Privacy Policy

Introduction

Loyalty Juggernaut Inc. (“LJI”, “we”, or “us”) respects your privacy and is committed to protecting your personal data. This Privacy Policy describes how we collect, use, and share personal data when:

• You visit or interact with our website at https://www.lji.io, and
• When we process personal data on behalf of our clients through our platform, GRAVTY®.

Loyalty Juggernaut, Inc. complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. LJI has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. LJI has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern.

To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/

Scope of this policy

This Privacy Policy applies to personal data:

• Collected through LJI’s website (e.g., contact forms, newsletter subscriptions, cookies),
• Collected from customers, users, and members through the GRAVTY® platform, and
• Transferred to LJI in the United States from the EU, UK, or Switzerland in reliance on the DPF Principles.

When acting as a Data Processor (e.g., for GRAVTY® customers), LJI processes data only under the instructions of our clients, who act as the Data Controllers.

Data Privacy Framework Principles

1. Notice

LJI collects personal data such as name, email address, IP address, contact details, organization name, and usage logs. This data is collected for purposes including:

• Responding to website inquiries,
• Providing access to GRAVTY® and its features,
• Performing analytics, customer support, and service improvements,
• Ensuring security, compliance, and audit requirements.

We disclose the types of data collected and its use to individuals at the time of collection or through this Privacy Policy.

LJI may also receive and process personal data from individuals located in the EU, UK, or Switzerland in the context of employment-related activities. This includes data about job applicants, employees, and contractors, such as contact details, employment history, compensation, and benefits information. This data is processed solely for human resources and internal administrative purposes (e.g., recruitment, payroll, legal compliance) under applicable legal and contractual obligations.

2. Choice

If we intend to use personal data for purposes materially different from those originally disclosed or if we share it with third parties not acting as our agents, we will provide individuals with an opportunity to opt out.

We do not use sensitive personal data (e.g., health or financial information) unless explicitly authorized.

3. Accountability for Onward Transfer

LJI may transfer personal data to trusted third parties (e.g., AWS, email processors, analytics providers) who assist us in operating our business. All such transfers are made under contracts that require recipients to follow the DPF Principles or offer equivalent protection.

A list of our subprocessors is available upon request at privacy@lji.io.

4. Security

We implement appropriate technical and organizational measures to protect personal data, including:

• Encryption at rest and in transit (AES-256, TLS 1.2+),
• Access control via role- and attribute-based permissions,
• Network firewalls, bot protection (WAF), and intrusion detection,
• Audit logging and continuous monitoring.

5. Data Integrity and Purpose Limitation

LJI limits the collection and use of personal data to what is relevant and necessary for the purposes for which it is processed.

For data processed on behalf of LJI Customers, LJI processes personal data strictly under the instructions of its Customers, who determine the categories of data collected and the purposes for which it is used. LJI does not use such data for any other purpose.

In the context of employment-related activities, LJI may receive personal data of individuals located in the EU, UK, or Switzerland (such as job applicants, employees, and contractors) for human resources and internal administrative purposes. This data is processed solely as necessary to support employment functions, in accordance with applicable legal, regulatory, or contractual obligations.

LJI retains personal data only for as long as necessary to fulfill the intended processing purpose or to comply with applicable legal and contractual requirements. Data is reviewed periodically to ensure it remains accurate, complete, and current for its intended use.

6. Access

Individuals from the EU, UK, or Switzerland whose data we process under the DPF may request access, correction, or deletion by contacting us at dpo@lji.io.

Where LJI acts as a data processor, individuals should contact the relevant GRAVTY® client directly.

7. Recourse, Enforcement, and Liability

LJI commits to resolving complaints regarding our collection or use of personal data under the DPF. EU, UK, and Swiss individuals with inquiries or complaints should contact:

In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, LJI commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs), the UK Information Commissioner’s Office (ICO), and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF.

Binding Arbitration:

If your DPF-related complaint cannot be resolved through the channels described above, you may, under certain conditions, invoke binding arbitration for some residual claims that have not been resolved by other redress mechanisms. This option applies only with respect to personal data that has been received or transferred pursuant to the Data Privacy Framework.

Disclosures and Legal Requests

We may disclose personal data if required to comply with lawful requests by public authorities, including to meet national security or law enforcement requirements.

LJI remains liable under the DPF Principles if an agent processes personal data in a manner inconsistent with those Principles unless we can prove we are not responsible.

Regulatory Oversight

LJI is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission (FTC).

Updates to This Policy

This Privacy Policy may be updated periodically. We will post any changes on this page and indicate the effective date at the top.

Contact

If you have questions about this Privacy Policy or our data handling practices, please contact: