This Privacy Policy explains how Luup One, operated by Luup L.L.C-FZ (Dubai, United Arab Emirates) (“Luup One”, “we”, “us”, “our”) collects, uses, shares, stores, and protects personal data when individuals access or use Luup One.
Luup One is a multi brand app. Users may access missions, offers, rewards, and brand programmes from multiple participating brands through one account.
01Who this Policy applies to
1.1This Policy applies to:
- users of Luup One;
- customers participating in brand programmes;
- affiliates, publishers, creators, ambassadors, and similar participants;
- individuals who interact with Luup One websites, apps, support tools, messages, or campaigns.
1.2This Policy does not replace a participating Brand’s own privacy policy for Brand products, purchases, websites, checkout flows, warranties, customer service, or other Brand controlled activity.
02Data protection roles
2.1Luup One may act as an independent controller for personal data needed to operate, secure, analyse, optimise, and improve Luup One.
2.2Luup One may act as processor for Brand controlled personal data where it processes data only on documented instructions from a Brand.
2.3Luup One and a Brand may act as joint controllers in limited cases where they jointly determine purposes and means of processing, such as shared campaign reporting or programme analytics.
2.4Roles will be allocated contractually between Luup One and the relevant Brand.
03Personal data we collect
3.1Account and identity data:
- name;
- email address;
- username;
- profile information;
- authentication method;
- country or region;
- age confirmation.
3.2Activity and mission data:
- mission participation;
- content submissions;
- engagement metrics;
- referral or recommendation activity;
- tracked links and codes;
- approvals, rejections, and reason codes;
- reward and payout history.
3.3Technical data:
- device type;
- operating system;
- app version;
- IP address;
- log data;
- cookies, SDKs, and similar technologies;
- security events.
3.4Communications data:
- in app messages;
- email and SMS communications;
- support requests;
- feedback;
- complaint records.
3.5Payment related data:
- payout method selected;
- payout status;
- payout provider reference;
- reward balance;
- transaction and redemption history.
3.6Luup One does not intentionally collect full payment card details, bank account credentials, criminal records, children’s data, or special category data unless expressly required, lawful, and notified.
04How we collect data
4.1We collect data when you:
- create an account;
- join a Brand programme;
- complete a mission;
- submit content;
- use links, codes, QR codes, or offers;
- request rewards or payouts;
- contact support;
- use the app or website;
- interact with emails, messages, or notifications.
4.2We may receive data from:
- participating Brands;
- payment providers;
- tracking and attribution providers;
- analytics providers;
- app stores;
- fraud prevention providers;
- social platforms where permitted;
- other service providers.
05Purposes of processing
5.1We process personal data for:
- account creation and access;
- platform operation;
- mission management;
- content review and moderation;
- reward tracking and verification;
- payout administration;
- fraud prevention and security;
- sanctions, tax, identity, and compliance checks;
- customer support;
- communications and notifications;
- reporting to participating Brands;
- platform optimisation;
- algorithmic performance improvement;
- aggregated analytics and benchmarking;
- legal compliance;
- dispute handling.
06Lawful bases
6.1Depending on the jurisdiction and data type, lawful bases may include:
- performance of a contract;
- consent;
- legitimate interests;
- compliance with legal obligations;
- protection of legal claims;
- other lawful bases recognised under applicable law.
6.2Luup One relies on legitimate interests for fraud prevention, platform security, service improvement, aggregated analytics, and performance optimisation where permitted by law.
6.3Where consent is required, we will seek consent and you may withdraw it where applicable.
07Human and algorithmic decision support
7.1Luup One uses algorithmic tools to support fraud detection, risk indicators, mission performance, timing, optimisation, ranking, and reward verification.
7.2Human review applies to mission approvals, content moderation, reward verification, account restrictions, and escalation decisions.
7.3Luup One does not intend to make solely automated decisions that produce legal or similarly significant effects without human review where required by law.
7.4You may contact us to request review of decisions where required by applicable law.
08Data visibility across brands
8.1Luup One is a multi brand app. Your account may be used across participating Brands.
8.2Brands may receive identifiable personal data where needed to operate their programme, verify actions, fulfil rewards, handle support, comply with law, or manage Brand customer relationships.
8.3Otherwise, Brands may receive aggregated, pseudonymised, or anonymised reports.
8.4One Brand will not receive another Brand’s confidential campaign data except where expressly permitted, aggregated, anonymised, or legally required.
09User generated content
9.1Content you submit may be reviewed by Luup One and the relevant Brand.
9.2Content approved for marketing may be used in accordance with the Platform Terms of Service, mission rules, and any consent or licence terms shown to you.
9.3Public content you post on third party platforms may be visible to others under those platforms’ terms.
10Sharing personal data
10.1We may share personal data with:
- participating Brands;
- payment and payout providers;
- hosting and infrastructure providers;
- analytics providers;
- messaging and email providers;
- fraud prevention and security providers;
- professional advisers;
- regulators, courts, law enforcement, or public authorities where required;
- buyers, investors, or successor entities in a corporate transaction, subject to appropriate safeguards.
10.2We do not sell identifiable personal data.
10.3We may use or commercialise aggregated, anonymised, or derived insights that do not identify individuals.
11International transfers
11.1Personal data may be processed in countries outside your country of residence, including by service providers and participating Brands.
11.2Where required, Luup One will use appropriate safeguards, which may include contractual protections, standard contractual clauses, adequacy decisions, transfer assessments, or other lawful transfer mechanisms.
12Retention
12.1We retain personal data only for as long as reasonably necessary for the purposes described in this Policy.
12.2Indicative retention periods:
- active accounts: for the duration of use;
- inactive accounts: 24 months;
- support records: 36 months;
- reward and payout records: 5 years where required for accounting, tax, fraud, or legal purposes;
- terminated Brand programmes: Brand controlled data handled according to the relevant Brand agreement, with Luup One retaining aggregated, anonymised, or legally required records.
13Your rights
13.1Depending on applicable law, you may have rights to:
- access your personal data;
- correct inaccurate data;
- request deletion;
- restrict processing;
- object to processing;
- request portability;
- withdraw consent;
- object to certain automated processing;
- submit a complaint to a regulator.
13.2Requests may be submitted to support@luup.com.
13.3We may need to verify your identity before responding.
13.4Where data is controlled by a participating Brand, we may coordinate with that Brand.
14Security
14.1Luup One uses reasonable technical and organisational measures designed to protect personal data.
14.2Measures may include access controls, encryption where appropriate, pseudonymisation where appropriate, logging, monitoring, vendor controls, review workflows, and security policies.
14.3No system can be guaranteed completely secure.
15Personal data breaches
15.1If Luup One becomes aware of a personal data breach, it will assess the breach and take appropriate steps.
15.2Where required, Luup One will notify the relevant Brand, regulator, and affected individuals in accordance with applicable law and contractual obligations.
15.3Where Luup One is processor, it will notify the relevant controller without undue delay.
16Children
16.1Luup One is intended for users aged 18 and over.
16.2We do not knowingly collect personal data from children.
16.3Accounts suspected to belong to minors may be suspended and deleted.
17Marketing communications
17.1We may send service messages, programme updates, reward notifications, support messages, and legal notices.
17.2We may send marketing communications where permitted by law.
17.3You can opt out of marketing communications, but we may still send service or legal messages.
18Cookies and similar technologies
18.1Luup One may use cookies, SDKs, pixels, local storage, device identifiers, and similar technologies.
18.2These technologies may support login, security, analytics, attribution, fraud prevention, app performance, and campaign measurement.
18.3Where required, we will request consent or provide controls.
19Contact
Privacy contact: support@luup.com
Company: Luup L.L.C-FZ
Registered office: Dubai, United Arab Emirates
Privacy lead: reachable at support@luup.com
20Complaints
20.1You may contact us first at support@luup.com.
20.2You may also have the right to complain to the applicable data protection authority in your jurisdiction.
21Changes to this Policy
21.1We may update this Policy from time to time.
21.2Material changes will be notified through the app, website, email, or other reasonable method.
21.3Continued use of Luup One after an updated Policy takes effect means you acknowledge the updated Policy, where permitted by law.
22Governing law and jurisdiction
22.1This Policy and any dispute, claim, or non contractual obligation arising out of or in connection with it are governed by the federal laws of the United Arab Emirates and the laws applicable in the Emirate of Dubai.
22.2Subject to mandatory data protection, consumer, or regulatory rights that cannot be excluded, the Courts of the Dubai International Financial Centre shall have jurisdiction to hear and determine disputes arising out of or in connection with this Policy.