Our Privacy Policy

KamioKash Privacy Policy

Effective date: 20 July 2026
Last updated: 20 July 2026

1. Who We Are

KamioKash is a loyalty, rewards and engagement platform operated by UAB Bluetrino LT, a private limited company incorporated in Lithuania on 26 July 2022.

Company registration number: 306121218
Registered address: J. Savickio str. 4-7, Vilnius, Lithuania

In this Privacy Policy, “KamioKash”, “Bluetrino”, “we”, “us” and “our” refer to UAB Bluetrino LT.

For purposes of the European Union General Data Protection Regulation (“GDPR”), UAB Bluetrino LT is established in the European Union and may act as a data controller or data processor, depending on the processing activity.

Under South Africa’s Protection of Personal Information Act (“POPIA”), we may similarly act as a responsible party or operator.

This Privacy Policy explains how we collect, use, disclose, retain and protect personal information when you:

• Visit a KamioKash website;
• Use a KamioKash application, portal, API or communication channel;
• Participate in a loyalty, employee reward, incentive or promotional programme powered by KamioKash;
• Communicate with us or request support;
• Act as a customer, supplier, programme sponsor, partner, merchant or business contact.

“Personal information” in this policy includes “personal data” as defined by the GDPR and “personal information” as defined by POPIA.

2. Our Privacy Roles

KamioKash processes personal information in different capacities.

2.1 When KamioKash acts as a controller or responsible party

KamioKash determines why and how personal information is processed for activities including:

• Operating our websites and business;
• Managing customer, administrator and partner accounts;
• Providing technical and customer support;
• Maintaining platform security and preventing fraud;
• Managing contracts, billing and commercial relationships;
• Communicating about KamioKash products and services;
• Managing suppliers and business partners;
• Meeting our legal, regulatory and accounting obligations.

2.2 When KamioKash acts as a processor or operator

Our customers use KamioKash to operate loyalty, employee reward, incentive and promotional programmes.

For personal information submitted to or generated through a customer programme, the customer or programme sponsor generally determines why the information is processed. That organisation is normally the controller or responsible party, and KamioKash processes the information on its documented instructions.

If you participate in a programme operated by one of our customers, the customer’s privacy notice also applies. Requests concerning your programme membership should normally be directed to the organisation operating the programme.

KamioKash will assist its customers in responding to valid privacy requests and meeting their legal obligations.

3. Personal Information We Collect

Depending on how you interact with KamioKash, we may process the following categories of personal information.

3.1 Identity and contact information

• First and last name;
• Email address;
• Mobile or telephone number;
• External membership, employee or customer identifier;
• Username and account identifier;
• Employer, programme and organisation;
• Country, region, language and communication preferences.

3.2 Account and authentication information

• Login and authentication records;
• Identity-provider information;
• Multi-factor authentication status;
• Account roles and permissions;
• Password-reset and one-time-password activity;
• Security, session and access logs.

We do not store readable copies of account passwords.

3.3 Loyalty and reward information

• Programme membership and status;
• Points earned, spent, adjusted or expired;
• Wallet balances and transaction history;
• Reward eligibility and tier status;
• Vouchers, gift cards and voucher codes;
• Orders, redemptions and fulfilment history;
• Campaign participation and promotional outcomes.

3.4 Behavioural and engagement information

• Actions completed within a programme;
• Responses to campaigns, challenges, surveys or games;
• Progress against goals or key performance indicators;
• Reward preferences and redemption behaviour;
• Segments, tiers and programme classifications;
• Communication delivery and engagement events.

3.5 Transaction and merchant information

• Purchase or qualifying-transaction references;
• Merchant, store and terminal details;
• Purchase amounts and transaction dates;
• Redemption-validation records;
• Receipts or supporting evidence submitted for a reward claim.

KamioKash is not intended to store full payment-card details unless this is expressly agreed and processing is performed through an approved payment provider.

3.6 Communications

• Emails, SMS messages and WhatsApp messages;
• Support requests and correspondence;
• Notification and marketing preferences;
• Message delivery, read and response status where made available by the relevant communication provider.

