Privacy Notice

JamDoughnut takes data protection and privacy responsibilities seriously. This notice will inform you of how we protect, process and share your personal data when you visit our website or app, as well as what your rights are as a data subject. We may amend this notice from time to time to keep it up to date with legal requirements and the way we operate our business. Any changes we may make to our privacy notice in the future will be posted on this page and, where appropriate, notified to you.

This version was last updated on the 17th June 2025.

JamDoughnut is the Data Controller for the personal data processed, unless otherwise stated in this privacy notice. Our Company registration Number is 12277192 and Information Commissioners Office (ICO) registration Number is ZA759668. Our registered Office is 2 Leman Street, London, E1W 9US.

1. Contact details

We have appointed a Data Protection Officer (DPO), who is responsible for overseeing this privacy notice. If you have any questions or would like to exercise your legal rights, please contact our DPO using the following form: https://www.jamdoughnut.com/contact-us/ or emailing privacy@jamdoughnut.com

2. Information we may collect and how it’s collected

When using our website or app we may collect, use and store the information set out below. Some personal data is necessary for us to comply with law or perform our contract with you, so without it we may not be able to provide our service to you. We will tell you when this is in the case, and for the purposes of this privacy notice these types of personal data are marked with an asterisk (*). Our services are not intended for use by anyone under 18 years of age, and if we identify any customers who are under 18 we will delete the personal data associated with their account.

Referrals data*: If you refer a customer to the app then we shall send you a confirmation email when the person you referred signs up and when they complete their first cash out. If you are the referee, the emails sent to the referrer will contain your first name and username only. We retain referral data (of both the referee and the referrer) within the app, including any bonus rewards that you or the person that referred you receives. We process personal data for this purpose on the basis of our legitimate interests to grow our business through customer referrals.

Registration data*: When you create an account, we collect your full name, mobile number, email address, device ID, operating system, operating software version, location data (if shared), the app version (where relevant), login activity and referral tracking for your account. We process personal data for this purpose in order to perform our contract with you.

Biometric data: You can sign into the app using biometric data, including your fingerprint/facial recognition for app access. We do not store or access biometric data, but instead use the confirmation provided to us by your device provider. We process personal data for this purpose where you have consented to logging in this way, through your device and we offer use of a pin as an alternative login method.

Purchase data and other data used for delivery of the service*: When you use our website or app to purchase, we collect personal data from you related to that purchase including the company, the amount, points earned (which we will automatically calculate), payment method, time of purchase, incentives/rewards or bonuses, purchase ID, and access to the gift card. We process this personal data on the basis of our contract with you.

If you purchase using Apple or Google Pay the payment will be conducted by a regulated Digital Card Payment Provider. Your payments will be securely authenticated using Apple and Google Pay. We provide the payment provider with your user ID, full name, email address and order details. The Digital Card Payment Provider will store your card details securely for conducting the transaction (to perform our contract with you) as well as for financial crime prevention (on the basis of our legal obligations and our legitimate interests to protect our business from financial crime). If you purchase using Open Banking bank transfer (Pay by Instant Bank Payment) the payment will be conducted by a regulated Open Banking Payment provider. We provide the Open Banking Payment Provider with your user ID, full name, email address and order details. The Open Banking Payment Provider will store your banking details for conducting the transaction as well as for financial crime prevention.

We may also process your purchase data, transactions data and device ID to better understand your purchasing tendencies and to provide you with a more personalised service and exclusive offers. We process personal data for this purpose on the basis of our legitimate interests to improve our customer insights and improve the competitiveness of our business.

Identification verification data*: We may ask you to verify your identity as a requirement for Know Your Customer and to prevent financial crime. If this is required, we will either request a photo of your photo ID or a video with you and your photo ID and we will process it for these purposes, on the basis of our legal obligations and our legitimate interests to protect our business from financial crime. Or an alternative way we may complete ID verification is via our partner Sumsub, who will process the information provided on the same basis for the same purposes. You can find their privacy notice here: Privacy Notice (Sumsub Service) | Sumsub.com

Cash out request data*: When you submit a cash out request, we store your bank details in order to complete the bank transfer to your bank account. This will include your account name, sort code and account number which is also shared with our bank to facilitate the transfer. In order to simplify subsequent cash outs, we will retain this data. You can change your bank details whenever you cash out. We process personal data for this purpose, in order to perform our contract with you.

