Datenschutzrichtlinie
Version: 2026-10-14
1. General Provisions
This Privacy Policy (hereinafter – "Privacy Policy") provides information about how we, Loyalty Vault S.R.L. (hereinafter – "COMPANY" or "we"), processes personal data when you use the website aceb.com (hereinafter – the "Website"), use our services or otherwise provide personal data to us.
Scope of the Privacy Policy
This Privacy Policy explains how Loyalty Vault S.R.L. collects, uses, shares and retains personal data, and how you can exercise your rights. It covers ACEB's website and API services, including ACEB tools and plugins used through ChatGPT, Codex or another AI assistant, and data about customers and gift recipients.
When you ask an AI assistant to use ACEB, we process the arguments sent to our tools: for example product searches, redemption-country filters, denominations, cart contents and identifiers, and order-status requests. Hosted checkout also requires a delivery email and may include a gift recipient email, gift message and coupon. These inputs are used to provide the requested service. Our tools do not require your full AI conversation, wallet seed phrase, private key or issuer-account password. The AI host's own privacy policy governs its processing of your conversation. Checkout order records also contain the caller IP address and user-agent. These are stored order details, distinct from routine request logs, and follow the order-retention arrangements described in section 4.1.
Legal background
We respect your privacy and seek to protect your personal data. Loyalty Vault S.R.L. will process your personal data in accordance with the applicable legal requirements of the European Union and the Romania, including Regulation (EU) No 2016/679 (General Data Protection Regulation, hereinafter – "GDPR") and other applicable legislation on the protection of personal data, and instructions from competent authorities. The terms used in the Privacy Policy are understood as they are defined in the GDPR. When processing your personal data, we implement organizational and technical measures that ensure the protection of personal data against accidental or unlawful destruction, alteration, disclosure, and any other unlawful processing.
2. Data Controller of Your Personal Data
We, Loyalty Vault S.R.L., are the data controller of your personal data specified in this Privacy Policy.
Our details:
Loyalty Vault S.R.L. is the private limited liability Loyalty Vault S.R.L. incorporated under the laws of the Romania, with its place of business at Bdul. Unirii 32 BL.73B ET. 2 AP. 10 ZIP Code 130082, Targoviste, Romania, code 51229859.
For customer support and privacy requests, email support@aceb.com. For security reports, email it@aceb.com. We do not publish a customer-support phone number.
3. The Principles
When processing personal data, we are committed to the principles relating to the processing of personal data set out in Article 5 of the GDPR and to making every effort to ensure that the data of individuals are:
- processed in a lawful, fair and transparent manner in relation to the data subject;
- collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes, except for the exceptions provided for in the GDPR;
- adequate, relevant and limited to the extent and to the extent necessary to achieve the stated purposes;
- accurate and kept up to date as necessary;
- kept in such a form as to permit identification of data subjects for no longer than is necessary for the predefined purposes (subject to the exceptions provided for in the GDPR);
- processed in such a way as to ensure, through appropriate technical or organisational measures, adequate security of personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage.
4. The Purposes
The personal data we collect, the purposes for which it is collected, the legal basis for collecting it, and the retention period are as follows: For the MCP plugin, browsing searches and product views are excluded from storefront query/view analytics. ACEB does not keep routine MCP request-content, IP-address or user-agent logs. Short-lived abuse-prevention counters still use the caller IP: read counters expire after one minute and cart/checkout counters after five minutes; hashed delivery-email checkout counters expire after one hour. This does not remove stored carts, orders or payment records.