3.7 Technical and usage information

• IP address;
• Browser and device type;
• Operating system;
• Date and time of access;
• Pages, features and services used;
• Session, security and diagnostic information;
• Cookie and similar technology identifiers.

3.8 Business contact information

For customer administrators, suppliers, merchants and partners, we may process:

• Name and business contact details;
• Employer, job title and responsibilities;
• Contract and billing information;
• Meeting notes and correspondence;
• Service and support history.

4. How We Obtain Personal Information

We may obtain personal information:

• Directly from you;
• From the organisation operating your programme;
• From your employer, customer, programme sponsor or authorised administrator;
• Through integrations, APIs, identity providers and communication platforms;
• From merchants, voucher suppliers and reward-fulfilment partners;
• Automatically when you use our websites or services;
• From publicly available business sources where permitted by law.

Where information is provided by a customer, that customer is responsible for ensuring that it has the authority and appropriate lawful basis to provide the information to KamioKash.

If providing particular information is mandatory, we or the relevant programme operator will explain this at the point of collection. Failure to provide required information may prevent us from creating an account, providing a service, issuing a reward or completing a transaction.

5. Why We Process Personal Information

We process personal information only where permitted by applicable law.

PurposeTypical lawful basis or justification

Creating and managing accounts

Performing a contract or taking requested pre-contractual steps

Operating loyalty and reward programmes

Customer instructions, contract performance and legitimate programme interests

Calculating points, tiers, eligibility and rewards

Providing the programme and applying its published rules

Issuing and redeeming vouchers or gift cards

Contract performance, transaction fulfilment and fraud prevention

Sending service and reward notifications

Contract performance and legitimate service interests

Providing customer support

Contract performance and legitimate business interests

Securing the platform

Legitimate interests, contractual obligations and legal requirements

Detecting fraud and misuse

Legitimate interests and legal obligations

Improving performance and reliability

Legitimate interests, using aggregated or de-identified information where practical

Product analytics and service improvement

Legitimate interests or consent where required

Marketing KamioKash services

Consent or legitimate interests, depending on the communication and applicable law

Billing, accounting and record keeping

Contract performance and legal obligations

Responding to lawful requests

Compliance with legal obligations

Establishing or defending legal claims

Legitimate interests and applicable legal rights

Where we rely on legitimate interests, we consider the necessity of the processing, its expected benefit and its potential effect on the rights and freedoms of affected individuals.

Where we rely on consent, you may withdraw that consent at any time. Withdrawal does not affect processing that occurred lawfully before consent was withdrawn.

We do not rely on consent where processing is necessary to provide a contracted service, maintain platform security or meet a legal obligation.

6. Segmentation, Profiling and Automated Rules

KamioKash allows programme operators to configure rules that may:

• Assign members to segments or tiers;
• Calculate points and reward eligibility;
• Trigger communications;
• Recommend or restrict available rewards;
• Measure performance against programme goals;
• Detect potentially fraudulent or unusual activity;
• Personalise programme content and reward offers.

These activities may constitute profiling under applicable privacy laws.

Programme operators determine the rules used within their programmes. KamioKash provides the technology used to configure and apply those rules.

Most programme rules support routine administration and do not independently produce legal or similarly significant effects.

Where automated processing produces a legal or similarly significant effect, the responsible controller will provide any explanation, review mechanism, opportunity for human intervention or right to contest the decision required by applicable law.

7. Special Personal Information and Children

KamioKash is not designed to collect special-category or sensitive personal information unless this is necessary for a specific programme, permitted by law and protected by appropriate safeguards.

Customers must not submit information concerning health, biometrics, race, ethnic origin, religion, trade-union membership, political beliefs, sexual orientation or criminal history unless this has been expressly agreed with KamioKash and a valid lawful basis exists.

KamioKash’s general business services are intended for adults.

A customer may operate a programme that includes children only where legally permitted and where the customer has implemented the required notices, consent mechanisms and safeguarding measures. KamioKash may require evidence of those measures before enabling such processing.

