For businesses

Data processing terms

Last updated: 16 October 2026

These terms are part of the agreement between each business that uses Usual and Usual, a service by Synco provided by Bruno Sancho Deltell, Apartment G02, 53 Mayor Street Upper, Dublin 1, Ireland, as required by Article 28 of the General Data Protection Regulation. A business accepts them when it creates its panel login.

1. Roles

The business is the controller of its customers' data. Usual is the processor: it handles that data only on the business's behalf and following its instructions.

2. Subject, duration and purpose

Running the business's loyalty card: letting its customers join, adding stamps, giving rewards, showing and updating the card in Apple Wallet and Google Wallet, and giving the business its panel, counter phones and statistics. For as long as the business uses Usual.

3. Data and people concerned

• The business's customers: the name they type when they join, their card number, the date and time of stamps and rewards and, if they save the card to Apple Wallet, a device identifier used to update it.
• People at the business: the owner's email and the names given to counter phones, with when each was last used.

Usual does not process special category data, nor customers' email, phone number, payment details or location.

4. What the business does

• Uses Usual only for its loyalty programme and with a valid legal basis.
• Informs its customers. Usual helps with the notice shown when they join and on the card, and with our privacy notice.
• Handles its customers' requests. The panel has buttons to delete a customer's data and to download the customer list.

5. What Usual does

1. Processes the data only under these terms and the settings the business chooses in its panel.
2. Makes sure everyone with access to the data is bound by confidentiality.
3. Applies appropriate security: HTTPS, encrypted passwords and private links, access that can be turned off at once, and daily backups kept for 14 days.
4. Helps the business respond to its customers' rights and, where needed, with impact assessments.
5. Tells the business about any security breach affecting its data without undue delay and at the latest 48 hours after becoming aware of it.
6. When the service ends, deletes the data within 90 days or, if the business asks first, gives it a copy.
7. Gives the business the information it needs to show these terms are being met.

6. Sub-processors

The business authorises Usual to rely on OVH (servers and backups), Cloudflare (domain and email forwarding), Apple (Apple Wallet update notifications) and Google (Google Wallet). Usual will give at least 30 days' notice before adding or changing one, and the business may object.

7. International transfers

Where a sub-processor handles data outside the European Economic Area, it does so under the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework.

8. Contact

Any questions about these terms: hello@usualcards.com.