Privacy Notice

Last Updated: June 2026 (Version 4)

Where the words “we”, “us” or “our” are used in this document, they refer to WeNudj Limited (trading as Nudj), a company registered in England and Wales (Company No. 15506029), with its registered address at 6 Burgoyne Road, London, England, N4 1AD.

1. About This Notice

This Privacy Notice explains how we collect, use, store, and share your personal information when you interact with our products, services, and technologies. It applies to all individuals whose data we process, including end users of our gamification and loyalty platform, merchant customers, business partners, and website visitors.

We are committed to protecting your privacy and processing your personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the EU General Data Protection Regulation (EU GDPR), the California Privacy Rights Act (CPRA), and other applicable data protection laws worldwide.

We do not sell your personal information. We do not sell, rent, or trade personal data to third parties for monetary or other valuable consideration, as defined under applicable privacy laws including the CPRA. This applies to all categories of personal information we collect, whether from merchants, end users, or website visitors.

1.1 Our Role: Data Controller and Data Processor

Depending on the context, we act in different data protection roles:

As a data controller — we are the controller for personal data we collect and process for our own purposes, including data from our website visitors, prospective customers, and merchant account holders (Section 3.1). We determine the purposes and means of this processing.

As a data processor — when a merchant uses our platform to run loyalty or gamification programmes, we process their customers’ personal data on their behalf and under their instructions. The merchant is the data controller for that data (Section 3.3).

This distinction is important because it determines your rights and who you should contact to exercise them. If you are an end user of a loyalty programme operated by a brand or retailer, your primary point of contact for data protection queries is that brand or retailer (the data controller). You may also contact us directly at privacy@wenudj.com and we will assist where we can.

Where we act as a data processor on behalf of a merchant, we do not use end users’ personal data obtained through the merchant’s platform for our own independent purposes, except where:

it has been aggregated and anonymised so that individuals are no longer identifiable; or

it is strictly necessary for security, fraud prevention, or service integrity.

Where we process personal data for our own purposes (as a data controller), this is limited to:

merchant account data

business contact data

website visitor data

2. How We Collect Information About You

We collect information about you in the following ways:

Directly from you, when you register with us, use our mobile applications, products, services, or technologies, or contact us with enquiries or feedback

From third parties, including specialist data companies, credit reference agencies, fraud prevention agencies, and e-commerce platforms [Note to reviewer: confirm whether we actually obtain data from specialist data companies, credit reference agencies, or fraud prevention agencies — no such integrations were found in our systems; if not, delete these sources.]

Automatically, through your use of our websites, applications and services (e.g. cookies, analytics, device information)

Via e-commerce platform APIs, when a merchant installs our application on their store (see Section 3.3)

3. What Information We Collect

The type of information we collect depends on how you use our products and services and your relationship with us. We distinguish between three categories of data collection:

Our role under data protection law, and the lawful basis we rely on, differs depending on whose data we process and why. Our lawful bases for our own processing are not the same as a merchant’s lawful bases for processing their customers’ data. The table below sets out which data falls into which role. Where we act as a controller, we rely on legitimate interest or, where relevant, consent — we do not rely on performance of a contract with you as an end user, because you do not enter into a contract with Nudj directly.

Data we process | Our role | Lawful basis we rely on

Merchant account and business-contact data — the people who hold a Nudj account, or who contact us about our services. | Controller | Performance of our contract with the merchant, and our legitimate interest.

Website-visitor and prospective-customer data, from our own sites and marketing. | Controller | Legitimate interest, and consent where required (for example, marketing communications).

Device, network and security-log data from our own websites and applications. | Controller | Legitimate interest (security and service integrity).

End-user loyalty data — challenges, points, profiles and rewards — processed to operate a merchant’s programme. | Processor. | We process this on the instruction of the merchant; the merchant’s lawful basis applies. We do not rely on a contract with you, because you do not contract with Nudj directly.

End-user data we use for our own security, fraud-prevention and service-integrity purposes. | Controller | Legitimate interest, limited to security, fraud prevention and service integrity.

Merchant and administrator inputs to AI-assisted features (prompts, brand content and uploads). | Processor | The merchant’s own lawful basis applies.

