Privacy policy

1. (a)
   earnr members;
2. (b)
   people whose earnr records we set up from details they gave a Boshhh Group service (section 6);
3. (c)
   visitors to getearnr.com; and
4. (d)
   anyone who contacts us or talks to Earni, our assistant.

Registration with the Information Commissioner’s Office: number to be added.

1. (a)
   email help@boshhhgroup.com, with “Data protection” in the subject line;
2. (b)
   phone 0161 505 0879; or
3. (c)
   write to the address above.

1. 1.
   You connect your bank on the Boshhh open banking page. You do this through Bud, for Boshhh’s own services. That connection is covered by the Boshhh privacy notice.
2. 2.
   You join earnr. On the same page there is a separate box for earnr. Ticking it is a required step to continue when you connect your bank through the Boshhh page. By ticking it, you join earnr and agree that earnr may use up to 6 years of your past transactions and keep collecting new ones, to find cashback for you. We record that you ticked it, the wording you saw and when. You can leave earnr at any time (paragraph 5.7).
3. 3.
   We enrol you in earnr. We set up your earnr membership from the details you gave on the Boshhh page.
4. 4.
   We collect your transactions every day through the same Bud connection. The connection is read-only.
5. 5.
   We match your transactions ourselves against the retailers that currently have an earnr cashback offer. Most of your transactions will not match anything, and those stay with us.
6. 6.
   We send Boogi only the transactions that match. For each matched transaction this is:

   • the bank’s description of the transaction, exactly as your bank shows it;
   • the amount;
   • the date; and
   • the payee or merchant name.

   When we enrol you with Boogi, we also send your postcode, your country and an internal member id (a random reference, not your name or phone number). Boogi needs the postcode to work out which offers are available where you live.

7. 7.
   Boogi confirms which matched transactions earn cashback, working with the retailer or network.
8. 8.
   We set your cashback rate. We decide how much of the retailer’s commission you receive, and show it on each offer before you spend. We keep the rest. (See section 8 of our Terms of Business.)
9. 9.
   We record and track your cashback through the stages in our Cashback and Withdrawal Policy.

1. (a)
   earnr uses your bank data only if you have ticked the earnr box, and only from that moment;
2. (b)
   your Boshhh service does not use your earnr cashback records; and
3. (c)
   if you opt out of earnr, Boshhh’s own services carry on as before.

1. (a)
   it may use your data only to confirm transactions against offers, calculate and confirm cashback, and report to retailers in a way that does not identify you;
2. (b)
   it must not sell your data or use it for its own marketing or anyone else’s;
3. (c)
   it must not pass your transaction data on to other offer or advertising networks;
4. (d)
   it must keep your data secure and delete it when we ask, including when you opt out or close your account; and
5. (e)
   it must not move your data outside the UK or EEA without safeguards (section 12).

1. (a)
   Bud asks for your explicit consent before it collects your data, as the payment services rules require. That consent must cover earnr’s cashback purpose as well as Boshhh’s own purposes.
2. (b)
   We ask for your explicit consent to process any sensitive information that your transactions may reveal (section 7). This is part of the earnr opt-in.

1. (a)
   we stop collecting your transactions for earnr and stop sending matches to Boogi;
2. (b)
   we ask Boogi to delete what it holds about you, except what is needed to confirm and pay cashback you have already earned;
3. (c)
   cashback already recorded is not affected; and
4. (d)
   your Boshhh service is not affected. Your bank connection stays in place for it unless you end it.

1. (a)
   your name and title;
2. (b)
   your date of birth;
3. (c)
   your email address;
4. (d)
   your phone numbers; and
5. (e)
   your postal address and country.

We also copied gender, marital status and residential status where we held them. earnr does not use these, and we will delete them.

We did not copy any bank details, National Insurance number, income details or earlier marketing consents.

1. (a)
   Why we think this is fair. We believe this is compatible with the reason you first gave us your details. We have kept the data to the minimum, we protect it in the same way as members’ data, and we give you a simple way to say no.
2. (b)
   What we will not do. We will not send you marketing because of this record (section 10), and we will not send your details to Boogi.
3. (c)
   Seeing our assessment. You can ask for a copy of our legitimate interests assessment.

1. (a)
   object to us holding your details for earnr. If you do, we will delete the record. We keep only your phone number or email address on a “do not set up again” list, so that we do not recreate the record by mistake;
2. (b)
   ask us to correct anything that is wrong; or
3. (c)
   do nothing. If the record is never used, we will delete it by 8 September 2027.

1. (a)
   donations to a religious or political organisation;
2. (b)
   trade union subscriptions;
3. (c)
   payments to health providers or pharmacies; or
4. (d)
   payments that hint at your sex life.

1. (a)
   your explicit consent, which we will ask for at the start of the check; and
2. (b)
   where the law allows it, the condition for preventing or detecting unlawful acts in the Data Protection Act 2018.

If you would rather not do a selfie check, tell us, and we will offer another way to verify you.

1. (a)
   match your transactions to retailers;
2. (b)
   calculate cashback; and
3. (c)
   choose and order the offers you see, based on where you already shop and where you live.

This is profiling, but it does not have legal or similarly significant effects on you.

1. (a)
   They never permanently refuse, reverse or forfeit your cashback, or close your account, on their own. A member of our team reviews any such decision first.
2. (b)
   You can ask for a person to review any automated decision, put your point of view, and challenge the outcome. The Cashback and Withdrawal Policy explains how.

1. (a)
   No data goes to China. We never send your information to DeepSeek’s own service or to any provider in China. Our systems are set up so that requests can only go to the EU providers we have chosen, with no fall-back to any other provider.
2. (b)
   No copies and no training. We only use providers that keep no copy of your messages once the reply is sent, and that do not use them to train AI models.
3. (c)
   Where the data goes. The model runs in the European Union. OpenRouter, which routes the request, is in the United States (section 12).

1. (a)
   you have opted in; or
2. (b)
   you are an earnr member, we are telling you about similar earnr services, and you were given a simple way to opt out when you joined and in every message (the “soft opt-in”).

1. (a)
   the UK–US data bridge (the UK Extension to the EU-US Data Privacy Framework), where the US recipient is certified under it;
2. (b)
   the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses; and

in either of the cases in (b), a transfer risk assessment, with extra safeguards where it shows they are needed.

1. (a)
   be informed about how we use your data, which is what this policy is for;
2. (b)
   get a copy of the personal data we hold about you;
3. (c)
   have it corrected if it is wrong or incomplete;
4. (d)
   have it deleted where we no longer need it or have no lawful basis to keep it;
5. (e)
   restrict how we use it, for example while we check a correction you have asked for;
6. (f)
   object to any use based on legitimate interests, including how we hold records set up from earlier enquiries (section 6). We must stop unless we have compelling grounds that outweigh your interests, or we need the data for legal proceedings;
7. (g)
   object to direct marketing at any time. This right is absolute, and we will always stop;
8. (h)
   move your data: receive the data you gave us, or that we got through your bank connection, in a machine-readable format;
9. (i)
   withdraw consent at any time, where we rely on it, including your earnr opt-in, your consent to the bank connection, and your consent to SMS or WhatsApp notifications. Opting out of earnr does not affect your Boshhh service. This does not affect what we did before you withdrew it; and
10. (j)
    ask a person to review an automated decision and challenge it (section 8).

1. (a)
   Using your rights is free.
2. (b)
   We will reply within one month. If your request is complex, we may extend this by up to two more months, and we will tell you if we do.
3. (c)
   We may ask you to prove who you are. We will usually do this with a sign-in code to your registered number.
4. (d)
   For data Bud holds as a separate controller, you can also contact Bud directly.

1. (a)
   online at ico.org.uk;
2. (b)
   by phone on 0303 123 1113; or
3. (c)
   by post to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

1. (a)
   encryption of data in transit and at rest;
2. (b)
   access limited to the staff who need it, with access controls at database level;
3. (c)
   read-only, time-limited bank access;
4. (d)
   sending Boogi a random member id instead of your name or number; and
5. (e)
   monitoring for unusual activity.