Last updated: 15 October 2026
This policy explains how Gamma Wallet handles personal data when you use our website (www.gamma-wallet.com), our blog (blog.gamma-wallet.com), the Gamma Wallet app for customers, the Gamma Business app and web portal for businesses, and the community portal for organisations.
Gamma Wallet is operated by Gamma Wallet Ltd, a company registered in England and Wales under company number 17168282, with its registered office at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom (“Gamma”, “we”, “us”). We follow the UK GDPR and, because we offer our services in the European Union, the EU General Data Protection Regulation (GDPR). For any privacy question or request, write to us at:
Our data protection contact is Remion Bacova. For any question on your personal data or your rights, write to:
Because Gamma Wallet Ltd is based in the United Kingdom, we have appointed a representative in the European Union under Article 27 of the GDPR. Data protection authorities and people in the EU can contact our representative about any question on the processing of their data:
Arben Rama, Italy
If your question is about how a particular business or organisation uses your data, you can contact them directly, or write to us and we will pass your request on.
The apps ask for permission to use your location. Gamma Wallet uses it to show businesses and offers near you and to detect your country when you scan a receipt; your position is sent with the search but we do not store it. Gamma Business uses it to find your shop’s address, which is then saved as the business address. You can refuse or withdraw location access at any time in your phone’s settings.
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Create and run your account, wallet and reward contracts | Account, wallet and transaction data | Contract — Art. 6(1)(b) |
| Verify your phone number and email, and reset your password | Phone number, email address | Contract — Art. 6(1)(b) |
| Service notifications (credit received, card expiring, level reached) | Notification token, email address, phone number | Contract — Art. 6(1)(b) |
| Messages from businesses where you hold a card, and from your organisation | Notification token, email address | Legitimate interest of the business or organisation in informing its own customers or members — Art. 6(1)(f). You can switch these off in the app at any time. |
| Show businesses and offers near you | Location (not stored) | Consent, given through your phone’s location permission — Art. 6(1)(a) |
| App usage statistics | App events, country, language, a pseudonymous user ID | Legitimate interest in understanding how the apps are used so we can improve them — Art. 6(1)(f). You can object at any time by emailing us. |
| Website and blog statistics | Google Analytics cookies | Consent — Art. 6(1)(a) |
| Answer your contact form message | Name, email address, message, IP address | Legitimate interest in replying to you and preventing spam — Art. 6(1)(f) |
| Business subscriptions and invoicing | Email address, payment status | Contract — Art. 6(1)(b) |
| Security, fraud prevention and fixing errors | IP address, technical logs | Legitimate interest in keeping the service safe — Art. 6(1)(f) |
| Tax and accounting records, and requests from authorities | Invoices and payment records | Legal obligation — Art. 6(1)(c) |
We do not sell your personal data and we do not use it for advertising.
Businesses see your nickname and your card, credit and reward contracts with them. Organisations see the member details described above. Beyond that, we share data only with the service providers below, who process it on our instructions under a data processing agreement.
| Provider | What for | Where |
|---|---|---|
| Google Cloud | Servers, file storage and technical logs | Google data centres in the EU and the United States |
| MongoDB Atlas (on Google Cloud) | Database | European Union (Belgium) |
| Google Firebase | Push notifications and app usage statistics | EU and United States |
| Google Maps | Maps in the apps | United States |
| Google Analytics | Website and blog statistics, only with your consent | United States |
| Twilio | SMS verification codes and SMS notifications | United States |
| Twilio SendGrid | Emails: verification codes, notifications and messages from businesses | United States |
| Cloudflare | Delivering and protecting our websites, menu pages and menu files | Global network (United States company) |
| Stripe | Payments for business subscriptions | Ireland and United States |
| OpenCage | Turning a shop’s location into an address | Germany |
| OpenStreetMap Foundation (Nominatim) | Detecting your country when you scan a receipt — your phone contacts it directly | United Kingdom |
We also share data with the Albanian tax authority when we check a fiscal receipt you scanned, with public authorities when the law requires it, and — only if a business chooses to connect an AI assistant such as Claude (Anthropic) to its own account — with that assistant, limited to the business’s own data.
Gamma Wallet Ltd is based in the United Kingdom, while our database is hosted in the EU; data moving between the EU and the UK is covered by the EU’s adequacy decision for the United Kingdom. Some providers are based in the United States or may access data from there. Those transfers rely on the EU–US Data Privacy Framework (and its UK extension) for certified providers, and otherwise on the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum. You can ask us for a copy of these safeguards.
Under the GDPR you have the right to:
You can delete your account yourself in the app, or follow the steps on our Delete Account page. For any other request, email us. We reply within one month and may ask you to confirm your identity first.
You can complain to the data protection authority in the EU country where you live or work, or where you believe your rights were breached. In the United Kingdom, the supervisory authority is the Information Commissioner’s Office (ico.org.uk).
Our website and blog use a few cookies: two strictly necessary ones that remember your cookie choice and your language, and Google Analytics cookies that are set only if you accept them in the cookie banner. The full list, with durations, is in our Cookie Policy:
In the apps, your login session, language and settings are stored on your phone, and Gamma Wallet keeps on your phone the key it uses to sign your reward contracts.
All connections to our apps and websites are encrypted (HTTPS). Our database is hosted in the EU and access to our systems is limited to the people who need it for their work. If a data breach puts your rights at risk, we will notify the supervisory authority and, where required, you.
Gamma is only for people aged 18 and over, and the apps are age-restricted accordingly in the App Store and Google Play. We do not knowingly collect data from anyone under 18. If you believe someone under 18 has registered, contact us and we will delete the account.
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Rewards and membership levels follow the rules each business sets.
When we change this policy we publish the new version on this page and update the date at the top. If a change is significant, we will also tell you in the app or by email.
For any question about this policy or your data, write to our data protection contact, Remion Bacova: