Introduction

This Privacy Policy describes how Promotion Vault, an Arizona Corporation (“Promotion Vault,” “we,” “us,” or “our”), collects, uses, and protects your information when you use our website at promotionvault.com, our services and applications (collectively, the “PV Services”), and our messaging programs.

By using the PV Services, you agree to this Privacy Policy, the Promotion Vault Terms of Service – Subscriber, the Promotion Vault Service Level Agreement, and the Promotion Vault Data Processing Addendum. Capitalized terms used but not defined here have the meanings given in the Terms of Service or DPA, as applicable.

Information We Collect

We may collect the following categories of personal information:

• Identifiers and contact information — name, email address, phone number, mailing address.
• Account information — login credentials, account settings, organization role, billing contact details.
• Recipient information — first name, last name, email address, and (where Subscriber has authorized SMS) phone number for individuals eligible to receive rewards.
• Usage data — actions taken in the PV Services, reward activation events, communication preferences.
• Technical data — IP address, device and browser information, log data, and similar information collected automatically when you access the PV Services.
• Survey and feedback content — responses, ratings, and other content you submit through PV surveys or feedback tools.
• Communications — content of emails, SMS, and support tickets exchanged with us.

How We Use Your Information

We use your information to:

• Provide, operate, and improve the PV Services.
• Authenticate users and secure accounts.
• Deliver rewards and related transactional communications, including email and SMS notifications.
• Communicate with you about the PV Services, including updates, support, and (where permitted) promotional messages.
• Process payments and manage billing through our payment processor.
• Maintain security, prevent fraud, and comply with applicable legal and regulatory obligations.
• Analyze service usage and conduct internal reporting, including survey and feedback analysis.

SMS Messaging Program Terms

By submitting your phone number through our website or other opt-in methods, you expressly consent to receive SMS messages from us in accordance with this Privacy Policy and our Terms of Service.

Sharing of Information

We do not sell your personal data. We may share information with:

• Trusted service providers and sub-processors that support the PV Services (see “Sub-Processors” below).
• Infrastructure, communication, and validation partners necessary to deliver rewards and notifications.
• Legal, regulatory, or law-enforcement authorities when required by applicable law or to protect the rights, property, or safety of Promotion Vault, our users, or others.
• A successor entity in connection with a merger, acquisition, financing, or sale of assets, in which case we will require any successor to honor the commitments in this Privacy Policy.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing with subcontractors in support services, such as customer service, is permitted as described in our DPA.

Sub-Processors

Promotion Vault uses third-party Sub-Processors to support the PV Services, including providers of cloud infrastructure, transactional email and SMS, payment processing, customer support, reward fulfillment, and data validation. The current list of Sub-Processors, with descriptions of the data each Sub-Processor processes and the purpose for which it does so, is available in Exhibit A to the Promotion Vault Data Processing Addendum.

Each Sub-Processor is contractually bound to maintain appropriate safeguards consistent with this Privacy Policy and applicable data protection laws.

Cookies and Tracking Technologies

The PV Services and our website use cookies and similar technologies, including those provided by Google (Google Tag Manager, Google Analytics via Site Kit), to operate the site, remember your preferences, understand how visitors use the site, and improve our services.

You can control cookies through your browser settings. If you are located in a jurisdiction that requires consent before non-essential cookies are set, we will request that consent at the appropriate time. Disabling cookies may affect the functionality of certain features of the PV Services.

Data Processing Agreement (DPA)

We process personal data in accordance with our Data Processing Addendum, which defines how data is handled, processed, and protected, and which lists our Sub-Processors. You can review the DPA here.

Terms of Service and Service Level Agreement

Your use of the PV Services, including SMS communications, is also governed by our Terms of Service – Subscriber and our Service Level Agreement. Together with this Privacy Policy and the DPA, these documents describe the legal terms, service commitments, and data-protection commitments that apply to your use of the PV Services.

Data Security

Promotion Vault implements commercially reasonable administrative, technical, and physical safeguards designed to protect your information against unauthorized access, alteration, disclosure, or destruction. Specific technical and organizational measures, including our infrastructure security posture and breach-notification commitments, are described in Section 9 of the DPA.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a security incident affecting your personal data, we will notify you and any required authorities as described in the DPA and in accordance with applicable law.

Data Retention

We retain personal information for as long as is necessary to provide the PV Services, fulfill the purposes described in this Privacy Policy, comply with our legal obligations, resolve disputes, and enforce our agreements. When personal data is no longer required, we will delete, anonymize, or aggregate it consistent with our internal data retention policy and the DPA.

Your Rights

Depending on your jurisdiction, you may have rights to:

• Access the personal information we hold about you.
• Request correction of inaccurate or incomplete information.
• Request deletion of your personal information, subject to applicable legal exceptions.
• Object to or restrict certain processing of your personal information.
• Withdraw consent for processing that relies on consent.
• Receive a copy of your personal information in a portable format, where applicable.
• Lodge a complaint with a supervisory authority where you reside.

To exercise any of these rights, contact us at privacy@promotionvault.com. We may need to verify your identity before responding. We will respond within the timeframes required by applicable law.

Age Restrictions

The PV Services are intended for individuals 18 years or older. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, please contact privacy@promotionvault.com so we can take appropriate action.

Third-Party Links

Our website and the PV Services may contain links to third-party websites, including Merchant gift card sites and integration partners. We are not responsible for the privacy practices of those third parties. Your interactions with third-party sites are governed by their own privacy policies and terms.

International Users

Promotion Vault is headquartered in the United States and stores personal data primarily on infrastructure located in the United States. If you access the PV Services from outside the United States, please be aware that information collected from you may be transferred to, processed, and stored in the United States. By using the PV Services from outside the United States, you consent to this transfer, subject to the protections described in this Privacy Policy and the DPA.

Updates to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated through the PV Services or by email to the address associated with your account, and the updated effective date will be posted at the top of this Privacy Policy.

Consent

By using the PV Services and opting into communications, you:

• Acknowledge this Privacy Policy.
• Agree to our Terms of Service and Service Level Agreement.
• Accept the data practices described in this Privacy Policy and the DPA.
• Consent to receive SMS messages under the terms outlined above, where you have opted in.