LoopLink Privacy Policy

Version 1.0

Last Updated: 24 July 2026

1. Introduction

Welcome to LoopLink.

Your privacy is fundamental to the trust that underpins the LoopLink Platform. We believe that data should create value for everyone who contributes to it while remaining protected, transparent and handled responsibly.

This Privacy Policy explains how LoopLink collects, uses, analyses, shares, protects and retains personal information when you use the LoopLink Platform, Pocket, our websites, applications, APIs and any related products or services (collectively, the "Services").

It also explains your rights and the choices available to you.

By using our Services you acknowledge that your personal information may be processed as described in this Privacy Policy and in accordance with applicable privacy legislation.

2. Who We Are

LoopLink is a Retail Intelligence Infrastructure company.

Our platform connects shoppers, retailers, financial institutions, loyalty programmes, payment providers, brands, media platforms and other authorised ecosystem participants to enable trusted commercial verification, retail measurement and data-driven commerce.

LoopLink develops technology that enables participating organisations to:

• verify purchases;
• measure campaign performance;
• optimise promotions;
• improve customer experiences;
• operate loyalty programmes;
• reduce fraud;
• improve retail operations;
• support programmable, trackable and verifiable commerce.

Depending on the country in which our Services are offered, LoopLink may provide services through subsidiaries, affiliates, authorised operating companies or joint venture partners.

Throughout this Privacy Policy, references to "LoopLink", "we", "our" and "us" include LoopLink [Legal Entity Name] Pte. Ltd., together with its subsidiaries, affiliates, authorised operating partners and joint ventures where applicable.

3. Scope of this Privacy Policy

This Privacy Policy applies whenever you:

• create or use a Pocket account;
• visit LoopLink.com or any LoopLink-operated website;
• use any LoopLink mobile application;
• interact with LoopLink through a retailer, bank, loyalty programme or other Commercial Partner;
• participate in promotions, loyalty programmes or campaigns verified by LoopLink;
• use APIs or other services operated by LoopLink where this Privacy Policy is referenced.

Certain Services may also be subject to additional privacy notices issued by participating retailers, banks, loyalty programmes or Commercial Partners.

Where LoopLink processes information on behalf of a Commercial Partner under a separate Data Processing Agreement or other Enterprise Agreement, that partner's own privacy notice may also apply.

Where there is any inconsistency regarding processing carried out on behalf of a Commercial Partner, the applicable contractual arrangements between LoopLink and that Commercial Partner shall prevail for that specific processing activity.

4. Our Privacy Principles

Our approach to privacy is based on several core principles.

Trust

Trust is the foundation of the LoopLink Platform.

We design our systems to support secure, transparent and responsible processing of information.

Transparency

We aim to explain clearly:

• what information we collect;
• why we collect it;
• how it is used;
• who receives it;
• how long it is retained;
• and the choices available to you.

Data Minimisation

We seek to collect only information reasonably necessary to operate our Services, fulfil contractual obligations, comply with legal requirements and improve the Platform.

Security

Protecting information is central to the design of our technology, infrastructure and operational processes.

Responsible Innovation

LoopLink continuously develops new technologies, including artificial intelligence, predictive analytics and Retail Intelligence models.

We strive to ensure these technologies are developed responsibly, proportionately and in accordance with applicable privacy laws.

5. Information We Collect

The information we collect depends on the Services you use and the relationships you have with participating Commercial Partners.

Information may be collected directly from you, automatically through your use of the Platform, or from authorised third parties.

The categories below describe the types of information we may process.

5.1 Information You Provide

You may provide information including:

• your name;
• email address;
• mobile telephone number;
• date of birth where required;
• language preferences;
• country of residence;
• authentication credentials;
• customer support communications;
• survey responses;
• referral information;
• promotional preferences;
• identity verification information where required by Applicable Law.

Certain Services may request additional information where required to comply with legal or regulatory obligations.

5.2 Information Generated Through Your Use of the Platform

As you use the Services, we may generate or receive information relating to:

• purchases;
• transaction events;
• product redemptions;
• campaign participation;
• loyalty programme activity;
• rewards earned;
• referrals;
• shopping behaviour;
• store interactions;
• timestamps;
• device identifiers;
• IP addresses;
• browser information;
• operating system information;
• application version;
• diagnostics;
• fraud prevention signals;
• security events;
• location information where authorised;
• interactions with Platform features.

The exact information collected depends upon the Services used and permissions granted.

5.3 Information Received from Commercial Partners

Subject to Applicable Law and contractual arrangements, LoopLink may receive information from participating Commercial Partners including:

• retailers;
• financial institutions;
• banks;
• payment providers;
• loyalty programmes;
• brands;
• media platforms;
• government programmes;
• technology providers;
• identity providers;
• advertising platforms;
• authorised data providers.

Examples include:

• loyalty identifiers;
• campaign identifiers;
• reward eligibility;
• purchase verification;
• transaction confirmations;
• hashed identifiers;
• authentication confirmations;
• redemption status;
• fraud prevention information;
• account linkage confirmations.

LoopLink does not knowingly purchase consumer data from unrelated data brokers for resale.

5.4 Technical Information

Our systems automatically generate operational information necessary to maintain security, reliability and performance.

This may include:

• log files;
• network activity;
• API requests;
• device health;
• security monitoring;
• authentication events;
• crash reports;
• performance diagnostics;
• fraud detection indicators.

This information helps us secure the Platform and improve the Services.

6. Definitions of Information

Throughout this Privacy Policy, different categories of information are referred to.

Personal Information means information relating to an identified or identifiable individual.

Pseudonymised Information means information where identifying elements have been replaced or transformed but may still relate to an individual using additional information held separately.

Hashed Information means information transformed using cryptographic techniques to support identity matching without routinely transmitting the original identifier.

Aggregated Information means information combined from multiple individuals such that it no longer identifies a specific person.

Derived Intelligence means statistical models, benchmarking information, predictive analytics, Retail Intelligence, commercial insights and other analytical outputs developed through lawful processing of Platform information.

Different categories of information are subject to different legal obligations under Applicable Law.

7. How We Use Information

LoopLink processes information to operate, improve and secure the Platform while enabling trusted collaboration between authorised ecosystem participants.

Depending on the Services used, we may process information to:

• create and manage your Account;
• authenticate your identity;
• verify transactions and commercial events;
• administer loyalty programmes;
• determine eligibility for rewards and promotions;
• verify redemption of offers;
• operate programmable, trackable and verifiable campaigns;
• provide customer support;
• detect, investigate and prevent fraud;
• protect the security and integrity of the Platform;
• measure campaign effectiveness;
• reconcile commercial transactions and settlement events;
• generate Retail Intelligence;
• improve Platform performance;
• develop new products and services;
• comply with legal and regulatory obligations;
• fulfil contractual obligations;
• protect the rights, safety and security of Users and Commercial Partners.

8. Retail Intelligence

Retail Intelligence is one of the core functions of the LoopLink Platform.

Retail Intelligence enables participating ecosystem members to better understand commercial activity while respecting applicable privacy obligations.

Retail Intelligence may include:

• purchasing behaviour analysis;
• campaign attribution;
• conversion measurement;
• customer engagement analysis;
• loyalty insights;
• promotional performance;
• inventory optimisation;
• fraud detection;
• benchmarking;
• predictive analytics;
• demand forecasting;
• commercial scoring;
• operational analytics;
• performance reporting.

Retail Intelligence is developed to improve the effectiveness of participating retailers, financial institutions, loyalty programmes, brands and other authorised Commercial Partners.

9. Profiling and Personalisation

Where permitted by Applicable Law, LoopLink may develop consumer purchasing profiles and behavioural models to improve the operation of the Platform.

Profiling may be used for purposes including:

• recommending relevant offers;
• improving loyalty programmes;
• personalising promotions;
• improving campaign performance;
• optimising marketing investments;
• reducing fraud;
• identifying abuse;
• improving shopper experiences;
• improving retailer operations;
• supporting banking and payment services;
• improving Retail Intelligence;
• developing new Platform capabilities.

Profiling is performed responsibly and in accordance with applicable privacy legislation.

Where Applicable Law requires consent for specific profiling activities, such consent will be obtained before those activities are undertaken.

LoopLink does not sell identifiable consumer profiles as standalone products to unrelated third parties.

10. Artificial Intelligence and Machine Learning

LoopLink may use artificial intelligence ("AI"), machine learning ("ML") and other advanced analytical technologies throughout the Platform.

These technologies may support:

• fraud detection;
• campaign optimisation;
• product recommendations;
• shopper engagement;
• predictive modelling;
• attribution modelling;
• demand forecasting;
• operational optimisation;
• customer support;
• Platform security;
• service improvement;
• development of new technologies.

AI and ML models may be trained using information lawfully processed through the Platform, subject to Applicable Law and contractual obligations.

LoopLink continuously evaluates AI systems to improve fairness, reliability, transparency and security.

AI-generated insights support commercial decision-making but should not be regarded as guarantees of future outcomes.

11. Combined Data and Ecosystem Intelligence

The value of the LoopLink Platform increases through collaboration between authorised ecosystem participants.

Where permitted by Applicable Law and authorised by applicable contractual arrangements, LoopLink may combine information received from multiple authorised Commercial Partners to generate broader Retail Intelligence than any individual participant could reasonably produce independently.

Such information may originate from:

• retailers;
• financial institutions;
• payment providers;
• loyalty programmes;
• brands;
• media platforms;
• government programmes;
• technology providers;
• identity providers;
• other authorised ecosystem participants.

Combined information may be used to:

• improve campaign effectiveness;
• improve customer experiences;
• optimise commercial performance;
• improve fraud detection;
• improve attribution quality;
• generate benchmarking;
• improve demand forecasting;
• improve Platform functionality;
• develop new analytical capabilities.

Wherever possible and appropriate, LoopLink applies techniques such as hashing, pseudonymisation, aggregation or de-identification to minimise the use of directly identifiable information.

12. How We Share Information

LoopLink shares information only where there is a legitimate business purpose, a legal basis, or your consent where required.

Depending on the Services used, information may be shared with:

• participating retailers;
• banks and financial institutions;
• loyalty programme operators;
• payment providers;
• brands funding promotional campaigns;
• technology service providers;
• cloud infrastructure providers;
• customer support providers;
• analytics providers;
• fraud prevention providers;
• government authorities where legally required;
• professional advisers;
• auditors;
• regulators;
• authorised Commercial Partners.

We require recipients to protect information through appropriate contractual, organisational and technical safeguards.

13. Advertising and Campaign Measurement

LoopLink enables brands and Commercial Partners to measure whether marketing activities result in verified commercial outcomes.

To support this functionality, LoopLink may share campaign measurement information with authorised advertising platforms and campaign partners.

Depending on the applicable campaign, this may include:

• hashed identifiers;
• conversion confirmations;
• attribution events;
• campaign identifiers;
• quality scores;
• aggregated reporting;
• performance metrics.

LoopLink does not operate an independent advertising network and does not sell identifiable personal information for unrelated advertising purposes.

Our role is to enable trusted measurement, verification and optimisation of campaigns operated by participating Commercial Partners.

14. International Data Transfers

LoopLink operates internationally.

Your information may therefore be processed by LoopLink entities, affiliates, authorised operating companies, joint ventures or approved service providers located in different jurisdictions.

These jurisdictions may include countries in which:

• our engineering teams operate;
• cloud infrastructure is located;
• Commercial Partners operate;
• customer support is provided;
• Platform services are delivered.

Whenever information is transferred internationally, LoopLink implements safeguards appropriate to the applicable legal framework.

Such safeguards may include:

• contractual data protection obligations;
• standard contractual clauses or equivalent mechanisms;
• technical safeguards;
• encryption;
• access controls;
• organisational security measures;
• or other legally recognised transfer mechanisms.

15. Cookies and Similar Technologies

LoopLink websites and web-based Services use cookies, software development kits (SDKs), pixels, local storage and similar technologies to improve functionality, security and performance.

These technologies may be used to:

• remember preferences;
• authenticate Users;
• improve website functionality;
• analyse Platform performance;
• detect fraud;
• measure campaign performance;
• improve security;
• support customer support services.

Where required by Applicable Law, we will obtain your consent before placing non-essential cookies or similar technologies on your device.

A detailed Cookie Notice may be published separately and forms part of this Privacy Policy where applicable.

16. Legal Bases for Processing

Depending on the jurisdiction in which the Services are provided, LoopLink processes personal information on one or more lawful bases, including:

• your consent;
• performance of a contract;
• compliance with legal obligations;
• protection of vital interests;
• performance of tasks carried out in the public interest where applicable;
• LoopLink's legitimate interests, balanced against your rights and freedoms;
• other lawful bases recognised under Applicable Law.

The specific legal basis may differ depending on the country, the Service used and the relationship between LoopLink, the User and the relevant Commercial Partner.

Where additional consent is required under Applicable Law, LoopLink will seek such consent before processing the relevant information.

17. Data Retention

LoopLink retains information only for as long as reasonably necessary to fulfil the purposes described in this Privacy Policy, comply with Applicable Law, satisfy contractual obligations and protect the integrity of the Platform.

Retention periods may differ depending on the nature of the information, the Services provided and the legal requirements applicable within a particular jurisdiction.

Examples include:

• Account information: for as long as your Account remains active and for a reasonable period thereafter where required for legal, security or fraud prevention purposes.
• Transaction verification records: for the period required to support settlement, auditing, dispute resolution and regulatory compliance.
• Fraud prevention records: for as long as reasonably necessary to investigate, prevent and detect fraudulent or unlawful activity.
• Customer support records: for the duration necessary to resolve enquiries and improve our Services.
• Technical logs and security events: for operational security, incident investigation and Platform integrity.
• Marketing preferences: until you withdraw your consent or object where applicable.

Where information is no longer required, LoopLink will securely delete, anonymise or irreversibly de-identify it, unless continued retention is required by Applicable Law or a contractual obligation.

18. Your Privacy Rights

Depending on your jurisdiction, you may have rights regarding your personal information.

These rights may include the right to:

• be informed about how your information is processed;
• access your personal information;
• request correction of inaccurate information;
• request deletion of information where legally applicable;
• object to certain processing activities;
• restrict processing in specific circumstances;
• withdraw consent where processing is based upon consent;
• request portability of your information;
• request human review of certain automated decisions where required by Applicable Law;
• lodge a complaint with a competent supervisory authority.

The availability of these rights depends upon Applicable Law and the circumstances of the processing activity.

LoopLink will respond to verified requests within the timeframes required under Applicable Law.

19. Exercising Your Rights

Requests relating to your personal information may be submitted using the contact details provided in this Privacy Policy.

Before responding, LoopLink may request reasonable information to verify your identity and protect the privacy and security of other individuals.

Certain requests may be declined where:

• Applicable Law permits refusal;
• another person's rights would be adversely affected;
• legal obligations require continued retention;
• contractual obligations prevent deletion;
• fraud prevention or security obligations require continued processing.

Where a request cannot be fulfilled, LoopLink will explain the reasons where permitted by Applicable Law.

20. Security Measures

Protecting information is fundamental to the operation of the LoopLink Platform.

LoopLink applies technical, organisational and administrative safeguards designed to protect information against unauthorised access, disclosure, alteration or destruction.

Security measures may include:

• encryption in transit and at rest;
• role-based access controls;
• multi-factor authentication;
• network segmentation;
• audit logging;
• security monitoring;
• vulnerability management;
• penetration testing;
• secure software development practices;
• supplier due diligence;
• contractual security obligations;
• employee confidentiality obligations;
• incident response procedures;
• business continuity and disaster recovery planning.

No security system can guarantee absolute protection.

