LoopCo Privacy Policy

Policy version: February 2026

Section 1

Who We Are

LoopCo Ltd is the operator of the LOOP consumer engagement platform.

Registered address: 219 Burton Road, Derby, England, DE23 6AE
Company number: 16978729
Email: [INSERT]

For the purposes of data protection law, LoopCo acts as an independent controller of your personal data.

Brand partners participating in LoopCo campaigns are also independent controllers of any personal data you choose to share with them. This means they are independently responsible for how they use your personal data once it has been shared with them. LoopCo does not control, and is not responsible for, the processing of your personal data by brand partners after it has been shared in accordance with your consent.

Section 2

How You Engage with LOOP

LoopCo operates a digital consumer engagement platform that enables individuals to interact with campaigns, brand activations, and promotions using QR-enabled technology and related digital interfaces (the “Platform”).

The Platform, including all campaign pages, QR code routing infrastructure, data capture forms, and associated systems, is owned and operated by LoopCo Ltd.

You may interact with LoopCo and the Platform in one or more of the following ways:

2.1 Scanning LoopCo-enabled QR codes

You may access the Platform by scanning a QR code that is deployed by or on behalf of LoopCo. These QR codes may appear on or in connection with:

• Reusable water bottles, flasks, or other physical products;
• Product packaging;
• Retail environments;
• Events and sponsorship activations or campaigns;
• Digital media, advertising materials, or physical signage; and/or
• Other campaign touchpoints operated by or on behalf of LoopCo.

Each QR code may be uniquely identifiable and linked to a specific campaign, activation, location, or brand partner. When you scan a QR code, you will typically be directed to a LoopCo-hosted digital interface, such as a campaign landing page or entry form.

2.2 Accessing and using campaign pages and forms

You may interact with LOOP by accessing campaign-specific pages hosted on the Platform. These pages may enable you to:

• Learn about a campaign or promotion;
• Submit personal information;
• Enter prize draws, competitions, or giveaways;
• Receive rewards, incentives, or promotional offers;
• Respond to surveys, questionnaires, or campaign engagement prompts;
• Express preferences or interests; and/or
• Opt-in to receive communications from LoopCo and/or participating brand partners.

These campaign pages are operated and controlled by LoopCo, even where they relate to or feature third-party brands.

2.3 Providing information voluntarily

You may provide personal data to LoopCo when you:

• Complete forms hosted on the Platform;
• Register for or participate in campaigns;
• Enter prize draws or promotional activities;
• Opt-in to receive marketing communications;
• Communicate with us by email, webform, or other electronic means; or
• Otherwise choose to submit information through the Platform.

2.4 Opting in to brand partner communications

Where clearly presented to you at the point of collection, you may choose to opt in to receive communications from one or more participating brand partners.

Where you provide such opt-in consent:

• LoopCo will share your relevant personal data with the selected brand partner(s); and
• Each brand partner will act as an independent controller of your personal data.

You may withdraw your consent to receive communications from a brand partner at any time by contacting the brand partner directly or using the unsubscribe mechanisms provided.

2.5 Participating in prize draws, competitions and promotions

The Platform may enable you to participate in prize draws, competitions, giveaways, or similar promotional activities administered by LoopCo (each, a “Promotion”).

Participation may involve:

• Submitting entry forms;
• Providing eligibility information;
• Confirming compliance with applicable Promotion Rules; and
• Receiving prize notifications or fulfilment communications.

Each Promotion will be governed by separate Promotion Rules.

2.6 Automatic collection of technical and interaction data

When you access or interact with the Platform, certain technical and interaction data may be collected automatically. This may include:

• Device information;
• Browser information;
• IP address;
• Interaction timestamps;
• Campaign engagement data; and
• QR code interaction data.

This data helps us operate, secure, and improve the Platform and administer campaigns.

2.7 Interaction across multiple campaigns and brand partners

The Platform is designed to support multiple campaigns and participating brand partners. Your interactions with different QR codes, campaigns, or promotions may be linked within LoopCo’s systems in order to:

• Operate and administer the Platform;
• Maintain accurate records of your participation;
• Deliver rewards or prizes; and
• Improve platform functionality and user experience.

LoopCo remains the operator and controller of the Platform and its underlying systems.

2.8 No obligation to participate

You are not required to scan QR codes, provide personal data, or participate in campaigns. Your use of the Platform and provision of personal data is entirely voluntary. However, if you choose not to provide certain information, you may not be able to participate in specific campaigns, promotions, or rewards.

