Privacy Policy

GMD Holdings LLC, Salvador Aljende 78, Skopje, Republic of North Macedonia, is the controller of the personal data we collect about account holders and visitors. For the personal data of a business’s own customers, the business is the controller and we act as its processor. You can reach us at info@kult.cards.

Account data: name, email or phone number, business details, language preference, and login codes.

Billing data: plan, transaction records and limited payment details handled by our payment providers (we do not store full card numbers).

Loyalty data: programs, cards, stamps, points and rewards you create, and the end-customer records associated with them.

Usage and technical data: device, browser, IP address, log and analytics data, and — where relevant to anti-abuse — approximate location at the time of a scan.

Cookies: a locale cookie ("kult.locale") to remember your language, and essential cookies needed to sign in and run the Service.

To provide and operate the Service (performance of a contract).

To process payments and manage subscriptions (performance of a contract; legal obligation).

To secure the Service and prevent abuse, including geofence and working-hours checks on scans (legitimate interests).

To communicate with you about your account and support (performance of a contract; legitimate interests).

To comply with legal obligations and enforce our Terms.

We use a small number of cookies that are essential to operating the Service and remembering your language choice. We do not use them for advertising. You can clear cookies in your browser, but some features may stop working.

We share data only as needed to run the Service: with Apple and Google to issue and update wallet passes; with our payment provider to handle billing; and with hosting, email and analytics providers acting as our processors under contract.

We do not sell your personal data.

Some processors may be located outside your country. Where data is transferred internationally, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

We keep personal data for as long as your account is active and as needed to provide the Service, then for any period required to meet legal, accounting or dispute-resolution obligations. After that we delete or anonymise it.

We use technical and organizational measures — including encryption in transit, access controls and one-time-code authentication — to protect personal data. No system is perfectly secure, but we work to keep your data safe and to notify you of incidents where required by law.

Subject to applicable law, you have the right to access, correct, delete, restrict or object to the processing of your personal data, and to data portability. You may also withdraw consent where processing is based on consent.

To exercise your rights, contact info@kult.cards. You also have the right to lodge a complaint with your data-protection authority.

If your request concerns data held by a business that uses our Service about its own customers, we will direct it to that business as the controller.

The Service is not directed to children and is intended for businesses. We do not knowingly collect data from children.

We may update this policy from time to time. We will post the updated version with a new "last updated" date and, for material changes, give reasonable notice.

For privacy questions, contact GMD Holdings LLC at info@kult.cards or Salvador Aljende 78, Skopje, Republic of North Macedonia.