In this notice, “merchant” means a business that contracts with us directly (for example, a Shopify store that installs our application), and “end user” means an individual who takes part in a loyalty programme operated by a merchant.

3.1 Information We Collect Directly from Merchants

When a merchant registers for our services or installs our application, we collect account registration details, configuration and preferences for loyalty programmes, communications with our support and customer success teams, and automated logs relating to the merchant’s use of our application, including login events, configuration changes, and API activity.

Lawful basis: performance of a contract (where the merchant has entered into an agreement with us) and legitimate interest (for platform security and service improvement).

3.2 Information We Collect Directly from Merchants’ Customers (End Users)

When end users interact with our loyalty and gamification features on a merchant’s store or application, we may collect identity information provided during enrolment, engagement and behavioural data, preferences and profile data, survey responses, feedback, product reviews, and professional details where applicable.

Lawful basis: this data is processed on behalf of the merchant (as data controller) under performance of a contract between the merchant and us, and between the merchant and their customer. As processor we do not ourselves determine a lawful basis for this data and do not rely on any contract with you as an end user; the merchant is the controller and its lawful basis applies.

3.2.1 Cookies and Tracking Technologies

Our platform may use cookies, local storage, and similar technologies on the merchant’s storefront to maintain session state and authenticate users, track challenge participation, reward redemptions, and engagement activity, analyse how end users interact with loyalty features, and remember user preferences and personalise content.

We do not use tracking technologies on merchant storefronts for the purpose of cross-site advertising or behavioural profiling unrelated to the merchant’s loyalty programme. Merchants are responsible for disclosing the use of third-party technologies, including Nudj, in their own privacy policies and cookie banners.

We and the merchant each have independent obligations under data protection law. Where we act as a controller for any of your personal data, we have our own duty to make you aware of our role. For merchants who contract with us directly, we will put in place data processing terms requiring them to provide appropriate privacy information to their users, including reference to our role, so that our involvement and this Privacy Notice can be brought to your attention at the point your data is collected or shortly thereafter.

3.2.2 Data From Connected Social Accounts

Where a loyalty programme includes social challenges, an end user can choose to connect a third-party account (for example Spotify, Instagram, or YouTube). With their authorisation, we retrieve limited data from that account solely to verify challenge completion. We use this data only to award the relevant challenge; we do not use it for profiling or advertising. The end user can disconnect the account at any time.

3.3 Information We Receive via Shopify and Other E-Commerce Platform APIs

When a merchant installs Nudj on their Shopify store (or other supported e-commerce platform), we receive certain data from the platform via authorised API access. We request only the minimum API scopes necessary to deliver the loyalty and gamification services, and we periodically review these scopes to ensure continued compliance with data minimisation principles. Customer, order and checkout data accessed through these scopes is classified as “protected customer data” by Shopify, and we handle it in line with Shopify’s Protected Customer Data requirements, including data minimisation, encryption, retention limits, and restricted staff access.

The specific data we access depends on the permissions granted during installation, including customer information, order data, checkout data, product information, discount management, customer record updates, and subscription data where enabled.

This data is processed on behalf of the merchant (who acts as the data controller) to provide the loyalty, rewards, and gamification services they have configured. We act as a data processor for merchant customer data and process it only for the purposes described above. We do not use data received via Shopify APIs for any purpose other than providing our application’s services to the merchant.

Lawful basis: performance of a contract between us and the merchant, and the merchant’s own lawful basis for processing their customers’ data.

3.4 Information About Your Devices and Network

When you visit our websites or use our applications, we may automatically collect technical information about the devices you use, including IP addresses, browser type, operating system, mobile device identifiers, and network information. This information is used for security monitoring, analytics, and to ensure our services function correctly.

Lawful basis: legitimate interest (platform security and performance).

3.5 Payment and Card Information

If you make purchases or redeem rewards, your payment is processed by our third-party payment service providers. We do not receive, store, or process complete card details. Payment information is transmitted directly to the payment provider in a secure environment.

