Privacy Policy

Last updated: March 2026

1. Data Controller

The data controller for this service is Wocherie OÜ (registry code: 16826825), registered at Gerassimovi 4-64, 20105 Narva, Estonia. For any privacy-related questions, contact us at info@localpartner.eu.

2. What Data We Collect

We collect the following personal data when you use LocalPartner:

Business Account Data

• Contact person name and email address
• Business name, city, address, CVR/registration number
• Business type and location information (addresses, coordinates)
• Payment information (processed by Stripe; we do not store card details)

Employee Account Data

• Name and email address (provided by employer)
• Branch/location assignment
• Visit history (QR scans at partner locations, timestamps)

Technical Data

• IP address, browser type, device information
• Cookies for session management and language preference

3. Purpose and Legal Basis

We process your data for the following purposes:

• Contract performance (Art. 6(1)(b) GDPR): To provide the LocalPartner service — account management, partnerships, QR code scanning, billing.
• Legitimate interest (Art. 6(1)(f) GDPR): To improve our service, prevent fraud, and ensure security.
• Legal obligation (Art. 6(1)(c) GDPR): To comply with accounting and tax requirements.
• Consent (Art. 6(1)(a) GDPR): For optional cookies and marketing communications (if applicable).

4. Data Sharing

We share data with:

• Partner businesses: When a partnership is active, partner businesses can see your business name, locations, and agreed discount terms. Employee names are not shared with partners.
• Stripe: Payment processing. See Stripe Privacy Policy.
• Vercel: Frontend hosting. See Vercel Privacy Policy.
• Railway: Backend hosting and database. See Railway Privacy Policy.

We do not sell your personal data to third parties.

5. Data Retention

We retain your data for as long as your account is active. After account deletion or subscription cancellation, we retain business data for up to 12 months for legal and accounting purposes, after which it is deleted. Visit history is anonymized 6 months after creation.

6. Your Rights (GDPR)

Under the General Data Protection Regulation, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Erase your data ("right to be forgotten")
• Restrict processing
• Data portability — receive your data in a structured format
• Object to processing based on legitimate interest
• Withdraw consent at any time (where consent is the legal basis)

To exercise any of these rights, email us at info@localpartner.eu. We will respond within 30 days.

7. Cookies

We use the following cookies:

• Essential cookies: Session authentication (JWT token stored in localStorage), language preference. These are necessary for the service to function.
• No tracking or advertising cookies are used.

8. Data Security

We protect your data with HTTPS encryption, secure password hashing (bcrypt), and access controls. Our database is hosted in Europe (Railway, europe-west4 region) with SSL encryption.

9. International Transfers

Your data is primarily processed within the EU/EEA. Some sub-processors (Vercel, Stripe) may process data outside the EEA under appropriate safeguards (Standard Contractual Clauses).

10. Supervisory Authority

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon): www.aki.ee.

11. Changes to This Policy

We may update this privacy policy from time to time. Material changes will be communicated via email or a notice on our website. The "Last updated" date at the top reflects the most recent revision.

12. Account Deletion

You can delete your employee account directly in the LocalPartner mobile app: go to Profile → Delete Account. Your account and visit history will be permanently removed.

Business accounts can request deletion by emailing info@localpartner.eu. We will process your request within 30 days. Note that some data may be retained for up to 12 months for legal and accounting purposes as described in Section 5.