8. Sharing Personal Information

We may disclose personal information to:

• The organisation operating your programme;
• Authorised programme administrators;
• Reward, voucher and gift-card suppliers;
• Merchants and redemption partners;
• Hosting, cloud-infrastructure and database providers;
• Email, SMS and WhatsApp communication providers;
• Identity, authentication and security providers;
• Customer-support, monitoring and error-diagnostics providers;
• Professional advisers, auditors and insurers;
• Regulators, courts and law-enforcement authorities where legally required;
• A purchaser or successor in connection with a lawful merger, acquisition or restructuring.

We require processors and operators acting on our behalf to process personal information only for agreed purposes and to apply appropriate security and confidentiality safeguards.

Some reward, merchant, communication or fulfilment providers may act as independent controllers or responsible parties. Their privacy notices will apply to the processing they independently determine.

KamioKash does not sell personal information.

A current list of material subprocessors is available at [SUBPROCESSOR PAGE URL] or on request.

9. International Transfers

KamioKash is established in Lithuania and uses customers, personnel and service providers located in different countries.

Personal information may be processed in the European Economic Area, South Africa and other countries in which our customers, infrastructure providers, communication providers or reward partners operate.

Where personal information is transferred outside the European Economic Area or another jurisdiction that restricts international transfers, we apply safeguards required by applicable law.

These safeguards may include:

• An adequacy decision;
• European Commission Standard Contractual Clauses;
• Transfer-risk assessments;
• Contracts requiring appropriate privacy and security protections;
• Additional technical and organisational safeguards;
• Customer instructions and consent where legally required.

For transfers from South Africa, we apply the requirements of POPIA relating to the transfer of personal information to foreign countries.

Information about the safeguards applicable to a particular service may be requested using the contact details below.

10. Retention

We retain personal information only for as long as reasonably required for the purpose for which it was collected, to comply with customer instructions, or to meet legal, security, accounting and dispute-resolution requirements.

Unless a different period is required by law or agreed with a customer, our standard retention periods are:

InformationStandard retention period

Active programme and member records

For the duration of the programme

Inactive member identity and contact information

24 months after the member’s last activity or programme closure

Customer programme data following contract termination

Deleted or returned within 90 days, subject to the customer agreement

Loyalty wallet and reward transactions

7 years after the transaction or programme closure

Voucher, order and redemption records

7 years after redemption, expiry or cancellation

Administrator and platform audit trails

7 years

Login and authentication logs

12 months

General security logs

12 months, or up to 24 months where connected to a security incident

Customer-support records

3 years after the request is closed

Contracts, invoices and accounting records

10 years, or longer where required by applicable law

Privacy requests and consent records

5 years after the request is closed or consent is withdrawn

Security-incident records

7 years after the incident is closed

Marketing contact information

Until an objection or opt-out is received, or 24 months after the last meaningful interaction

Marketing-suppression records

The minimum information required for as long as necessary to honour the opt-out

Website analytics

14 months

Production backups

Normally overwritten or deleted within 35 days

At the end of the applicable retention period, personal information is deleted, anonymised or securely isolated unless continued retention is legally required.

Where transaction or audit records must be preserved, KamioKash may remove or anonymise direct identifiers while retaining non-identifying ledger information needed for reconciliation, fraud prevention, audit or legal claims.

Where KamioKash acts as a processor or operator, retention and deletion are governed by the customer agreement and the customer’s documented instructions.

Retention periods may be extended where:

• A legal or regulatory obligation requires continued retention;
• A dispute, investigation or legal claim is active or reasonably anticipated;
• Information is subject to a lawful preservation request;
• Continued retention is necessary to protect the rights of KamioKash, a customer or another person.

11. Security

We use technical and organisational measures designed to protect personal information against loss, misuse, unauthorised access, alteration and disclosure.

These measures include, where appropriate:

• Encryption in transit and at rest;
• Role-based access controls;
• Multi-factor authentication;
• Tenant and environment separation;
• Secure credential and secrets management;
• Audit logging and monitoring;
• Backups and recovery procedures;
• Vulnerability management and security reviews;
• Access reviews and staff confidentiality obligations;
• Incident-detection and response procedures.

No internet-based service can guarantee absolute security. If you believe that your account or personal information has been compromised, contact us immediately.

12. Direct Marketing and Communications

We may send operational communications required to administer an account, programme, reward, transaction or security event.

Where permitted, we may also send information about KamioKash products, services and events. You may opt out of marketing communications using the unsubscribe facility provided or by contacting us at privacy@kamiokash.com.

Opting out of marketing will not prevent us from sending essential service, security, transactional or programme communications.

Programme communications sent on behalf of a customer are controlled by that customer and the preferences configured for the relevant programme.

13. Cookies and Similar Technologies

Our websites and applications may use cookies and similar technologies to:

• Maintain sessions and authentication;
• Remember preferences;
• Protect forms and prevent abuse;
• Measure website performance;
• Diagnose technical problems;
• Understand how our services are used.

Strictly necessary technologies may operate without consent where permitted by law.

Analytics, advertising or other optional technologies will not be activated until the required information has been provided and valid consent has been obtained.

More information, including cookie providers, purposes and lifespans, is available in our [COOKIE NOTICE URL]. Where available, you can change or withdraw your choices using the website’s cookie-preference controls.

14. Your Rights

Subject to applicable law, you may have the right to:

• Ask whether we hold personal information about you;
• Request access to your personal information;
• Correct or update inaccurate information;
• Request deletion or destruction of information;
• Object to processing based on legitimate interests;
• Request restriction of processing;
• Withdraw consent;
• Opt out of direct marketing;
• Request a portable copy of information you provided;
• Request information about automated processing;
• Request human review of certain automated decisions;
• Lodge a complaint with the relevant privacy regulator.

These rights may be limited where retention or processing is required by law, necessary to protect another person’s rights, or required to establish or defend a legal claim.

15. Exercising Your Rights

To submit a privacy request, contact us at:

Controller: UAB Bluetrino LT
Company registration number: 306121218
Privacy Officer: Laylah Solomon
Privacy email: privacy@kamiokash.com
Postal address: J. Savickio str. 4-7, Vilnius, Lithuania

We may need to verify your identity before completing a request. We will request only the information reasonably required to perform that verification.

Where KamioKash processes information on behalf of a customer, we may refer the request to that customer or respond according to its instructions.

We aim to respond within one month under the GDPR. This period may be extended where permitted for complex or numerous requests. Requests governed by another law will be handled within the period required by that law.

16. Complaints

We encourage you to contact our Privacy Officer first so that we can investigate and resolve your concern:

Privacy Officer: Laylah Solomon
Email: privacy@kamiokash.com

Because UAB Bluetrino LT is established in Lithuania, you may lodge a complaint with the Lithuanian State Data Protection Inspectorate:

State Data Protection Inspectorate
L. Sapiegos str. 17
LT-10312 Vilnius, Lithuania
Email: ada@ada.lt
Website: https://vdai.lrv.lt/en/

You may also lodge a complaint with the data-protection authority responsible for your habitual residence, place of work or the location of the alleged infringement.

Where POPIA applies, you may complain to South Africa’s Information Regulator:

Website: https://inforegulator.org.za/

17. Personal Information Breaches

We maintain procedures for identifying, investigating and responding to personal-information breaches.

Where required by law, we will notify the relevant controller, responsible party, supervisory authority and affected individuals within the applicable timeframes.

Where KamioKash acts as a processor under the GDPR, we will notify the relevant customer without undue delay after becoming aware of a personal-data breach.

Where KamioKash acts as an operator under POPIA, we will notify the relevant responsible party immediately where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person.

18. Third-Party Services and Links

Our services may contain links to, or integrate with, third-party websites, applications, merchants and reward providers.

KamioKash is not responsible for processing independently determined by those third parties. We recommend reviewing their privacy notices before providing personal information or using their services.

19. Changes to This Policy

We may update this Privacy Policy to reflect changes to our services, processing activities or legal obligations.

We will publish the updated policy with a revised “Last updated” date.

Where changes materially affect your rights or how we use personal information, we will provide additional notice where reasonably possible or legally required. Material changes will not be applied retrospectively where doing so would be unlawful.

20. Contact Us

For questions about this Privacy Policy or our handling of personal information, contact:

UAB Bluetrino LT
Company registration number: 306121218
Registered address: J. Savickio str. 4-7, Vilnius, Lithuania
Privacy Officer: Laylah Solomon
Privacy email: privacy@kamiokash.com
Support email: support@kamiokash.com