3.6 AI-Assisted Features

Our admin application offers AI-assisted tools for merchants and administrators — for example a content assistant, image generation for campaign assets, and voice features. When a merchant uses these tools, the content they provide is processed by our AI sub-processors to generate the requested output. These features process merchant and administrator input rather than end-user loyalty profiles, and we do not use end users’ personal loyalty data to train AI models. The AI sub-processors we use are listed in Section 6.1.

4. What We Use Your Information For

Under the UK GDPR and EU GDPR, we must have a lawful basis for processing your personal information. The lawful bases we rely on are summarised below. Where relevant, the specific lawful basis for each category of data collection is indicated in Section 3.

4.1 Performance of a Contract

Where you have entered into a contract or agreement with us (or where a merchant has entered into an agreement with us to provide services to their customers), we will process personal information in order to fulfil that contract. This includes providing gamification services, processing reward redemptions, managing accounts, and delivering campaign functionality.

4.2 Legitimate Interest

We may use your information where we have a legitimate business interest to do so, provided that interest is not overridden by your rights and freedoms. This includes improving our products and services, understanding how customers use our products and services, analysing engagement metrics, detecting and preventing fraud or abuse, maintaining security and integrity, and conducting market research and analytics.

Where we rely on legitimate interests in relation to end users, this is limited to ensuring platform security, preventing fraud, and maintaining service integrity.

You have the right to object to processing based on legitimate interest. If you wish to do so, please contact privacy@wenudj.com and we will review your request.

4.3 Legal Obligation

Where we are required to process your information to comply with a legal or regulatory obligation (e.g. identity verification, anti-money laundering checks, tax reporting).

4.4 Consent

Where consent is required for a particular processing activity (e.g. marketing communications, location tracking, mobile push notifications), the relevant data controller is responsible for obtaining and managing that consent.

For processing where we act as a data processor, the merchant or brand operating the loyalty programme is responsible for obtaining consent from their customers and for providing mechanisms to withdraw that consent. For processing where we act as a data controller, you may withdraw consent at any time by contacting privacy@wenudj.com.

5. How We Protect Your Information

We implement appropriate technical and organisational security measures to protect your personal information against unauthorised or unlawful processing, accidental loss, destruction, or damage. Our security measures include encryption of data in transit and at rest, regular security assessments and penetration testing, access controls and role-based permissions, multi-factor authentication enforced for all staff accounts, ISO 27001:2022 certification, SOC 2 Type I compliance, employee security training, incident response procedures, breach notification plans, and a documented security incident response policy.

[Note to reviewer: confirm ISO 27001:2022 certification, SOC 2 Type I, penetration testing, and enforced staff MFA are all currently in place before publishing; remove any that are not yet in place.]

We assess our processing activities on an ongoing basis and conduct Data Protection Impact Assessments (DPIAs) where required by law. Our ISO 27001 Information Security Management System (ISMS) is maintained and overseen by our designated ISMS Owner. For security-related enquiries, please contact security@wenudj.com.

6. Who We Share Your Personal Data With and Why

6.1 Third-Party Service Providers (Sub-Processors)

We work with third-party service providers who provide website and application development, hosting, maintenance, backup, storage, analytics, and other services for us. These third parties may have access to or process your information as part of providing those services. We limit the information provided to these providers to that which is reasonably necessary and require them to protect your information through appropriate contractual safeguards, including Data Processing Agreements where required by law.

Our key sub-processors include Vercel, MongoDB Atlas, Upstash, BetterStack, PostHog, Tinybird, SendGrid, Stripe, Amazon Web Services, Shopify, OpenAI, Microsoft Azure OpenAI, Fal.ai, and ElevenLabs. The full, current register, including each sub-processor’s purpose and processing location, is available on request by contacting privacy@wenudj.com.

6.2 Sharing with Customers or Business Partners

If you use our services through a brand, agency, or enterprise customer, we may share your information with that customer for their business purposes. Their use of your information is subject to their own privacy policies.

6.3 E-Commerce Platform Providers

We integrate with e-commerce platforms such as Shopify. These platforms facilitate the data exchange described in Section 3.3 above. Our use of platform APIs is subject to the platform’s API terms of service and partner agreements. We do not sell merchant or customer data to third parties.