Refunds data*: All refunds given by us will be transferred back to your original payment method. This information will be shared with our Payment Provider and our bank to facilities the transfer. We will retain a copy of all refund transactions for our records and for financial crime prevention. We process personal data for this purpose, in order to perform our contract with you, on the basis of our legal obligations and our legitimate interests to protect our business from financial crime.

Sensitive data: We do not request any sensitive personal data (also known as special category data) from you. Nor do we collect any information about criminal convictions and offences.

Marketing data: From time to time, if opted in, we will send you marketing communications. These are separate from any transactional or service-related communications. You can opt out of marketing communications at sign up (where you can receive an initial purchase bonus on your first purchase) and in future correspondence. Marketing communications shall be sent via the following channels: Email, SMS and Push notifications based on your preferences. You can also opt out of these by contacting privacy@jamdoughnut.com. For push notifications, you can set your preferences on your mobile device. We process personal data for these purposes on the basis of our legitimate interests to promote our business, or where required by law, with your consent.

General communications data*: Information is also stored when you communicate with us via email, social media or other means by which you decide to contact us. This is usually limited to your name, email address and/or social media account depending on how you contact us and any correspondence on resolving your enquiry. We process this personal data on the basis of our contract with you and/or our legitimate interests in providing an efficient service to you.

Surveys data: In order to better understand our customers, we may also collect anonymised data in surveys and other feedback methods. We will use different platforms from time to time to conduct this. This helps us improve our service by tailoring our developments. Participation in surveys is optional and anonymous. Where you choose to participate in a survey, we process this data on the basis of our legitimate interests in understanding your experience on our website or app.

Operational data*: When using our website or app, we may also record your location, device type, deviceID, OS version, crash logs, app version as part of normal request processing and session management, and to support you and our service in the event of problems occurring. We process this personal data on the basis of our legitimate interests in providing a secure platform and conducting diagnostics. Through app information shared with us by your device provider, we consider your use of other cashback sites to ensure you receive a personalised savings rate from us according to our pricing model. We process this personal data on the basis of the performance of a contract to manage the cashback rate, and otherwise for our legitimate interests in ensuring that customers are incentivised to spend through our app and/or website.

App data*: The app needs camera and location information for verification of your loyalty status, through scanning your loyalty card. We request this through Android and iOS system-level prompts. Location permission is requested for local offers and this feature will only work if we have your device location. Where the location permission is granted we use this information to present local cash back offers and store the data against any payments the users makes in the JamDoughnut app. We also capture this (via device fingerprinting) for each registration, purchase and cash out request (see our cookie policy for more information on this). We process personal data for this purpose in order to perform our contract with you.

Cookies and other technologies: We use certain online technologies to collect and process your personal data when you use our website or app. Please read our cookie policy for further information on how these technologies work, why we use them and what data processing is involved. In particular, we use third-party tools (like Firebase Analytics, Crashlytics, or Google Analytics), those platforms may collect device and usage data, which includes information like app version, device model, OS version, and anonymized usage statistics. Some of the data we collect is necessary to help us improve stability, diagnose crashes, and better understand how users interact with the website or app and is used in our legitimate interests to provide a secure and efficient platform to grow our business.

3. Our lawful basis for using your data

The lawful basis we rely on for processing your personal data depends on our purpose of processing, as outlined in section 2 above. Our lawful bases include:

Consent: In certain circumstances, we process your personal data with your consent. For example, we may rely on your consent to send you marketing material.
Performance of a contract: we have to collect or use the information so we can enter into or carry out a contract.
Legal obligations: If we are required by the law, we will need to process your personal data. For example, to comply with our tax and financial reporting obligations with respect to monies we owe you.
Legitimate interests: We have legitimate business interests to pursue, and this may require the processing of your personal data. We will only rely on our legitimate business interests as our lawful basis, when you would reasonably expect your personal data to be used and where we have deemed it to have a minimal privacy impact on you or that that we have strong reasons for pursuing our interests. Whenever this lawful basis is used, we will consider the potential impact on you and your rights before we process your personal data for our legitimate interests.

4. Automated decision making

Automated individual decision-making is a decision made by automated means without any human involvement. We may carry out automated decision making, including profiling, from time to time as part of our financial crime prevention or in order to personalise our services to you and provide you with exclusive offers. You have the right to contact us to ask for a person to review an automated decision. Our lawful basis for these activities is either that: it is necessary for the entry into or performance of a contract, it is authorised by UK law or we have your consent.

5. Data Sharing and processors

When you use our services, the information you provide may be shared with carefully selected third party suppliers only to perform certain data processing tasks on our behalf.

The list below sets out the categories of third parties that we engage with to facilitate our services to you:

Open Banking Provider – Bank transfer processing
Fraud Prevention / Know Your Customer Provider – device fingerprints and identity verification
Digital payment Provider – Payment card processing
Cloud hosting Provider – Server hosting and data storage
User Analytics Provider - Site and app usage
Help Desk Provider - Customer service communications
Communication sending provider – Email, SMS and Push Notifications
Social media channels – Customer service and engagement

6. International transfers

Where we transfer your personal data outside the UK or EU to a country deemed to have a lower standard of data protection in place, for example to a third-party processor based in the US, we will ensure that your personal data is appropriately protected by meeting the obligations on us under UK GDPR and ensuring there is a transfer safeguard in place with the recipient. For example the Standard Contractual Clauses issued by the European Commission together with the UK addendum issued by the Information Commissioner. You can request further details on the relevant transfer safeguard by contacting privacy@jamdoughnut.com.

7. Third party links

Our app may contain links to other websites or applications which are not controlled by us. We are not responsible for the privacy practices or content of such other websites or applications. As such, visiting these other websites or applications is at your own risk.

8. Data Retention

In general, we retain personal data for as long as is necessary for the purpose(s) for which we originally collected it. We may also retain information as required by law, for example we must keep records for five years beginning from the date a business relationship ends/a transaction is completed for money laundering purposes. Whilst you have an open account in JamDoughnut your personal data will be stored, and how long it is stored thereafter will depend on a number of factors. For example, we must retain certain personal data types for 6 years for defence of claims purposes. Further details of cookie data is available in our cookie policy. Otherwise, further details of our retention periods are available in our retention policy, and an extract can be requested by contacting our DPO.

9. Deleting your account through the iOS App

To delete your account, please sign in to your account, select the user icon and at the bottom of your settings, there is an option to delete your account. Deleting your account will not delete your personal data. If you wish to exercise your right to erasure, please contact us using our online form here: https://www.jamdoughnut.com/contact-us/.

10. Your data protection rights

Under the UK data protection law, you have rights we need to make you aware of. The rights available to you depend on our reason for processing your information:

Right to access: If at any point you wish to either confirm whether your personal data is being processed and/or access the personal data we hold about you, you can request to see this information, usually free of charge, and we will respond to this request within a 1-month period. We may however charge a reasonable fee when a request is manifestly unfounded or excessive particularly if this is repetitive and for further copies of the same information.

Right to be informed: This policy provides the information you need about how we collect and use your personal data which we have outlined within this document.

Right to rectification : You are entitled to have personal data corrected if it is inaccurate or incomplete. This right always applies.

Right to erasure: you have the right to have personal data that we hold about you erased. This only applies: (a) the organisation no longer needs your personal data for the original reason they collected or used it for; (b) you initially consented to the organisation using your personal data, but have now withdrawn your consent ; (c) you have objected to the use of your personal data, and your interests outweigh those of the organisation using it; and (d) You have objected to the use of your personal data for direct marketing purposes.

Right to object and restrict: You can ask for the processing of your personal data to be restricted, for example for marketing purposes. You can also object to the processing of your personal data where this is based on our legitimate interests, but this may affect the service we are able to offer.

Right to portability: You can request a copy of your personal data to be sent to another data controller or to yourself in a machine readable format. The right only applies if we are processing information based on your consent or under a contract, and if the processing is automated.

Right to withdraw consent: Where we rely on your consent, you have the right to withdraw your consent at any time. Please be aware, if you withdraw your consent, we may not be able to provide certain products/services to you.

Complain about the use of your personal data

In the first instance, if you are not fully satisfied with our response, or believe we are processing your personal data unfairly or unlawfully, you can contact our Data Protection Officer through this form: https://www.jamdoughnut.com/contact-us/ or privacy@jamdoughnut.com. You also have the right to complain to the Information Commissioner’s Office (ICO). You can find further information about the ICO and their complaints procedure here: https://ico.org.uk/concerns

To exercise your rights or if you require any further information, please contact our data protection team at dpo@jamdoughnut.com