintaining records;

7. enforcing agreements; and

8. protecting legal rights.

We balance these interests against the rights and reasonable expectations of affected individuals.

5.4 Legal obligation

We may process information to comply with taxation, accounting, consumer, privacy, anti-fraud, sanctions, court, regulatory and law-enforcement obligations.

5.5 Vital interests and public interest

In limited circumstances, information may be processed or disclosed to protect a person’s life, health or physical safety, or for another substantial public interest permitted by law.

6. PERMISSIONS AND USER CONTROLS

Depending on the device and feature, the Services may request permission to access:

1. precise or approximate location;

2. background location;

3. camera;

4. motion, activity and fitness information;

5. notifications;

6. photos or stored files;

7. Bluetooth or nearby devices; and

8. microphone, only where a voice-enabled feature requires it.

You may manage permissions through your device settings. Refusing or withdrawing a permission may prevent the relevant feature from operating correctly.

Turning off a permission does not automatically delete information previously collected. A separate deletion request may be required.

7. COOKIES, ANALYTICS AND SIMILAR TECHNOLOGIES

Our websites, dashboard and Services may use cookies, software development kits, pixels, local storage, device identifiers and similar technologies to:

1. maintain sessions;

2. remember settings;

3. secure accounts;

4. diagnose faults;

5. measure usage and campaign performance;

6. prevent fraud;

7. deliver content; and

8. support advertising where legally permitted.

Where required, non-essential cookies and technologies will not be activated until consent is obtained.

You may manage available controls through the cookie banner, application settings, device settings or browser controls. Blocking some technologies may affect functionality.

8. ADVERTISING AND MARKETING

We may use contact and usage information to send service updates, offers, campaign announcements or business communications where permitted.

You may unsubscribe from promotional email through the unsubscribe link or contact us. You may continue to receive essential service, security, transactional and legal communications.

We may work with advertising or measurement providers. Depending on applicable law and configuration, certain disclosures may be considered “targeted advertising”, “sharing” or a “sale” of personal information even where money is not exchanged.

Where required, we will provide a lawful opt-out mechanism, including a “Do Not Sell or Share My Personal Information” control.

IGC does not knowingly sell the personal information of children.

9. HOW WE DISCLOSE INFORMATION

We may disclose personal information to:

1. cloud-hosting and infrastructure providers;

2. application-development, maintenance and testing providers;

3. mapping, geolocation, sensor, augmented-reality and navigation-technology providers;

4. authentication and communication providers;

5. analytics and crash-reporting providers;

6. payment processors and financial institutions;

7. cybersecurity and fraud-prevention providers;

8. customer-support providers;

9. professional advisers, auditors and insurers;

10. campaign operators, merchants and reward providers;

11. authorised licensees, distributors and affiliates;

12. government authorities, regulators, courts and law-enforcement agencies;

13. actual or potential purchasers, investors or transaction advisers; and

14. other parties authorised by you or permitted by law.

We require service providers to process information only for authorised purposes and to apply appropriate confidentiality and security safeguards, subject to applicable law and contractual arrangements.

9.1 Campaign partners

Where you participate in a branded campaign, the responsible campaign partner may receive information reasonably required to:

1. validate participation;

2. issue or redeem rewards;

3. prevent fraud;

4. provide support;

5. measure campaign performance; or

6. satisfy legal and accounting requirements.

Campaign partners may have their own privacy policies and independent legal responsibilities.

9.2 Public and social features

Information you voluntarily publish through a public profile, leaderboard, social feature, shared campaign or public submission may be visible to other users or the public.

Do not publish information you wish to keep private.

10. BUSINESS CUSTOMERS AND DASHBOARD RESPONSIBILITIES

Each business customer, licensee, merchant, affiliate administrator and dashboard user must:

1. access personal information only for authorised business purposes;

2. comply with privacy, marketing, employment and consumer laws;

3. maintain accurate user permissions;

4. protect login credentials;

5. immediately remove access when personnel no longer require it;

6. not export, copy, scrape, sell or misuse personal information;

7. provide all required collection notices and obtain required consents;

8. not upload information obtained unlawfully;

9. not use dashboard information to discriminate, harass, track or harm a person;

10. promptly report suspected unauthorised access or data loss;

11. follow IGC’s security and deletion instructions; and

12. ensure that all campaign content and data collection are lawful.

Business customers are independently responsible for their own collection, use, disclosure, retention and export of personal information unless a written agreement expressly states otherwise.

IGC may suspend dashboard access, preserve audit records and investigate suspected unauthorised use.

11. FRAUD, CHEATING AND SECURITY MONITORING

To protect the Services, users and campaign partners, we may detect and investigate:

1. falsified or spoofed GPS information;

2. automated bots or scripts;

3. emulator or modified-device activity;

4. repeated or impossible travel patterns;

5. account sharing;

6. reward manipulation;

7. unauthorised application modifications;

8. suspicious payment activity;

9. unauthorised dashboard access; and

10. attempts to bypass security controls.

We may use automated indicators to flag activity for restriction or review. Where required by law, users may request human review of a decision that produces a significant legal or similarly significant effect.

Fraud-prevention records may be retained after account closure where reasonably necessary to prevent repeat abuse, enforce legal rights or comply with law.

12. INTERNATIONAL TRANSFERS

IGC may operate internationally. Personal information may be accessed, hosted or processed in countries other than the country in which it was collected.

Privacy laws in those countries may differ.

Where required, we will use appropriate safeguards, which may include:

1. adequacy decisions;

2. standard contractual clauses;

3. international data-transfer agreements or addenda;

4. contractual privacy and security obligations;

5. transfer-risk assessments;

6. encryption and access controls;

7. data localisation where mandatory; and

8. other approved legal transfer mechanisms.

By operating a dashboard or campaign across multiple countries, a business customer must ensure it has lawful authority for any international transfer it initiates.

13. DATA RETENTION

We retain personal information only for as long as reasonably necessary for the relevant purpose, including:

1. providing an active account;

2. processing rewards and transactions;

3. maintaining campaign and financial records;

4. preventing fraud;

5. resolving disputes;

6. maintaining security and audit logs;

7. satisfying legal, tax, accounting and regulatory obligations; and

8. establishing, exercising or defending legal claims.

Retention periods may vary by data type, country and relationship.

Indicative retention periods may include:

1. Account information: while the account is active and for a reasonable period after closure;

2. Transaction and reward records: generally for the period required by financial, consumer and tax laws;

3. Security and access logs: for a reasonable security and investigation period;

4. Location and sensor data: for the shortest period reasonably necessary for functionality, validation, analytics, safety review or fraud prevention;

5. Support and legal correspondence: for the duration of the matter and any applicable limitation period;

6. Marketing records: until consent is withdrawn or the information is no longer required; and

7. De-identified statistics: potentially indefinitely where they can no longer reasonably identify an individual.

Information may remain temporarily in encrypted backups until the backup cycle expires.

Deletion may be delayed where retention is required by law, needed to protect another person, necessary to investigate fraud or required to establish or defend legal rights.

14. SECURITY

We use administrative, technical and organisational safeguards appropriate to the nature of the information and the risks involved.

Safeguards may include:

1. encryption in transit and, where appropriate, at rest;

2. authentication and role-based access controls;

3. access logging and monitoring;

4. secure development and testing practices;

5. data minimisation;

6. vulnerability management;

7. service-provider assessments;

8. employee and contractor confidentiality obligations;

9. incident-response procedures; and

10. backup and recovery controls.

No application, transmission or storage system can be guaranteed to be completely secure.

Users are responsible for:

1. maintaining the confidentiality of their credentials;

2. using a strong and unique password;

3. protecting their device;

4. logging out of shared devices;

5. not sharing verification codes; and

6. notifying us promptly of suspected unauthorised access.

Dashboard administrators are responsible for properly controlling their organisation’s users and permissions.

15. DATA BREACHES

Where we become aware of a data breach, we will investigate and take steps reasonably appropriate to the risk.

Where legally required, we will notify affected individuals and relevant privacy regulators.

A notification may describe:

1. what occurred;

2. the categories of information affected;

3. potential consequences;

4. measures taken;

5. recommended protective actions; and

6. contact information for assistance.

Users and business customers must promptly report suspected loss, unauthorised access or disclosure to [insert security/privacy email].

16. YOUR PRIVACY RIGHTS

Depending on your location and applicable law, you may have the right to:

1. be informed about our processing;

2. request access to personal information;

3. request correction of inaccurate or incomplete information;

4. request deletion or erasure;

5. request restriction of processing;

6. object to processing;

7. withdraw consent;

8. request data portability;

9. opt out of certain marketing;

10. opt out of sale, sharing or targeted advertising;

11. limit certain uses of sensitive personal information;

12. request information about categories and recipients of disclosures;

13. not be discriminated against for exercising privacy rights;

14. complain to a privacy regulator; and

15. request human review of certain automated decisions.

These rights are not absolute. We may deny or limit a request where permitted by law, including where:

1. identity cannot reasonably be verified;

2. another person’s rights would be affected;

3. information is protected by legal privilege;

4. retention is legally required;

5. deletion would compromise fraud prevention or security;

6. the request is manifestly unfounded or excessive; or

7. another legal exception applies.

We will explain a refusal where required.

17. EXERCISING YOUR RIGHTS

Privacy requests may be submitted to:

Request form: IGCloyalty.com

Please state:

1. your name;

2. the account email or telephone number;

3. your country or state of residence;

4. the right you wish to exercise; and

5. enough information for us to locate the relevant records.

We may request information reasonably necessary to verify identity and protect accounts from fraudulent requests.

An authorised agent may act for you where permitted by law, but we may require proof of authority and direct identity verification.

We will respond within the period required by applicable law. Complex or numerous requests may require an extension where legally permitted.

We ordinarily do not charge for a valid request, but a reasonable fee may apply where legally permitted for repetitive, excessive or manifestly unfounded requests.

18. REGIONAL PRIVACY PROVISIONS

18.1 Australia

Where the Australian Privacy Act 1988 and Australian Privacy Principles apply, we will handle personal information in accordance with those requirements.

You may complain to us using the contact details above. If you are dissatisfied with our response, you may be entitled to complain to the Office of the Australian Information Commissioner.

Nothing in this Privacy Policy excludes rights that cannot lawfully be excluded under Australian law.

18.2 European Economic Area

Where the European Union General Data Protection Regulation applies, you may have rights of access, rectification, erasure, restriction, objection, portability and withdrawal of consent.

You may also lodge a complaint with the supervisory authority in the country where you live, work or believe an infringement occurred.

Where legally required, IGC will appoint an EU representative or data protection officer and publish the relevant contact details.

18.3 United Kingdom

Where the UK GDPR and Data Protection Act 2018 apply, you may exercise the rights described in this Privacy Policy and may complain to the UK Information Commissioner’s Office.

Where legally required, IGC will appoint a UK representative and publish the relevant contact details.

18.4 California

Subject to statutory thresholds and exceptions, California residents may have rights to:

1. know the categories and specific pieces of personal information collected;

2. know the categories of sources, purposes and recipients;

3. request deletion;

4. request correction;

5. opt out of sale or sharing;

6. limit certain uses of sensitive personal information; and

7. receive equal service and pricing when exercising privacy rights.

IGC will not discriminate against a person for exercising a legally protected privacy right.

Where relevant, requests may be submitted through the contact methods in Section 17 and through any “Do Not Sell or Share My Personal Information” mechanism made available.

18.5 Other United States jurisdictions

Residents of other US states may have rights under applicable state privacy laws, including access, correction, deletion, portability, opt-out and appeal rights.

Where an appeal right applies, a person may appeal a denied request by replying to the decision or contacting the privacy email with the heading “Privacy Appeal”.

18.6 Canada

Where Canadian privacy law applies, we will collect, use and disclose personal information with valid consent or another lawful authority and provide access and correction rights subject to legal exceptions.

18.7 Brazil

Where Brazil’s Lei Geral de Proteção de Dados applies, individuals may have rights to confirmation, access, correction, anonymisation, restriction, portability, deletion, information about disclosures, consent withdrawal and review of automated decisions.

18.8 Other countries

Additional local privacy rights and requirements may apply. Where local law provides greater protection than this Privacy Policy, the mandatory local requirement will prevail.

19. CHILDREN AND MINORS

The Services are not intended for children below the minimum digital-consent age applicable in their country unless:

1. the relevant service is expressly designed for children;

2. legally required parental or guardian consent has been obtained; and

3. appropriate child-protection controls are implemented.