Section 3

Personal Data We Collect

We collect personal data when you interact with the LoopCo platform, including when you scan a QR code, participate in campaigns, enter promotions, submit forms, or communicate with us. The personal data we collect falls into the following categories.

Information you provide

Identity and contact data, including:

• Full name
• Email address
• Telephone number
• Postal address

Eligibility data, including:

• Date of birth or age confirmation
• Country of residence

Campaign and response data, including:

• Information submitted through forms
• Survey responses and campaign entries

Marketing and preference data, including:

• Marketing consent choices
• Brand partner opt-in selections
• Communication preferences

Information collected automatically

Technical data, including:

• IP address
• Device type and identifiers
• Operating system
• Browser type and version

Usage data, including:

• QR codes scanned
• Campaign interactions
• Dates and times of access
• Pages viewed and links clicked

Location data, including:

• Approximate location data derived from your IP address
• Campaign or activation location associated with a QR code

Campaign and promotional data

Where you participate in campaigns or prize draws, we collect data necessary to administer these promotions, including:

• Entry records
• Eligibility verification
• Winner selection records
• Prize fulfilment and delivery information
• Communications relating to promotions.

Marketing and consent records

We maintain records of consents you have provided (including your consent status, timestamp and source of consent), brand partner opt-ins, communication preferences and consent withdrawals.

Data received from brand partners and service providers

We may receive limited personal data from brand partners and service providers where necessary to operate campaigns or deliver prizes, such as fulfilment confirmations or eligibility validation. Brand partners act as independent controllers of personal data they collect directly from you.

Derived and aggregated data

We may generate data based on your interactions with the platform, such as participation history and engagement metrics, to operate, improve, and analyse the Platform. We may also use aggregated or anonymised data that does not identify you.

Section 4

How We Use Your Personal Data

We use your personal data only where permitted by applicable law. Depending on how you interact with the LoopCo platform, we may use your personal data for the purposes set out below. We rely on one or more of the following legal bases under UK GDPR:

• Performance of a contract with you (Article 6(1)(b));
• Compliance with legal obligations (Article 6(1)(c));
• Our legitimate interests (Article 6(1)(f)), where these are not overridden by your rights; and
• Your consent (Article 6(1)(a)), where required.

To provide and operate the Platform

We use your personal data to operate, administer, and deliver the Platform and associated campaign experiences, including to:

• Enable you to access campaign pages and digital experiences;
• Register and record your participation in campaigns, activations, and promotions;
• Provide rewards, incentives, content, and campaign functionality;
• Authenticate and verify your interactions with LoopCo-enabled QR codes;
• Administer your participation in prize draws, competitions, and promotions;
• Communicate with you regarding your participation;
• Provide customer support and respond to enquiries.

Legal basis: Article 6(1)(b) (performance of a contract) and Article 6(1)(f) (legitimate interests in operating and administering our platform).

To administer promotions, prize draws and incentives

Where you participate in promotions or prize draws, we use your personal data to:

• Verify your eligibility;
• Prevent duplicate, invalid, or fraudulent entries;
• Select winners in accordance with applicable promotion rules;
• Notify winners and arrange prize fulfilment;
• Publish or make available winner information where required by law or the CAP Code;
• Maintain appropriate records to demonstrate regulatory compliance.

Legal basis: Article 6(1)(b) (performance of a contract), Article 6(1)(c) (legal obligation), and Article 6(1)(f) (legitimate interests in administering lawful promotions).

To share personal data with brand partners where you opt-in

Where you are presented with a clear choice and provide your explicit consent, we will share your personal data with the specific brand partner identified at the point of collection. Brand partners may use your personal data to:

• Send you marketing communications;
• Provide offers, content or promotions;
• Conduct customer engagement and marketing activities in accordance with their own Privacy Policies.

Legal basis: Article 6(1)(a) (consent) and, where applicable, consent under PECR.

To send marketing communications where you have consented

Where you have provided consent, we may use your personal data to send you marketing communications relating to:

• LoopCo campaigns and promotions;
• Platform updates;
• Rewards, offers, and incentives;
• Relevant opportunities available through the Platform.

You may withdraw your consent at any time by using the unsubscribe link in communications or contacting us.

Legal basis: Article 6(1)(a) (consent) and, where applicable, consent under PECR.

To analyse, develop and improve our Platform and services

We use personal data and interaction data to better understand how users engage with the Platform, including to:

• Analyse campaign performance and user engagement;
• Improve platform functionality, usability, and effectiveness;
• Develop new features, products, and services;
• Optimise campaign design and delivery;
• Generate aggregated and anonymised analytics and insights.

Legal basis: Article 6(1)(f) (legitimate interests in improving and developing our platform and services).

To ensure Platform security, integrity and lawful use

We use personal data to maintain the security and integrity of the Platform, including to:

• Detect, investigate and prevent fraud, abuse, or misuse;
• Prevent unauthorised access;
• Protect our systems, users and brand partners;
• Enforce our Platform terms and Promotional Rules;
• Monitor Platform performance and reliability.

Legal basis: Article 6(1)(f) (legitimate interests in ensuring platform security and preventing fraud).

To comply with legal and regulatory obligations

We may use personal data where necessary to:

• Comply with applicable laws, regulations and regulatory requirements;
• Respond to lawful requests from regulators, courts, or authorities;
• Establish, exercise, or defend legal rights and claims;
• Maintain compliance records and audit trails.

Legal basis: Article 6(1)(c) (legal obligation) and Article 6(1)(f) (legitimate interests in protecting our legal position).

Section 5

Marketing and Communications

Where you have provided your consent, we may send you marketing communications relating to:

• LoopCo campaigns, promotions, and prize draws;
• Offers, incentives and rewards; and
• Platform features and updates.

These communications may be sent by [email, SMS, or other electronic means].

LoopCo will only send such communications where permitted by applicable law, including the Privacy and Electronic Communications Regulations 2003.

You may withdraw your consent to receiving marketing communications at any time by:

• Clicking the unsubscribe link in any marketing communication;
• [Adjusting your preferences through the Platform]; or
• Contacting us at [insert details].

Section 6

Sharing Your Personal Data

We do not sell your personal data. We only share your personal data where necessary for legitimate business purposes, where you have given your consent, or where we are required or permitted to do so by law. Where your personal data is shared, this will always be subject to appropriate contractual, technical and organisational safeguards.

Sharing with brand partners

Where you expressly choose to opt-in to receive communications, offers, or marketing from a participating brand partner through the Platform, we will share the personal data specified at the point of collection with that brand partner. This may include, for example:

• Your name;
• Your email address;
• Your contact details;
• Campaign participation data; and
• Any preferences or responses you choose to provide.

Each brand partner will be clearly identified to you at the point where you provide your consent.

Sharing with service providers

We may share personal data with carefully selected third-party service providers who process personal data on our behalf and only in accordance with our instructions. These providers help us operate, maintain and improve the Platform and administer campaigns.

These may include providers of: [insert generic categories of any third parties that you may be engaging with in the provision of your services].

All such service providers are contractually required to:

• Process personal data only on our instructions;
• Maintain appropriate security measures; and
• Comply with applicable data protection laws.

These service providers are not permitted to use your personal data for their own purposes.

Sharing within the LoopCo group

We may share your personal data with other companies within the LoopCo corporate group, where applicable, for internal administrative purposes, platform operation, customer support, and business management. Any such sharing will be subject to appropriate safeguards and internal data protection policies.

Legal and regulatory disclosures

We may disclose your personal data where necessary to:

• Comply with our legal or regulatory obligations;
• Respond to lawful requests from courts, regulators, or law enforcement authorities;
• Enforce our legal rights;
• Prevent fraud, misuse or unlawful activity;
• Protect the rights, property or safety of LoopCo and our users.

Corporate transactions

If LoopCo is involved in a merger, acquisition, restructuring, investment, asset sale, or similar corporate transaction, your personal data may be disclosed to relevant third parties such as prospective purchasers, investors, advisers, or acquiring entities. In such cases, your personal data will remain subject to appropriate confidentiality safeguards and applicable data protection law.

Section 7

Data Retention

We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying legal, regulatory, accounting, and reporting requirements.

Retention periods are determined based on applicable legal obligations, regulatory expectations, operational necessity, and our legitimate business interests in operating and protecting the Platform.

We retain personal data relating to your interaction with the LOOP platform, including campaign participation, submissions, and engagement records, for the duration of the relevant campaign and for a period of up to [insert retention period e.g. 24 months] thereafter.

Where you have provided consent to receive marketing communications or to share your data with brand partners, we retain your contact details, consent records, and associated engagement data for as long as your consent remains valid and for a period of up to [insert period e.g. 6 years] following withdrawal of consent, in order to demonstrate compliance with applicable data protection laws, maintain suppression lists, and establish, exercise, or defend legal claims. Where you withdraw consent, we will cease processing your personal data for marketing purposes without undue delay.

Where you participate in a prize draw, promotion, or incentive programme, we may retain relevant personal data for up to [insert period e.g. 6 years] from the end of the promotion.

Technical and device related data may be retained for [insert period e.g. 24 months], except where a longer retention period is required, or the data is aggregated or anonymised.

Where personal data is no longer required, we will either securely delete it, or irreversibly anonymise it so that it can no longer be associated to you. Anonymised data may be retained indefinitely for analytics, reporting, and platform improvement purposes.

Personal data may remain in secure backup systems for a limited period after deletion. Such data will be isolated, protected from further processing, and deleted in accordance with our internal backup retention policies.

Section 8

Your Rights

Under UK data protection law, you have the following rights in relation to your personal data. These rights are subject to certain legal conditions and exemptions.

For further information on each of those rights, including the circumstances in which they do and do not apply, please contact us. You may also find it helpful to refer to the guidance from the UK’s Information Commissioner on your rights under the UK GDPR.

Please note that in some circumstances the exercise of the above rights may be limited by legal restrictions and exemptions. If relevant, we will explain this when responding to a request to exercise data protection rights.

If you would like to exercise any of those rights, please contact us at [insert contact details]. When contacting us please:

• Provide enough information to identify yourself (e.g. your full name, address and customer or matter reference number) and any additional identity information we may reasonably request from you; and
• Let us know which right(s) you want to exercise and the information to which your request relates.

We shall respond to all legitimate requests within one month from the date we receive the request, and will contact you if we require more information to verify your identity or clarify your request. Occasionally, it may take us longer, taking into account the complexity of your request and volume of data involved. If we require more time, we will let you know.

Requests are normally free of charge. However, we may charge a reasonable fee or refuse a request where it is manifestly unfounded, excessive, or repetitive, as permitted by law.

You have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) if you believe your personal data has been processed unlawfully. ICO contact details:

Information Commissioner’s Office
Wycliffe House, Water Lane
Wilmslow, Cheshire, SK9 5AF
Website: www.ico.org.uk
Telephone: 0303 123 1113

We encourage you to contact us first so we can try to resolve your concern.

Section 9

Cookies and Similar Technologies

A cookie is a small text file which is placed onto your device (e.g. computer, smartphone or other electronic device) when you access or interact with the Platform.

The Platform uses cookies and similar technologies to operate effectively, deliver campaign experiences, administer promotions, analyse engagement, and protect the integrity and security of the Platform. Cookies allow the Platform to recognise your device and store certain information about your interaction with the Platform.

We may also use similar technologies, including pixels, tags, web beacons, software development kits (SDKs), local storage, and unique identifiers (together, “Cookies and similar technologies”).

We also use third-party cookies that help us analyse how you use this website, store your preferences, and provide the content and advertisements that are relevant to you. These cookies will only be stored in your browser with your prior consent.

You can choose to enable or disable some or all of these cookies but disabling some of them may affect your browsing experience.

The following describes how we use different categories of Cookies and similar technologies and your options for managing the data collection settings of these technologies:

When you first access the Platform, you will be presented with a cookie consent mechanism. This allows you to accept all cookies, reject non-essential cookies, or manage your preferences. We do not place non-essential cookies on your device without your consent.

Who sets cookies

LoopCo (first-party cookies) – These cookies are controlled directly by LoopCo and used to operate the Platform.

Third-party service providers (third-party cookies) – We may use trusted service providers to support:

• Platform hosting and infrastructure;
• Analytics and performance monitoring;
• Campaign administration;
• Messaging and communications services.

These providers process personal data only on our instructions and in accordance with applicable data protection laws.

Cookie duration

Cookies may remain on your device for different periods depending on their purpose.

Session cookies remain on your device only while your browser session is active and are deleted when you close your browser.

Persistent cookies remain on your device until they expire or are deleted. These cookies are retained only for as long as necessary to fulfil their purpose.

Managing your cookie preferences

You may manage or withdraw your consent at any time by adjusting your cookie preferences via the Platform or by modifying your browser settings. Instructions for managing cookies are available from your browser provider.

Please note that disabling certain cookies may affect the functionality of the Platform. If you disable cookies, some Platform features may not function properly, including:

• Campaign participation;
• Prize draw entry;
• Campaign attribution;
• Platform performance.

Section 10

Changes to This Privacy Policy

We may change this privacy policy from time to time. When we make significant changes, we will take steps to inform you, for example by including a prominent link to a description of those changes on our website for a reasonable period.