Privacy Policy for Smile

• Customers of Our Merchants – We may obtain your personal information when we provide services to merchants, including merchants that use our services to operate loyalty programs. We process this personal information on our merchants’ behalf and recommend you review your merchant’s privacy policy and contact them with any complaints, questions or requests. We also obtain and control personal information about customers when they use our services directly, such as when they create or use the Smile wallet.
• Merchants and Their Users – Most information we collected about merchants is business information, not personal information. We use any personal information collected to support and better understand our merchants and provide and improve our services.
• Website / Support Service Users – We collect personal information you provide directly, such as your contact information, and information collected through cookies and similar tools. We use this to provide the website, support and better understand our users and provide and improve our services.
• Employees / Contractors / Applicants – If you apply for a job with Smile, we use your personal information to consider hiring you. If we hire you, we will use your personal information in connection with your employment. A separate privacy notice may apply to employees.

What this notice covers

This notice applies to all personal information that we collect, use, disclose and store when you apply for a job with Smile or access our services. Our services include the Smile wallet, which allows you to view your reward points across multiple merchants. When you create a Smile wallet, the information you provide to Smile will be subject to this notice, including any reward points information that Smile obtains from merchants in connection with your wallet. “Smile” includes Smile Inc. and any related companies anywhere in the world.

What this notice does not cover

• Merchants: As mentioned above, we process personal information for others, including merchants. Please direct any complaints, questions or requests related to your personal information directly to those merchants. In the event you are not satisfied with how they respond, you may contact us directly, but we cannot guarantee we will be able to address it. If you do not create a Smile wallet, Smile does not control your reward point information. If you create a Smile wallet, each of Smile and the applicable merchant will control a copy of your reward points and each will know if your reward point totals change, such as when you earn new points or spend points.
• Non-Personal Information: Information about your business, including your business contact information, is not typically personal information. Anonymized information is also not considered personal information for the purposes of this notice. We may anonymize any personal information in our custody, in which case it will cease to be personal information.

In some situations, we may rely on exemptions or other permitted conduct under applicable laws, including to collect, use, disclose or store personal information for purposes not described in this notice. We provide services to merchants in many jurisdictions and privacy practices may be adopted to address the specific privacy requirements of particular jurisdictions. If you are unsure if or how this notice applies to you, contact us.

Please note that we may update this notice from time to time to reflect changes in our privacy practices by providing you with notice of the changes. Notice includes but is not restricted to posting a link to the new notice, posting a new notice at smile.io/privacy-policy, or sending you a link to the new notice via contact information you have provided to us. Such changes will be effective with respect to your use of Smile’s services after Smile has given notice of the changes. Please review this notice periodically to see whether it has been updated. Any use of Smile’s services by you after we provide notice constitutes your acceptance of those changes.

Much of the personal information we process is necessary to provide our services and meet our contractual obligations. In most other situations, we rely on our legitimate interest (which, in some countries, would be “implied consent” or a legal exception to the consent requirement, such as where the processing is to prevent fraud). The specific purposes for which we process personal information include to:

• communicate with you
• track and process your purchases and report back to you as appropriate
• administer, manage, test and improve our services
• better understand the services, such as through reporting and analytics
• deliver content and information to third parties including other merchants and their customers
• market and advertise our services
• fulfil any other purpose that would be reasonably apparent to the average person at the time of collection

While not stated as a purpose below, we may also use any personal information:

• For security purposes, including to detect, prevent and investigate potential fraud
• Where required or permitted by law

We may also request express consent to process your personal information in some circumstances, such as when you sign up as a merchant or a user for a merchant or when you visit our website and we use cookies or when you create a Smile wallet. We may also de-personalize information, such as through anonymization or aggregation. We may use and disclose such information for any purpose, as it will no longer identify you or any other person.

We do not sell your personal information to third parties (as "sell" is defined in California law). A "sale" would not include a situation where someone is buying all or part of our business (as is explained further below).

We share your personal information with our employees, contractors, consultants and other parties such as affiliates and third party companies that assist us in providing our services, including marketers, customer support and hosting services. Below is a non-exhaustive list of the third parties that may have access to personal information under our control.

The following table outlines recipients to whom we may disclose your personal information, as well as the purpose of such disclosure. When we disclose your personal information, we cease to control it, and the recipient’s policies and procedures will apply. Where required by law, we will obtain your consent before disclosure.

Will My Personal information Leave the Country?

We may disclose personal information to third parties both in and outside of your country, and as result, your personal information may be collected, used, disclosed or stored in another country, including Canada and in the United States of America. Laws relating to privacy vary between countries, and your personal information may be processed in a country with less stringent than the laws in your country. Personal information may be accessible to governments, courts, or law enforcement, national security authorities or and regulatory agencies of these countries in accordance with applicable laws.

• Cookies – Our website uses session cookies, which are deleted when you exit your browser, for the functioning of our website. We also use stored cookies, which stay on your computer, to analyses your use of the website and remember your preferences. You can read about cookies at allaboutcookies.org.
• IP – Our website also obtains your IP address and browser type, which we keep for 24 months.
• Web beacons – We use web beacons in our emails to know when you read / opened the email and when you clicked on the link.
• "Do Not Track (DNT) Signals" – Although we would like to honor browsers set with DNT signals, at this time, our website do not respond to DNT signals or other mechanisms that might enable users to opt out of IP address tracking. For more information about DNT signals, please visit allaboutdnt.com.

Depending on where you are located and subject to applicable laws, you may have the right to request to access, correct or erase your personal information, object to our processing of your personal information, requests restriction of your personal information in our control or withdraw or change your consent to how we process your personal information, by contacting our Privacy Officer (Contact Us). Keep in mind that merchants control much of the personal information processed by Smile, so you may need to direct your request to the merchant with whom you have a relationship.

As a security measure, our Privacy Officer may request specific information from you in order to verify your identity prior to granting any requests. If we cannot respond to your request promptly or have to refuse the request, we will advise you of the reasons, subject to any legal restrictions. If you disagree with our determination, you may complain to us and we will reconsider. If you are not satisfied with our ultimate determination, you may contact your local data protection authority or privacy commissioner. In addition, the personal information may have been destroyed, erased or made anonymous in accordance with our record retention obligations and practices.

If you want to designate someone to exercise your rights on your behalf, please send your designation request using the email associated with your account, if you have one, or that you have otherwise provided to Smile. We are not otherwise able to verify your identity.

Where permitted by law, we may refuse or charge a fee for repeat, abusive or inappropriate requests.

We only store personal information as long as necessary to fulfill the purposes for which the personal information was collected, to conduct our business operations and maintain an appropriate historical record of our relationship with you, or in order to comply with applicable laws, whichever is longer, after which time the personal information is destroyed or erased. We may, instead of destroying or erasing your personal information, make it anonymous such that it cannot be associated with, or tracked back to, you.

We take steps to maintain physical, technical and procedural safeguards that are appropriate to the sensitivity of your personal information. These safeguards are intended to prevent your personal information from loss and unauthorized access, copying, use, modification or disclosure. However, the internet is not a secure environment and no computer system is perfectly secure. As such, we cannot guarantee the security of personal information provided to us through electronic means: there is always a risk that your personal information may be accessed or used without authorization.

Will We Use Your Personal Information to Contact You?

Smile and its marketing partners and sponsors may use your personal information to send you emails periodically listing promotions or events relating to Smile’s services. You may opt-out of receiving such promotional emails by sending an email to help@smile.io or following the instructions in such correspondence. Once Smile has processed your opt-out request, we will no longer send you promotional emails unless you opt back in to receiving such communications. Smile does not control mailing lists maintained by merchants.

What Personal information Do We Collect from Children?

We only collect, use, disclose and store personal information of children under the age of 13 with the consent of a parent or guardian. If you believe that a child under 13 may have provided us with personal information without the consent of a parent or guardian, we request that you Contact Us immediately.

What Personal information Do We Collect from Third Parties?

We may collect personal information about you from a third party. In such cases, the third party providing that personal information to us is responsible for obtaining your consent or another lawful basis for such disclosure.

For example, if you provide your personal information to another Smile user, such as a merchant, as part of accessing and using Smile's services, that personal information may be collected by us, or other third parties, as we and others are the service provider of such users. The collection, use, disclosure and storage of such information will be subject to the privacy policies of such other Smile users. We recommend that you review the privacy policies of those Smile users prior to providing any personal information.

Do We Collect Personal Information About Third Parties from You?

You may have the opportunity to communicate with others that use Smile’s services, such as by sending an invitation to a third party. If you choose to take advantage of this functionality, we may ask you to provide us with certain information about the person with whom you wish to communicate, such as their name and email address. By providing us with this information, you confirm that you have obtained their consent to collect, use and disclose their personal information in this manner.

We collect such information for the purposes of facilitating the requested communication, which may contain a specific promotional message from you. Unless we explicitly say otherwise, we will not use this personal information for other marketing purposes without first obtaining consent from the subject of the personal information. Please be aware that when you use any invitation functionality on the services, your email address, name or username and message may be included in the communication sent to you.

What Personal information Do Third Parties Collect from Us?

As a convenience to you, Smile’s services may contain links to third party websites, applications or services, or integrate with other third party platforms that collect personal information from you. Such third party services may include payment processors that collect personal information in order to facilitate your purchase of certain services. While we try to link only to third party services that share our commitment to protecting your privacy, we are not responsible for the privacy practices or content of third party services. We recommend that you review the privacy policies of those third party services prior to use.

What is Required of Merchants?

Our Terms of Use require that merchants comply with all applicable laws, including privacy laws, including by obtaining consent to process your personal information where required by applicable laws. If you believe a merchant is violating applicable laws or regulations, we invite you to please Contact Us.

If you wish to make a complaint about how we have handled you personal information or you believe that we have breached this notice or applicable laws, you may file a complaint with our Privacy Officer using the details below: