Smile has published this Privacy Policy (or privacy notice) to tell you about how we collect, use, disclose and store personal information. We think transparency is important, but providing that transparency requires us to make this notice longer than we would like. That is why we have set out the highlights at the top. We have made the full notice as user-friendly as we could, but we would also welcome your questions and comments (see Contact Us).
Highlights of this Notice
- Customers of Our Merchants: We may obtain your personal information when we provide services to merchants, including merchants that use our services to operate loyalty programs. We process this personal information on our merchants’ behalf and recommend you review your merchant's privacy policy and contact them with any complaints, questions or requests. We also obtain and control personal information about customers when they use our services directly.
- Merchants and Their Users: Most information we collected about merchants is business information, not personal information. We use any personal information collected to support and better understand our merchants and provide and improve our services.
- Website / Support Service Users: We collect personal information you provide directly, such as your contact information, and information collected through cookies and similar tools. We use this to provide the website, support and better understand our users and provide and improve our services.
- Employees / Contractors / Applicants: If you apply for a job with Smile, we use your personal information to consider hiring you. If we hire you, we will use your personal information in connection with your employment. A separate privacy notice may apply to employees.
Application of This Notice
What this notice covers
This notice applies to all personal information that we collect, use, disclose and store when you apply for a job with Smile or access our services. “Smile” includes Smile Inc. and any related companies anywhere in the world.
Wallet Passes
Merchants may use Smile to offer their customers merchant-branded loyalty passes through Apple Wallet or Google Wallet ("Wallet Passes"). For Wallet Passes, Smile generally processes personal information on behalf of the applicable merchant. The merchant remains responsible for its relationship with its customers and for providing required notices and choices.
In connection with Wallet Passes, Smile may process information already used to provide the merchant loyalty program, such as name, email address, points balance, VIP tier and store credit, together with wallet-specific information such as pass serial numbers, Google pass object identifiers, device type, device library identifiers, device push tokens, authentication tokens, installation or removal status and point-of-sale scan events. Smile uses this information to create, issue, authenticate, display, update, maintain and support Wallet Passes, deliver operational pass updates, enable customer identification at point of sale, troubleshoot the service and protect its security and integrity.
Smile communicates information and content needed to provide Wallet Passes to Apple or Google, depending on the wallet selected. Apple and Google process information in accordance with their own applicable terms and privacy practices. If a customer removes a Wallet Pass, Smile will seek to delete information used only to provide that pass or remove customer-facing pass fields, subject to the wallet provider functionality available to Smile and Smile receiving the relevant removal event. Information required for the underlying merchant loyalty program may continue to be retained as described in this notice and the merchant's privacy notice.
What this notice does not cover
- Merchants: As mentioned above, we process personal information for others, including merchants. Please direct any complaints, questions or requests related to your personal information directly to those merchants. In the event you are not satisfied with how they respond, you may contact us directly, but we cannot guarantee we will be able to address it.
- Non-Personal Information: Information about your business, including your business contact information, is not typically personal information. Anonymized information is also not considered personal information for the purposes of this notice. We may anonymize any personal information in our custody, in which case it will cease to be personal information.
In some situations, we may rely on exemptions or other permitted conduct under applicable laws, including to collect, use, disclose or store personal information for purposes not described in this notice. We provide services to merchants in many jurisdictions and privacy practices may be adopted to address the specific privacy requirements of particular jurisdictions. If you are unsure if or how this notice applies to you, contact us.
Changes to this Notice
Please note that we may update this notice from time to time to reflect changes in our privacy practices by providing you with notice of the changes. Notice includes but is not restricted to posting a link to the new notice, posting a new notice at smile.io/privacy-policy, or sending you a link to the new notice via contact information you have provided to us. Such changes will be effective with respect to your use of Smile's services after Smile has given notice of the changes. Please review this notice periodically to see whether it has been updated. Any use of Smile's services by you after we provide notice constitutes your acceptance of those changes.
Processing of Personal Information
Much of the personal information we process is necessary to provide our services and meet our contractual obligations. In most other situations, we rely on our legitimate interest (which, in some countries, would be “implied consent” or a legal exception to the consent requirement, such as where the processing is to prevent fraud). The specific purposes for which we process personal information include to:
- communicate with you
- track and process your purchases and report back to you as appropriate
- administer, manage, test and improve our services
- better understand the services, such as through reporting and analytics
- deliver content and information to third parties including other merchants and their customers
- market and advertise our services
- fulfil any other purpose that would be reasonably apparent to the average person at the time of collection
While not stated as a purpose below, we may also use any personal information:
- For security purposes, including to detect, prevent and investigate potential fraud
- Where required or permitted by law
We may also request express consent to process your personal information in some circumstances, such as when you sign up as a merchant or a user for a merchant or when you visit our website and we use cookies. We may also de-personalize information, such as through anonymization or aggregation. We may use and disclose such information for any purpose, as it will no longer identify you or any other person.
| Category of Information Collected | Examples of Information Collected | Purposes |
|---|---|---|
| Customers of Our Merchants | ||
| Communications | Emails and other communications you send us, such as if you ask us a question about a merchant or raise a concern about a merchant | Communicate with you; administer, manage, test and improve our services; as noted above, most information we collected about customers of our merchants is done on behalf of merchants. We suggest you review your merchant’s privacy policy and contact them with any questions or concerns. |
| Preferences | The type of stores you shop at, your budgets, what your favourite store is and similar preferences | Promote our services and our merchants to you based on your preferences |
| Contact Information | Name, email address, mailing address, city, etc. | Promote our services and our merchants to you; communicate with you |
| Transaction Information | Purchase orders and other reward point earning events provided by you or a merchant | Providing our services to merchants, including managing loyalty program; provide services to you, including displaying your reward points to you |
| Merchants and Their Users | ||
| User Account Information | Name, contact information, account usage details, passwords | All purposes set out above. |
| Communications | Emails and other communications you send us, including whether your click on links or open emails | Communicate with you; administer, manage, test and improve our services; market and advertise our services |
| Usage Information | When users log in, how long they log in, what they do in their account | See Tracking Technologies (Cookies, Web Beacons, location, browser type, IP address, etc.). |
| Website / Support Service Users | ||
| Communications | Emails and other communications you send us, including whether you click on links or open emails, and including contact information used for communications | Communicate with you; administer, manage, test and improve our services; market and advertise our services |
| Usage Information | When you access the website, what device you use, where you are located (based on IP address), and which pages you visit and for how long | Administer, manage, test and improve our services; market and advertise our services |
| Employees / Contractors / Applicants | ||
| Communications | Emails and other communications you send us, including whether you click on links or open emails, and including contact information used for communications | Communicate with you |
| Application information | Your job application, resume, information provided by your references and our evaluation of you | Consider your application; in relation to your employment or engagement with us (if hired) |
| Payment Information | ||
| We use a third party payment provider to process payments. We do not collect personal information related to credits cards or other payment information. The payment provider will collect, use and disclose that information in accordance with its own privacy policy. | ||
Sharing your personal information
We do not sell your personal information to third parties (as "sell" is defined in California law). A "sale" would not include a situation where someone is buying all or part of our business (as is explained further below).
We share your personal information with our employees, contractors, consultants and other parties such as affiliates and third party companies that assist us in providing our services, including marketers, customer support and hosting services. Below is a non-exhaustive list of the third parties that may have access to personal information under our control.
| Service Provider | Purpose |
|---|---|
| Marketers | Provide you with news and marketing, including customizing our advertisements |
| Customer Support | Track your service issues and improve our services; provide answers and solutions to your queries and concerns |
| Hosting and Similar Service Providers | Help us provide our services |
| E-commerce Platforms and Merchants | Help us provide our services |
| Analytics | Tracking your use of our services in order to improve our services |
The following table outlines recipients to whom we may disclose your personal information, as well as the purpose of such disclosure. The role and responsibility of each recipient depends on the circumstances. Service providers and sub-processors may process personal information on Smile's behalf and subject to Smile's instructions, while other recipients may process information under their own policies and procedures. Where required by law, we will obtain your consent before disclosure.
| Recipient | Purpose |
|---|---|
| Merchants | We may provide analytics data and information about your use of Smile’s services to relevant merchants. |
| Third Parties Acquiring or Proposing to Acquire Smile | Where third parties acquire or propose to acquire all or a substantial part of our operations or any of our affiliates or subsidiaries, including by merger or acquisition, amalgamation, corporate reorganization or restructuring or a sale of assets, including as part of the related due diligence |
| Law Enforcement / Legal Proceedings | Where we believe release is appropriate to comply with applicable laws or regulations, enforce our policies, or protect our or others' rights, property or for safety |
Will My Personal information Leave the Country?
We may disclose personal information to third parties both in and outside of your country, and as result, your personal information may be collected, used, disclosed or stored in another country, including Canada and in the United States of America. Laws relating to privacy vary between countries, and your personal information may be processed in a country with less stringent than the laws in your country. Personal information may be accessible to governments, courts, or law enforcement, national security authorities or and regulatory agencies of these countries in accordance with applicable laws.
Tracking Technologies (Cookies, Web Beacons, etc.)
Cookies: Our website uses session cookies, which are deleted when you exit your browser, for the functioning of our website. We also use stored cookies, which stay on your computer, to analyses your use of the website and remember your preferences. You can read about cookies at allaboutcookies.org.
IP: Our website also obtains your IP address and browser type, which we keep for 24 months.
Web beacons: We use web beacons in our emails to know when you read / opened the email and when you clicked on the link.
"Do Not Track (DNT) Signals": Although we would like to honor browsers set with DNT signals, at this time, our website do not respond to DNT signals or other mechanisms that might enable users to opt out of IP address tracking. For more information about DNT signals, please visit allaboutdnt.com.
Exercising Your Rights to Your Information
Depending on where you are located and subject to applicable laws, you may have the right to request to access, correct or erase your personal information, object to our processing of your personal information, requests restriction of your personal information in our control or withdraw or change your consent to how we process your personal information, by contacting our Privacy Officer (Contact Us). Keep in mind that merchants control much of the personal information processed by Smile, so you may need to direct your request to the merchant with whom you have a relationship.
As a security measure, our Privacy Officer may request specific information from you in order to verify your identity prior to granting any requests. If we cannot respond to your request promptly or have to refuse the request, we will advise you of the reasons, subject to any legal restrictions. If you disagree with our determination, you may complain to us and we will reconsider. If you are not satisfied with our ultimate determination, you may contact your local data protection authority or privacy commissioner. In addition, the personal information may have been destroyed, erased or made anonymous in accordance with our record retention obligations and practices.
If you want to designate someone to exercise your rights on your behalf, please send your designation request using the email associated with your account, if you have one, or that you have otherwise provided to Smile. We are not otherwise able to verify your identity.
Where permitted by law, we may refuse or charge a fee for repeat, abusive or inappropriate requests.
Retaining Your Personal Information
We only store personal information as long as necessary to fulfill the purposes for which the personal information was collected, to conduct our business operations and maintain an appropriate historical record of our relationship with you, or in order to comply with applicable laws, whichever is longer, after which time the personal information is destroyed or erased. We may, instead of destroying or erasing your personal information, make it anonymous such that it cannot be associated with, or tracked back to, you.
Securing Your Personal Information
We take steps to maintain physical, technical and procedural safeguards that are appropriate to the sensitivity of your personal information. These safeguards are intended to prevent your personal information from loss and unauthorized access, copying, use, modification or disclosure. However, the internet is not a secure environment and no computer system is perfectly secure. As such, we cannot guarantee the security of personal information provided to us through electronic means: there is always a risk that your personal information may be accessed or used without authorization.
Other Questions
Will We Use Your Personal Information to Contact You?
Smile and its marketing partners and sponsors may use your personal information to send you emails periodically listing promotions or events relating to Smile’s services. You may opt-out of receiving such promotional emails by sending an email to help@smile.io or following the instructions in such correspondence. Once Smile has processed your opt-out request, we will no longer send you promotional emails unless you opt back in to receiving such communications. Smile does not control mailing lists maintained by merchants.
What Personal information Do We Collect from Children?
We only collect, use, disclose and store personal information of children under the age of 13 with the consent of a parent or guardian. If you believe that a child under 13 may have provided us with personal information without the consent of a parent or guardian, we request that you Contact Us immediately.
What Personal information Do We Collect from Third Parties?
We may collect personal information about you from a third party. In such cases, the third party providing that personal information to us is responsible for obtaining your consent or another lawful basis for such disclosure.
For example, if you provide your personal information to another Smile user, such as a merchant, as part of accessing and using Smile's services, that personal information may be collected by us, or other third parties, as we and others are the service provider of such users. The collection, use, disclosure and storage of such information will be subject to the privacy policies of such other Smile users. We recommend that you review the privacy policies of those Smile users prior to providing any personal information.
Do We Collect Personal Information About Third Parties from You?
You may have the opportunity to communicate with others that use Smile's services, such as by sending an invitation to a third party. If you choose to take advantage of this functionality, we may ask you to provide us with certain information about the person with whom you wish to communicate, such as their name and email address. By providing us with this information, you confirm that you have obtained their consent to collect, use and disclose their personal information in this manner.
We collect such information for the purposes of facilitating the requested communication, which may contain a specific promotional message from you. Unless we explicitly say otherwise, we will not use this personal information for other marketing purposes without first obtaining consent from the subject of the personal information. Please be aware that when you use any invitation functionality on the services, your email address, name or username and message may be included in the communication sent to you.
What Personal information Do Third Parties Collect from Us?
As a convenience to you, Smile's services may contain links to third party websites, applications or services, or integrate with other third party platforms that collect personal information from you. Such third party services may include payment processors that collect personal information in order to facilitate your purchase of certain services. While we try to link only to third party services that share our commitment to protecting your privacy, we are not responsible for the privacy practices or content of third party services. We recommend that you review the privacy policies of those third party services prior to use.
What is Required of Merchants?
Our Terms of Use require that merchants comply with all applicable laws, including privacy laws, including by obtaining consent to process your personal information where required by applicable laws. If you believe a merchant is violating applicable laws or regulations, we invite you to please Contact Us.
Contact Us
If you wish to make a complaint about how we have handled you personal information or you believe that we have breached this notice or applicable laws, you may file a complaint with our Privacy Officer using the details below:
Privacy OfficerPO Box 33042 Ira Needles
Waterloo, ON, N2T 2M9
Canada
privacy@smile.io
Any other questions regarding this notice or any other privacy-related concerns, such as requests to withdraw consent, access our records of personal information or to change or erase personal information can also be addressed to our Privacy Officer.
What if I have a Complaint about a Merchant?
If you have a question, comment or complaint about a merchant, please contact the merchant directly. If the merchant is not responsive, you may direct your question, comment or complaint to us, but we cannot guarantee we will be able to address it.