4.1. Provision of Services
| Purpose of data processing | Loyalty Vault S.R.L. has the purpose of providing you with the services you have ordered and ensuring the smooth provision of such services. |
|---|---|
| Data subjects | Individual customers, business customers and their representatives, and recipients of gift purchases. |
| Personal data |
|
| Source of personal data | We receive data directly from you, through an AI host when you ask it to call our tools, and from payment or delivery providers as needed to process your order. |
| Legal basis | Processing needed to provide a requested service or perform a purchase contract is based on Article 6(1)(b) GDPR. Required accounting records are processed under legal obligations (Article 6(1)(c)). Proportionate abuse prevention and the establishment or defence of claims rely on legitimate interests (Article 6(1)(f)). |
| Consequences of failure to provide data | If you do not provide this personal data, Loyalty Vault S.R.L. will not be able to provide the services you request. |
| Storage | Order details currently have no automatic expiry or anonymisation schedule. You may request access or erasure at support@aceb.com; requests are assessed against applicable legal obligations and the need to resolve outstanding claims. Accounting registers and supporting accounting documents must generally be retained for five years calculated from 1 July of the year following the financial year in which they were prepared, under Romanian Accounting Law No. 82/1991, Article 25. Different statutory record categories and unresolved disputes may require longer retention. The statutory minimum does not by itself justify keeping every delivery email, gift message or other optional order detail indefinitely. |
4.2. Direct Marketing
| Purpose of data processing | Loyalty Vault S.R.L. has the purpose of providing news and other information about our Services and/or offers to you. |
|---|---|
| Data subjects | Persons who have purchased Loyalty Vault S.R.L. services and at that time or at any time thereafter did not object to the use of their personal data for direct marketing purposes in the context of marketing similar goods and/or services by Loyalty Vault S.R.L.; Persons who have provided their consent to the processing of their personal data for the purpose of direct marketing. |
| Personal data |
|
| Source of personal data | Loyalty Vault S.R.L. obtains personal data directly from you. |
| Legal basis | Your consent to the processing of personal data for direct marketing purposes (Article 6(1)(a) of the GDPR), or Our legitimate interest to notify our customers about similar goods and/or services offered by Loyalty Vault S.R.L. (Article 6(1)(f) of the GDPR). |
| Additional conditions | Based on our legitimate interest in notifying customers about similar goods and/or services offered by Loyalty Vault S.R.L., Loyalty Vault S.R.L. will process your personal data for direct marketing purposes only if all of the following conditions are present (Email and SMS direct marketing): When you purchase a product and/or service at Website, you do not expressly disagree with being sent direct marketing communications; Every time we send a direct marketing notification, you will be able to refuse direct marketing communications by notifying this via a specified email or other means specified in this Privacy Policy; Your personal data will be processed on this basis only for marketing similar goods and/or services offered by Loyalty Vault S.R.L.. |
| The data subject's right to object to or withdraw consent | The data subject may object to or withdraw they consent to the use of his or her data for direct marketing purposes at any time. If the data subject does not consent to the use of their personal data for direct marketing purposes or withdraws such consent, their data will no longer be processed for such marketing purposes, but the data subject will not lose the possibility to use our other Services. |
| Storage | Your personal data will be processed for the purpose specified in this Paragraph for 2 years from the date of its collection, or until you object to such processing of personal data, or until your consent to the processing of personal data for this purpose is withdrawn, whichever of these circumstances occurs first. |
4.3. Direct Communication
| Purpose of data processing | Loyalty Vault S.R.L. has the purpose of responding to your inquiries which you provide by email or standard mail, writing or calling by phone using a special form at Website, or contacting us directly. |
|---|---|
| Data subjects | Persons who submit inquiries to Loyalty Vault S.R.L. by email or standard mail, by writing or calling by phone, using a special form at Website, or by contacting us directly in person. |
| Personal data |
|
| Source of personal data | Loyalty Vault S.R.L. receives personal data directly from you. |
| Legal basis | Our legitimate interest to respond to your inquiries and/or provide you with detailed information about Loyalty Vault S.R.L. services (Article 6(1)(b), (c) and/or (f) of the GDPR). |
| Consequences of failure to provide data | If you do not provide this personal data, Loyalty Vault S.R.L. will not be able to respond to your inquiries. |
| Storage | Personal data provided to us in various requests from data subjects, which is retained for 6 months after the resolution of the request, but for at least one year after the request. |
4.4. Social Networks
| Purpose of data processing | Loyalty Vault S.R.L. has a purpose to manage its social network accounts and to communicate with users of social networks. |
|---|---|
| Data subjects | Users of social networks (Facebook, LinkedIn) who interact with us through Loyalty Vault S.R.L. accounts. |
| Personal data |
|
| Source of personal data | Loyalty Vault S.R.L. obtains personal data directly from you and/or from the relevant social network. |
| Legal basis | Our legitimate interest to communicate with the users of our social network accounts (Article 6(1)(f) of the GDPR). |
| Consequences of failure to provide data | If you do not provide this personal data, Loyalty Vault S.R.L. will not be able to communicate with you, to respond to your inquiries. |
| Storage | Given that Loyalty Vault S.R.L. does not administer the above social networks, but only its accounts on these networks, and acts as a joint data controller together with the companies that administer the said social networks, please familiarize yourself with the information about the storage of your personal data in the privacy documents of the following social networks: |
4.5. Legal Requirements and Dispute Resolution
| Purpose of data processing | Loyalty Vault S.R.L. may process all the above personal data in order to make claims and enforce or defend itself against legal claims. |
|---|---|
| Data subjects | The person who filed the complaint |
| Personal data |
|
| Source of personal data | Loyalty Vault S.R.L. receives personal data directly from you, or from payment collection or administration service providers, financial institutions, or other payment intermediaries, depending on your chosen method of payment for services. |
| Legal basis | Article 6(1)(f) of the GDPR. |
| Consequences of failure to provide data | The data subject is not obliged to provide his or her personal data for the above processing purposes. However, the failure to provide certain data may result in the data subject's request not being fulfilled. |
| Storage | If we believe that a dispute may arise in a particular case, we will keep the data relating to that case for the full duration of the relevant period of limitation prescribed by applicable law (depending on the nature of the potential claim), provided that it is not shorter than the relevant time limit set out above. |
5. Data Recipients
We may disclose information about you to our employees, representatives, intermediaries, suppliers, or subcontractors if this is reasonably necessary, e.g. to our providers of payment services who administer financial operations at Website, Website hosting service providers, providers of maintenance services of servers, email service providers, etc.
In addition, we may disclose information about you to:
- courts, arbitrators, mediators, counterparties, and their lawyers (if required for the purpose of judicial or other similar proceedings);
- police, law enforcement authorities, tax authorities, other state or municipal authorities (if it is expressly required by the relevant legal acts), or other persons performing official duties assigned to them (e.g. notaries, debt recovery companies);
- professional consultants, such as lawyers, advisers, auditors, or accountants (if this is necessary to ensure our legitimate interests);
- service providers who provide information technology, cloud computing, and system administration services, payment collection or administration, marketing, and accounting services, postal or courier services only to the extent necessary for the proper provision of services;
- other entities within the same group of companies, only to the extent this is necessary for the proper administration of the group of companies;
- when performing business transactions (sale of Loyalty Vault S.R.L., its assets (part thereof) or its shares (part thereof), merger or division of Loyalty Vault S.R.L., etc.), to potential or final acquirers (their representatives), persons performing inspection of Loyalty Vault S.R.L. or otherwise participating in the relevant business transaction. In this case, Loyalty Vault S.R.L. will transfer only as much personal data as is necessary for the purposes of the business transaction and will ensure the confidentiality of personal data.
Also, in each case, if we transfer your personal data to a third country (outside the EU/EEA), one of the following conditions must be met:
- the data shall be transferred to the country, with respect to which the decision on adequacy has been adopted;
- the transfer of data is carried out using appropriate safeguards as specified in legal acts;
- the derogations provided for in legal acts are complied with if it is not possible to transfer the data under the above conditions.
Loyalty Vault S.R.L. will make every effort to ensure that the transfer of data takes place in accordance with the GDPR requirements and will take appropriate measures to ensure that your personal data is secure. For more information about such measures, please contact us directly using the contact details specified in Paragraph 2 of this Privacy Policy.
Our Website may contain third party banners, links to their websites and services over which we have no control. We are not responsible for the security and privacy of data collected by third parties. The data subject must inquire about the privacy protection of such data with the relevant third parties whose websites or services they use.
6. Your Rights
The data subject has the right to contact us regarding questions related to the processing of his personal data, i.e. have the following rights:
- the right to receive information about data processing;
- the right to access your data (request our confirmation as to whether your personal data is processed, and if so - to access your data and how they are processed);
- the right to demand correction of data or, taking into account the purposes of personal data processing, to supplement incomplete personal data of a person;
- the right to demand the deletion of data or the suspension of their processing actions (except for storage) (the right to destruction and the right "to be forgotten");
- the right to restrict data processing;
- the right to data portability;
- the right to object to the processing of personal data;
- the right to submit a complaint to the supervisory authority;
- other rights established by the legal acts applicable to the processing of personal data.
Any request related to the processing of personal data can be submitted by the data subject to us by e-mail at support@aceb.com or by sending the request by post or by coming to our office at the address below. Taking into account the subject of the data subject's request, in order to ensure the confidentiality of the personal data we process, we may require the person who submitted the request to provide additional information necessary to determine the identity of the personal data subject and/or confirm his identity in a specific way (for example, signing the request with a secure electronic signature, personally coming to location and provide a valid identity document, send a duly certified copy of such document, etc.). If a person does not comply with such a request from us, the requested information may not be provided.
We undertake to respond to all requests related to the processing of personal data in accordance with the procedure established by the GDPR within one month of receiving the request.
7. Privacy Policy Updates
We have the right to update or change this Privacy Policy at any time. Such an updated or amended Privacy Policy will enter into force upon its publication at Website.
8. Filing Complaints
If you believe that the processing of your personal data violates the provisions of the GDPR, you have the right to lodge a complaint with the supervisory authority of the EU Member State of your habitual residence, your place of work, or the place of the alleged infringement.
The Romanian supervisory authority is the National Supervisory Authority for Personal Data Processing (ANSPDCP):
B-dul G-ral Gheorghe Magheru 28–30, Sector 1, 010336 Bucharest, Romania
Before submitting a complaint to the supervisory authority, we would appreciate it if you would contact us and explain your concerns to us. We will make maximum efforts to resolve your question expeditiously and carefully. You may at any time contact us by e-mail to support@aceb.com.
Loyalty Vault S.R.L. will examine your request to exercise the rights of the data subject within 1 month. This period may be extended, if necessary, for a further period of 2 months, taking into account the complexity and number of requests. In this case, Loyalty Vault S.R.L. will notify you of any such extension within 1 month of receipt of the request, together with the reasons for the delay.
If upon the receipt of a request, complaint, or claim, we have suspicions regarding your identity, we have the right to request additional information necessary to confirm your identity.