Privacy Policy - Sushi Club
Operator and data controller: SUSHI CLUB (French SAS)
Registered office: 2 Rond-Point de l'Europe, 120 Avenue du Général de Gaulle, Rue Pierre Brossolette, 3 Rue Raymond Ridel, 92250 La Garenne-Colombes, France
Contact email: caizhanggui@caizhangguiinfo.com
Technical and SaaS provider: REAYOU 2024 SL
This Policy applies to member registration and login, invitation registration, points, the rewards store, in-store collection, customer support and account deletion in Sushi Club. SUSHI CLUB determines the purposes and means of processing for these services. REAYOU 2024 SL generally acts as a contracted technical provider and processor for accounts, hosting, maintenance, security and troubleshooting.
1. Data we process
| Context | Data | Purpose |
|---|---|---|
| Registration and login | Mobile number, SMS verification result, account identifier, registration and login times | Create and verify the account, enable login, protect the account and support recovery |
| Invitation registration | Invitation code or link, inviter and invitee account identifiers, invitation time and reward status | Create an invitation relationship within this merchant, determine eligibility and prevent bulk registration or abuse. An invitation code is optional and ordinary registration remains available. |
| Membership and points | Membership number, points balance, earning, use, expiry, return and adjustment records | Provide benefits, calculate and display points, correct errors and handle disputes |
| Rewards store and collection | Redemption number, item or benefit, points used, selected store, collection code or QR code, redemption and validation status | Create the order, enable store fulfilment and validation, manage stock cancellation, point returns and after-sales support |
| Support and rights requests | Contact details you provide, issue description, relevant order or points records and communications | Handle enquiries, complaints, after-sales support, account deletion and privacy requests |
| Operation and security | Device model, operating system, App version, language, network status, IP address, login and operation logs and error information | Operate the service, diagnose faults, prevent attacks, abnormal login, fraud and points abuse |
| QR scanning | Live camera view and scan result when you actively open the scanner | Recognise store, membership, collection or campaign QR codes. The camera view is generally processed on the device and is not continuously recorded. |
The App does not require identity documents, facial recognition, bank-card data, precise location, contacts or health data, and it does not process online payment-card details. Do not send passwords, SMS codes or full card details to support.
2. Purposes and legal bases
- Performance of a contract: creating the membership account, recording points and completing redemptions and in-store collection.
- Legal obligations: retaining records required for accounting, tax, complaints, security or legal claims.
- Legitimate interests: account and system security, fraud prevention, troubleshooting and service stability, balanced against your rights.
- Consent or active choice: non-essential device features such as the camera and marketing communications where consent is legally required. You may refuse or withdraw without affecting unrelated core services.
We do not use solely automated decisions that produce legal or similarly significant effects, and we do not sell personal data.
3. Device permissions and SDKs
| Permission or component | Explanation |
|---|---|
| Camera | Requested only after you open the scanner, to recognise QR codes. If refused, only scanning is unavailable. |
| Network and local storage | Used to access service APIs and store the login session, language and necessary cache. The App does not request broad access to your personal files. |
| Vibration | Used only for brief haptic feedback after a successful scan, a button action or an important status change. It does not collect personal data. |
| uni-app runtime | The App is built with uni-app. The review build does not configure optional advertising, analytics, maps/location, third-party login, push, clipboard, Bluetooth or NFC SDK modules. |
SMS verification may be delivered by a contracted communications provider. It receives only the mobile number, message content required for the code and delivery status.
4. Recipients, sharing and processors
Where necessary, data may be available to:
- authorised staff and directly operated stores of SUSHI CLUB for membership, points, redemption, collection and support;
- REAYOU 2024 SL for development, hosting, maintenance, security and technical support;
- contracted SMS, hosting, database and network-infrastructure providers acting under instructions;
- courts, regulators, law-enforcement bodies or public authorities where legally required.
We do not share member profiles across different merchant tenants and do not sell data to advertisers.
5. International processing
We prioritise processing and storage in the European Union or European Economic Area. If an essential provider processes data outside the EEA, we use an adequacy decision, EU Standard Contractual Clauses or another lawful safeguard and update this Policy where required.
6. Retention
| Category | Typical period |
|---|---|
| Account and membership profile | While the account is active; normally deleted or anonymised within 7 days after identity verification. Accounting, tax, security, anti-fraud and dispute records that must legally be retained are isolated and restricted to those purposes. |
| Invitation, points and redemption records | During the relevant service and generally 3 years afterwards; records that are accounting, tax or contractual evidence may be retained for up to 10 years where required by law. |
| Login, security and error logs | Generally no more than 12 months, unless needed until a security incident or dispute is resolved. |
| Support, complaints and rights requests | Generally 3 years after closure; necessary evidence of an account-deletion request may be retained for 5 years. |
At the end of the applicable period, data are deleted, anonymised or otherwise made non-identifiable.
7. Your rights
Subject to applicable law, you may request access, correction, deletion, restriction, objection and portability, and may withdraw consent at any time. Email caizhanggui@caizhangguiinfo.com. We may carry out proportionate identity verification to prevent impersonation.
We normally respond within one month. For complex or numerous requests, this may be extended by two months, with notice within the first month. You may also lodge a complaint with the French data protection authority, the CNIL.
8. Account deletion
You can request deletion in the App through the “Delete account” option in the App's account settings, or through the public deletion page. Once identity is verified, deletion is normally completed within 7 days. Unused points, coupons and membership benefits expire after you confirm deletion. Pending redemption orders must first be completed or cancelled; if the merchant cannot fulfil and cancels the order, the points are returned.
Accounting, tax, security, anti-fraud and dispute records that must be retained by law are restricted and used only for those purposes.
9. Minors
The App is not directed to children under 15. A person under 15 should not create an account independently. Users aged 15 to 17 should obtain parental or guardian authorisation where required by applicable law. Contact us if a child has provided data without appropriate authorisation.
10. Security and Policy updates
We use access controls, encryption in transit, logging, backups and least-privilege measures. No system is completely secure. If an incident is likely to create a high risk, we will notify affected users and regulators as required.
Material changes will be notified in the App or by another appropriate method, and consent will be requested again where required. An update will not unlawfully reduce rights already acquired.
11. Contact
Privacy, support and account deletion: caizhanggui@caizhangguiinfo.com
Hours: Monday to Friday, 09:00–18:00 Central European Time, excluding French public holidays
Address: 2 Rond-Point de l'Europe, 120 Avenue du Général de Gaulle, Rue Pierre Brossolette, 3 Rue Raymond Ridel, 92250 La Garenne-Colombes, France