6.4 Linking Your Accounts

If you choose to link your Nudj account with third-party services, we will share information necessary to enable that integration as you have authorised.

6.5 Other Disclosures

We may also use or share your information to comply with legal obligations, enforce our terms of service, protect our rights and property, support a merger, acquisition, or sale of assets, or where you have given explicit consent.

7. International Data Transfers

Our platform infrastructure includes services hosted outside the United Kingdom, including in the United States. This means your personal information may be transferred to, stored in, or processed in countries outside the UK and the European Economic Area.

Where we transfer personal data internationally, we ensure appropriate safeguards are in place, including the UK International Data Transfer Agreement, EU Standard Contractual Clauses, and adequacy decisions where available.

Our key infrastructure providers include Vercel, MongoDB Atlas, Upstash, BetterStack, and other cloud service providers. Each provider is subject to contractual data protection obligations and assessed as part of our ongoing vendor risk management programme under ISO 27001.

You may request further details about the safeguards we use for international transfers by contacting privacy@wenudj.com.

8. How Long We Store Your Information

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected. Retention periods include active account data for the duration of the relationship and up to 12 months after closure or inactivity, transaction and order data for up to 7 years, campaign and engagement data for 24 months following the end of the relevant campaign, technical logs and analytics for up to 12 months, and marketing consent records for as long as consent is active plus 3 years.

When we no longer need your information, we will securely delete or anonymise it. Anonymised data may be retained indefinitely for analytics and research purposes.

9. Data Subject Requests and Platform Compliance

We maintain processes to receive and respond to data subject requests from individuals and from the e-commerce platforms we integrate with.

9.1 Shopify Mandatory Compliance Webhooks

As a Shopify App Store application, we subscribe to and respond to Shopify’s mandatory compliance webhooks, including customer data requests, customer data erasure, and shop data erasure. These webhook-based processes operate in addition to the direct data subject request rights described in Section 10.

9.2 Data Processing Agreement

Where we process personal data on behalf of a merchant as a data processor, we do so under the terms of a Data Processing Agreement (DPA). Merchants may request a copy of our standard DPA by contacting privacy@wenudj.com. For Shopify merchants, our data processing obligations are also governed by the Shopify Partner Program Agreement and Shopify API Terms of Use.

10. Your Data Protection Rights

10.1 Rights Under UK and EU Data Protection Law

Under the UK GDPR, the Data Protection Act 2018, and where applicable the EU GDPR, you have rights of access, rectification, erasure, restriction of processing, data portability, objection, and rights related to automated decision-making.

To exercise any of these rights directly with us, please contact privacy@wenudj.com. We will respond within one month of your request. In complex cases, we may extend this by a further two months, and we will inform you if this is necessary.

Where we process your data as a processor on behalf of a merchant or brand, we may need to refer your request to the relevant data controller. These rights are not absolute and may be subject to exemptions under applicable law.

10.2 Automated Decision-Making

Our platform includes profiling in the form of scoring, rankings, and reward allocation based on user activity. These processes do not produce legal or similarly significant effects within the meaning of Article 22 UK GDPR.

10.3 Additional Disclosures for Individuals in the EEA and Switzerland

If you are located in the European Economic Area or Switzerland, your personal information is also protected under the EU GDPR and the Swiss Federal Act on Data Protection. The rights described in Section 10.1 apply equally to you, and you may exercise them by contacting privacy@wenudj.com.

11. Additional Disclosures for US Residents

If you are a resident of California or another US state with an applicable consumer privacy law, you may have additional rights regarding your personal information, including the right to know, delete, correct, opt out of sale or sharing, non-discrimination, and limitation of use of sensitive personal information where applicable.

In the preceding 12 months, we may have collected identifiers, commercial information, internet or electronic network activity, geolocation data, professional or employment-related information, and inferences drawn from the above.

To submit a request, please contact us at privacy@wenudj.com. We will verify your identity before processing your request. You may also designate an authorised agent to submit a request on your behalf. We will respond to verifiable requests within 45 days, or notify you if an extension is required.

We do not sell personal information as defined under the CPRA or any other applicable US state privacy law. We do not share personal information for cross-context behavioural advertising purposes.

12. Security Incident Notification

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, we will notify the relevant supervisory authority within 72 hours where required, notify affected individuals without undue delay where required, notify affected merchants promptly, and notify e-commerce platforms in accordance with applicable platform agreements.

Our incident response procedures are documented within our ISO 27001 ISMS and include defined severity classifications, escalation paths, evidence collection procedures, root cause analysis, and remediation tracking.

13. Merchant and Shopify Store Data

When a merchant uninstalls Nudj from their store, session and authentication data is deleted immediately, cached store data is purged at uninstall, and Shopify’s shop/redact webhook acts as a backstop to confirm all store data has been removed.

End-user loyalty data held within the merchant’s Nudj community forms part of the merchant’s own Nudj account. It is retained after uninstall so the merchant can reinstall or reconnect without losing their programme, and is deleted on the merchant’s explicit instruction or in response to individual customers/redact requests.

Merchants can request a full export of their data at any time by contacting privacy@wenudj.com. Individual customer data deletion requests are processed within 30 days of receipt. Merchants are responsible for informing their own customers about the use of third-party services including Nudj, and for obtaining any necessary consent under applicable data protection laws.

14. Children’s Data

Our services are not directed at children under the age of 16. We do not knowingly collect personal information from children under 16. If you believe we have inadvertently collected information from a child under 16, please contact us at privacy@wenudj.com and we will take steps to delete the information promptly.

Where our platform is used by brands whose audiences may include individuals under 18, we work with those brands to ensure appropriate safeguards are in place, having regard to the ICO’s Age Appropriate Design Code and, where applicable, the US Children’s Online Privacy Protection Act.

15. Complaints

If you have concerns about how we handle your personal information, please contact us first at privacy@wenudj.com. We take all complaints seriously and will work to resolve your concerns.

If you are not satisfied with our response, you have the right to lodge a complaint with the relevant data protection authority. WeNudj Limited is registered with the UK Information Commissioner’s Office (registration reference ZB696754). Where we act as the controller of your personal data, you have the right to complain about us directly to the ICO at ico.org.uk, in addition to any complaint you may make to the merchant.

16. Your Choices

16.1 Cookies

Most web browsers automatically accept cookies, but you can modify your browser settings to decline cookies. For details about the cookies we use on our own websites and how to manage them, please refer to our Cookie Policy at wenudj.com/cookie-policy.

For cookies used by our platform on a merchant’s storefront, please refer to the merchant’s own cookie policy and consent management settings.

16.2 Location Information

You can disable location tracking through your device settings or mobile app preferences. Some features may not work properly if you disable location services.

16.3 Communications Preferences

If you receive marketing communications through a brand’s loyalty programme powered by Nudj, please contact that brand directly to update your preferences or unsubscribe. We do not send marketing communications to end users on our own behalf.

If you are a merchant or business contact receiving marketing communications directly from WeNudj Limited, you can opt out by clicking the “unsubscribe” link in any marketing email or by contacting privacy@wenudj.com. We will still send transactional emails about your account and services.

16.4 Mobile Push Notifications

You can disable push notifications through your device settings or mobile app preferences. This will not affect in-app notifications related to your account activity.

17. Updating Our Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. We will notify you of material changes by posting the updated notice on our website with a new “Last Updated” date, sending you an email notification if the changes significantly affect your rights, or displaying a prominent notice in our applications or website.

We encourage you to review this Privacy Notice periodically. Your continued use of our services after changes take effect constitutes your acceptance of the updated notice.

18. Data Protection Contact

If you have any questions about this Privacy Notice, our data protection practices, or wish to exercise any of your rights, please contact:

Data Protection Officer: Charlie Curtis (privacy@wenudj.com)

Data Protection Lead: COO / ISMS Owner

Email: privacy@wenudj.com

Security enquiries: security@wenudj.com

Postal address: WeNudj Limited, 6 Burgoyne Road, London, England, N4 1AD

19. About Us

Company Name: WeNudj Limited (trading as Nudj)

Company Registration: 15506029 (England and Wales)

Registered Address: 6 Burgoyne Road, London, England, N4 1AD

Contact Email: privacy@wenudj.com

Website: https://wenudj.com