Privacy Statement

1. Introduction

Loop Your Spare Ltd (“Loop Your Spare”, “LYS”, “we”, “us” or “our”) respects your privacy and is committed to protecting personal data. This Privacy Statement explains how we collect, use, disclose, retain and protect personal data when you visit our website, request information or a product demonstration, register for or use our platform on a Free Plan, Pro Plan or Enterprise Plan, communicate with us, or otherwise use our services (together, the “Services”).

This Statement applies where Loop Your Spare acts as a controller. Where a business customer uploads or otherwise processes personal data through the platform and determines the purposes and means of that processing, that customer is the controller and Loop Your Spare acts as its processor under our Data Processing Agreement. In that case, the customer’s own privacy notice applies and you should contact the customer about your personal data.

2. Controller and contact details

For data protection queries or to exercise your rights, email contact@loopyourspare.com. We have not appointed a Data Protection Officer, as we are not currently required to do so. If that changes, the contact details will be published here.

3. Personal data we collect

3.1 Website and enquiry data

• Your name, business email address, telephone number and job title.
• Company or organisation name.
• The content of messages, enquiries and correspondence.
• Information submitted when requesting information, a demonstration, an onboarding discussion, registration for a Free Plan, Pro Plan or Enterprise Plan, or sales contact.
• Marketing preferences and records of consent or objection.

3.2 Registration and account data

• Name, work email address, company, role and account identifiers.
• Authentication and security information, such as password hashes, multi-factor authentication status and login history. We do not store passwords in readable form.
• Organisation, project, site and team membership information.
• Customer support requests and account administration records.

3.3 Platform content

• Material listings, descriptions, quantities, locations, images, notes and supporting records uploaded by users.
• Project, site and organisation details.
• Records of materials registered, claimed, transferred, reused or otherwise managed through the platform.
• Impact and reporting data, such as estimated cost, waste and carbon savings.
• User actions needed for audit trails, security, reporting and dispute resolution.

3.4 Technical and usage data

• IP address, device type, operating system, browser type, app version and language.
• Login times, pages or features used, session information, interaction events, error logs and diagnostic data.
• Security events, suspected misuse and fraud-prevention information.
• Cookie identifiers and analytics data, subject to your cookie choices.

3.5 Subscription, billing and payment data

• Selected plan, billing cycle, subscription status, renewal date and account entitlements.
• Billing contact, company name, billing address, country and VAT or other tax number where applicable.
• Invoices, credits, transaction identifiers, payment status and limited payment-method information provided by the payment processor, such as card brand and last four digits.

We do not receive or store full card numbers or card security codes. Card details are entered directly into the systems of our payment provider, Stripe Payments Europe, Limited (“Stripe”), which processes them under its own terms and privacy notice.

3.6 Data from other sources

• Information supplied by your employer or organisation administrator (for example, your name, work email address and role when you are added as a user).
• Information from integration partners that you choose to connect.
• Publicly available business information and professional contact information, where lawful (for example, from company websites or professional networking sites).
• Payment and fraud-prevention information from Stripe.

3.7 Whether you must provide your data

Where we ask for information to create an account, administer a subscription or respond to a request (for example, your name, work email and billing details), we need it to enter into or perform a contract with you or your organisation, or to meet legal obligations. If you do not provide it, we may not be able to provide the Services. Any other information is optional.

4. Purposes and legal bases

Where we rely on legitimate interests, we consider whether the processing is necessary and balanced against the rights and interests of affected individuals. You may request further information about this assessment.

5. Cookies and Google Analytics

We use cookies and similar technologies as described in our Cookie Policy. Google Analytics is switched off until you give consent through the cookie banner, unless applicable law permits a configuration that does not require consent. You can reject non-essential cookies as easily as you can accept them, and you can change your choice at any time through Cookie Settings.

6. Disclosure of personal data

We disclose personal data only where reasonably necessary, and only to the following categories of recipients:

• Cloud hosting, storage, database, authentication, support, security and communications providers acting as our processors.
• Google Ireland Limited, for website analytics, and only if you consent to analytics cookies.
• Stripe, our payment service provider.
• Professional advisers, auditors, insurers, banks and accountants.
• Customer organisations and organisation administrators, where they manage users and projects.
• Integration partners selected by the customer.
• Public authorities, regulators, courts and law-enforcement bodies where required or permitted by law.
• A buyer, investor or successor in connection with a proposed or completed corporate transaction, subject to appropriate confidentiality and data protection safeguards.

Processors acting on our behalf may process personal data only on our documented instructions, must keep it confidential and must implement appropriate security measures. A list of our current sub-processors is available on request at contact@loopyourspare.com.

7. International transfers

Some service providers, including Google and Stripe, may process personal data outside Ireland or the European Economic Area, for example in the United States. Where this occurs, we ensure a lawful transfer mechanism is in place, such as an adequacy decision (including the EU–US Data Privacy Framework for certified providers), the European Commission’s Standard Contractual Clauses or another mechanism permitted by data protection law, together with supplementary safeguards where required. You can request information about the relevant safeguards at contact@loopyourspare.com.

8. Retention

We retain personal data for no longer than necessary for the purposes described above, taking account of contractual, legal, accounting, security and dispute-resolution needs. Our indicative retention periods are:

• Unsuccessful general enquiries and product demonstration or service enquiries: normally up to 24 months after the last meaningful interaction, unless a shorter period is appropriate or you object.
• Account and active subscription data: for the duration of the account or customer relationship.
• Deleted account profile data: deleted or irreversibly anonymised without undue delay once we have verified your request, and normally within one month of receiving it, subject to the exceptions in our Account Deletion Policy.
• Security and significant-action audit logs: normally 12 months, unless needed for longer to investigate an incident or claim.
• Invoices, payment and accounting records: for the period required by Irish tax, accounting and company law.
• Consent and suppression records: as long as necessary to demonstrate preferences and to ensure that marketing objections continue to be respected.
• Backups: overwritten according to our backup cycle. Data held only in backups is isolated from ordinary use and removed through normal rotation, unless restoration is required for security or continuity.

9. Security

We use technical and organisational measures appropriate to the risks, including access controls, authentication safeguards, encryption where appropriate, logging, backups, vulnerability management and staff confidentiality measures. No service can guarantee absolute security. Users must protect their login credentials and notify us promptly of suspected unauthorised access.

10. Your rights

Subject to applicable conditions and exemptions, you have the right to:

• Access your personal data and receive information about its processing.
• Have inaccurate or incomplete personal data corrected.
• Request erasure of your personal data.
• Request restriction of processing.
• Object to processing based on legitimate interests, and object at any time to direct marketing.
• Receive certain personal data in a structured, commonly used and machine-readable format and transmit it to another controller.
• Withdraw consent at any time, without affecting processing carried out before withdrawal.
• Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects, where applicable.

Send requests to contact@loopyourspare.com. We may ask for information reasonably necessary to verify your identity and authority. We will respond without undue delay and in any event within one month of receiving your request. That period may be extended by up to two further months where permitted for complex or numerous requests, and we will tell you within the first month if we need to extend it. Rights are not absolute, and lawful exemptions may apply.

11. Complaints

You have the right to complain to the Irish Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28 (https://www.dataprotection.ie/). We would appreciate the opportunity to address your concerns first, but this does not affect your right to complain.

12. Children

The Services are designed for professional and business use and are not directed to children. We do not knowingly offer the Services directly to children under 16 or knowingly collect their personal data through registration.

13. Automated processing and AI

The platform may use automated or AI-assisted functionality to support material identification, forecasting, matching or reporting. We do not use solely automated processing to make decisions about individuals that produce legal or similarly significant effects. We do not use customer content that contains personal data to train AI models for other customers or for general-purpose use. Outputs may be estimates and should be reviewed by authorised users. Where you interact directly with an AI system, we will make that clear.

14. Changes

We may update this Statement to reflect changes in law, technology, providers or the Services. We will publish the revised version and update the date above. Where changes materially affect individuals, we will give additional notice where appropriate.