Accordingly, while LoopLink applies commercially reasonable safeguards, no method of transmission or storage can be guaranteed to be completely secure.

21. Data Breach Response

LoopLink maintains procedures for identifying, investigating and responding to security incidents involving personal information.

Where required by Applicable Law, LoopLink will:

• investigate suspected incidents;
• take reasonable steps to contain the incident;
• notify affected Commercial Partners where appropriate;
• notify competent regulatory authorities where required;
• notify affected individuals where legally required;
• implement measures designed to reduce the likelihood of recurrence.

22. Children's Privacy

Unless expressly stated otherwise for a specific Service, the LoopLink Platform is not intended for individuals below the minimum legal age required under Applicable Law.

LoopLink does not knowingly collect personal information from children without appropriate legal authorisation.

Where we become aware that information has been collected in violation of Applicable Law, reasonable steps will be taken to delete or otherwise appropriately handle such information.

23. Enterprise Agreements and Commercial Partners

Certain processing activities are carried out on behalf of Commercial Partners under separately negotiated contractual arrangements.

These arrangements may include:

• Master Services Agreements (MSA);
• Data Processing Agreements (DPA);
• Joint Venture Agreements (JV);
• Banking Agreements;
• Loyalty Programme Agreements;
• Commercial Agreements;
• Government Agreements;
• API Agreements;
• Integration Agreements;
• or other Enterprise Agreements.

Where LoopLink processes information solely on behalf of a Commercial Partner, LoopLink may act as a processor, service provider or similar role recognised under Applicable Law, while the Commercial Partner remains the controller or equivalent legal entity responsible for determining the purposes of processing.

Where this Privacy Policy differs from a separately executed Enterprise Agreement governing a specific processing activity, the Enterprise Agreement shall prevail for that processing activity to the extent permitted by Applicable Law.

24. International Operations

LoopLink intends to provide Services in multiple countries and jurisdictions.

Accordingly, this Privacy Policy has been designed as a global framework.

Country-specific legal requirements may be addressed through supplementary Country Schedules or Local Privacy Notices.

Where mandatory local privacy legislation grants greater rights or imposes additional obligations, those local legal requirements shall prevail to the extent required.

Nothing in this Privacy Policy limits rights granted under mandatory privacy legislation applicable in your jurisdiction.

25. Changes to this Privacy Policy

LoopLink may update this Privacy Policy from time to time to reflect:

• changes in our Services;
• new Platform capabilities;
• technological developments;
• regulatory requirements;
• judicial decisions;
• industry best practices;
• security improvements.

Where changes are material, we will provide appropriate notice as required by Applicable Law.

The revised version will become effective on the date specified at the beginning of this Privacy Policy.

26. Contacting LoopLink

If you have questions regarding this Privacy Policy or wish to exercise your privacy rights, please contact:

LoopLink Pte. Ltd.

Data Protection Officer: Sumanth Nag

Email: info@looplink.aiRegistered Address: 36 Robinson Road, #20-01 City House, 068877, Singapore, SingaporeWebsite: www.looplink.ai

Where required by Applicable Law, additional local contact details may be published for specific jurisdictions.

27. Complaints

If you believe your personal information has been processed unlawfully, we encourage you to contact LoopLink first so that we may investigate and attempt to resolve your concern.

You also have the right, where provided by Applicable Law, to lodge a complaint with the competent supervisory authority or data protection regulator in your jurisdiction.

Schedule A – Country-Specific Privacy Requirements

LoopLink may publish Country Schedules that supplement this Privacy Policy for individual jurisdictions.

Country Schedules may address:

• local privacy legislation;
• international data transfer requirements;
• marketing consent requirements;
• retention obligations;
• regulatory registrations;
• local supervisory authorities;
• consumer rights;
• banking regulations;
• electronic communications requirements;
• cookie regulations;
• and other jurisdiction-specific legal obligations.

Where a Country Schedule conflicts with this Privacy Policy, the Country Schedule shall prevail for individuals located in that jurisdiction to the extent required by Applicable Law.