Unless a specific service states otherwise, users must be at least 16 years old, or the minimum age legally permitted in their jurisdiction, to create an independent account.

A parent or guardian must supervise a minor’s use of location-based and augmented-reality features.

We do not knowingly use children’s personal information for targeted advertising or sell it.

Where we learn that a child’s information was collected without required authorisation, we may suspend the account and delete the information, subject to legal and safety requirements.

20. THIRD-PARTY SERVICES AND EXTERNAL LINKS

The Services may link to third-party websites, maps, payment services, social platforms, application stores, merchant pages or other external services.

IGC does not control the independent privacy practices of those third parties.

Users should review the third party’s privacy policy before providing information or enabling an integration.

The inclusion of a link or integration does not mean IGC accepts responsibility for the third party’s privacy, security, accuracy or conduct.

21. CORPORATE TRANSACTIONS

If IGC undergoes a merger, acquisition, financing, restructuring, sale of assets, insolvency process or transfer of business, information may be disclosed to advisers and transferred as part of the transaction.

Any recipient will be required to process personal information in accordance with applicable law and any continuing commitments attached to the information.

22. LAW ENFORCEMENT AND PROTECTION OF RIGHTS

We may preserve, use or disclose information where we reasonably believe it is necessary and legally permitted to:

1. comply with law, legal process or a lawful government request;

2. investigate fraud, cybercrime or unauthorised access;

3. protect the safety or rights of a person;

4. prevent serious harm;

5. enforce agreements;

6. recover debts;

7. defend legal claims; or

8. protect the integrity of the Services.

We assess government and law-enforcement requests and may challenge requests that appear unlawful, excessive or invalid where appropriate.

23. DE-IDENTIFIED AND AGGREGATED INFORMATION

We may create aggregated, statistical or de-identified information for:

1. service improvement;

2. research and development;

3. campaign measurement;

4. foot-traffic and engagement analysis;

5. system accuracy testing;

6. commercial reporting; and

7. industry insights.

Where information has been effectively de-identified so that it is no longer personal information under applicable law, we may use and disclose it for lawful purposes.

We will not knowingly attempt to re-identify information that is legally treated as de-identified except for security testing, validation or where permitted by law.

24. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy to reflect:

1. changes to the Services;

2. new technologies;

3. new legal requirements;

4. operational or business changes; or

5. improved privacy practices.

The updated version will state the revised effective date.

Where a change materially affects how personal information is used, we will provide additional notice or obtain consent where required.

Continued use of the Services after an update does not constitute consent where applicable law requires express consent.

25. LANGUAGE

This Privacy Policy may be translated into other languages.

Translations are provided for accessibility. To the extent legally permitted, the English version will govern where there is an inconsistency, except where local law requires the local-language version to prevail.

26. CONTACT AND COMPLAINTS

Questions, requests or complaints regarding this Privacy Policy may be sent to:

Via our website IGCloyalty.com

Please include sufficient information for us to understand and investigate the matter.

We will acknowledge and investigate privacy complaints in accordance with applicable law. We may request further information and will communicate the outcome and available review options.

You may also have the right to contact the privacy or data-protection regulator in your jurisdiction.

27. DOCUMENT PRIORITY

This Privacy Policy should be read with:

1. the IGC Terms and Conditions;

2. the applicable campaign rules;

3. the Cookie Policy;

4. any dashboard or business-customer agreement;

5. any data-processing agreement; and

6. collection notices displayed when particular information is requested.

Where documents conflict:

1. mandatory privacy law prevails;

2. a specific collection notice prevails for the particular processing it describes;

3. an executed data-processing agreement governs the controller–processor relationship it covers; and

4. this Privacy Policy applies to all remaining privacy matters.

28. ACKNOWLEDGEMENT

By using the Services, you acknowledge that:

1. you have been provided access to this Privacy Policy;

2. location, device, sensor and usage information may be processed as described;

3. information may be processed internationally subject to appropriate legal safeguards;

4. campaign partners may independently process information as disclosed;

5. device permissions can be controlled through device settings;

6. privacy requests are subject to identity verification and lawful exceptions; and

7. no technological system can provide absolute privacy or security.

Where consent is required, this acknowledgement does not replace a specific consent request.

End of Global Privacy Policy