Rewallo is a digital loyalty service operated by AviaTravel OÜ, registration number 17586406, Tornimäe tn 5, Kesklinna linnaosa, 10145 Tallinn, Estonia. Contact us about privacy at support@rewallo.com or through /support. This notice explains how we handle personal information when you use our website, business workspace and loyalty-card services.
Who is responsible
We act as controller for our business-account contacts, subscriptions, accounting, support and service security. A participating business normally decides why its customers join its loyalty programme and how rewards work. For membership information processed on that business’s instructions, the business is the controller and Rewallo acts as processor under the Data Processing Agreement. Contact the business first about its programme; we can help identify the relevant business and pass on a request.
Information and purposes
Business registration collects your name, business name and type, email, phone, business address, country and password; some address and website fields are optional. We use these details to establish and operate your workspace and subscription. Passwords are hashed rather than stored as readable passwords.
Customer membership collects name, email and phone, a membership identifier, stamps, rewards and activity records. These details operate the chosen loyalty programme and deliver service messages. Joining a programme does not subscribe a customer to marketing.
Billing information includes contact and optional company/tax details, plan and processor identifiers, payment status and invoice records. Payment card information is entered with the payment processor. The application does not store complete payment card numbers or card security codes.
Support correspondence contains what you submit and our response. Please do not send passwords or payment card details. Operational/security records can include technical request information, account identifiers, error categories and authentication/session records. Hosting and mail providers may separately keep infrastructure delivery/access records.
Legal bases
For account and billing contacts, we rely on performing a contract where the individual is the contracting party, or legitimate interests in administering a business relationship where the individual represents a business. We process accounting records to meet applicable legal obligations. Support and proportionate service-security processing rely on providing the service and legitimate interests in responding to enquiries and preventing abuse. Where optional processing requires consent, it must be offered separately and may be withdrawn without losing essential service access. Customer-programme legal bases are determined and communicated by the participating business.
Recipients and international transfers
Information is shared only as needed with authorised personnel and contracted providers supporting hosting, email, payments, and optional wallet or editorial-AI features. See Service Providers for the services and recipient categories involved. Apple or Google receive information when you choose the corresponding Wallet flow. Editorial-AI inputs are described in AI Usage Disclosure; membership data is not automatically included in those prompts by this integration.
Where a transfer outside the EEA requires safeguards, the responsible controller must establish an applicable adequacy mechanism or appropriate safeguards, such as standard contractual clauses and supplementary measures as required. We do not promise that every provider stores every record exclusively within the EU. Ask support@rewallo.com for information about the safeguards applicable to your data and how to obtain a copy.
Retention
Account records are kept for the active relationship and subsequently only as required for closure, security, disputes and legal obligations. Membership information is held on the participating business’s instructions; cancellation of a subscription is not itself a request to erase every membership or accounting record. Support records are retained while resolving the enquiry and for a justified follow-up/dispute period. Financial records are retained for applicable statutory accounting periods. Backups and infrastructure logs have separate rotation schedules. Retention is determined by the purpose of the record, whether the account or enquiry remains active, controller instructions, outstanding disputes and applicable legal duties. Accounting source documents are generally retained for seven years from the end of the relevant financial year under Estonian accounting rules. Contact us for information about your records. Deletion from active systems and expiry of backup copies can occur at different times; retained copies remain subject to access restrictions.
Your rights
Subject to the applicable rules, you may request access, correction, erasure, restriction and portability, object to relevant processing, and withdraw consent where processing relies on consent. We may need proportionate identity checks to protect your information. Some information may need to be retained to meet legal obligations or establish/defend claims; we explain applicable limits when responding. Send requests to support@rewallo.com. We respond without undue delay and normally within one month; where the law permits an extension because of complexity or the number of requests, we explain the extension within that first month. For customer-programme records, we coordinate with the responsible business.
You may complain to a competent supervisory authority, including the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), https://www.aki.ee/en. This does not prevent contacting an authority in your country where applicable.
Storage, security and automated decisions
Cookie Policy explains essential browser storage and privacy controls. Data Security describes implemented safeguards and their limits. The editorial-AI integration does not decide customer eligibility or automatically award stamps or rewards. We do not sell membership data through this service.
Changes
The page shows its update date and version. Material changes to purposes or contractual commitments require appropriate notice and, where necessary, a new choice or agreement. A changed notice does not retrospectively create consent.