MAMMAM

Privacy Policy

Last updated: [[EFFECTIVE_DATE]]

This policy explains how personal data is processed when you use MAM through its website, mobile applications and associated features, including those for affiliated businesses (Employers), Employees, Private users, Partners and Merchant cashiers. It provides information under Articles 12, 13 and, where relevant, 14 of Regulation (EU) 2016/679 (GDPR).

Please see our Terms and Conditions for contractual terms and our Cookie Policy for cookies and similar technologies. Accepting the Terms, acknowledging this Privacy Policy and granting any optional consent are separate actions.

1. Controller and contact details

The controller responsible for the platform activities described here is [[CONTROLLER_LEGAL_ENTITY]], registered at [[FULL_REGISTERED_ADDRESS_AND_COUNTRY]], company registration/VAT number [[REGISTRATION_OR_VAT_NUMBER]] ("MAM", "we" or "us").

For privacy questions and data-subject requests: [[MONITORED_PRIVACY_EMAIL]]. Data Protection Officer (DPO), if appointed: [[DPO_CONTACT_OR_REMOVE_SENTENCE]].

Affiliated companies may be independent controllers for certain activities, such as managing employment relationships and making decisions about rewards or benefits. Please also consult the relevant company's employee privacy notice. The roles of MAM and participating companies depend on the services actually provided and their applicable agreements.

2. Categories of personal data

  • Account and identity: first and last name, email address, user ID, country, language, role, account status, email-verification details, authentication information and an optional profile image. Authentication credentials are handled by authentication services and should never be shared with support staff.
  • Companies, relationships and invitations: business name, country, billing and tax information (including VAT identifiers where supplied), business role information, user-company relationships, inviting and invited parties, Partner and referral information, and cashier permissions.
  • MAM wallet and economic activity: balances, allocations, purchases, sales, requests, conversions, Merchant redemptions, euro and MAM amounts, reference prices, receipts, invoices, subscriptions, commissions, refunds, disputes, withdrawals, transaction references and audit records.
  • Payments and payouts: Stripe transaction identifiers, payment statuses, connected payout-account profiles and eligibility statuses. Stripe may collect banking details, identity information and verification documents directly for its services and legal compliance; MAM may receive necessary identifiers, statuses and verification outcomes.
  • Support and communications: support tickets, categories, messages, voluntarily submitted attachments, support responses and ratings, platform notifications and service emails.
  • Technical and security data: login, session, event and transaction timestamps, language settings, essential browser and device characteristics, diagnostics and, where processed by our infrastructure, IP addresses and logs necessary for security and troubleshooting.
  • Preferences: choices relating to optional cookies, communication settings and language preferences, where supported by available features.

Camera and Merchant QR codes: when a cashier chooses to scan a QR code, the browser may ask to use the camera. In the current MAM Merchant web scanning feature reviewed, camera frames are processed on the device to read a temporary code; the scanning feature does not upload the video stream. You may deny or revoke the permission and enter the code manually where available.

3. Where information comes from

We receive information directly from you when you register, verify your identity, use the service or contact support; from affiliated businesses that invite you or enroll you in their programs; from Partners sending invitations; from identity providers when you choose third-party sign-in; from Stripe concerning payment and payout status; and automatically through technical systems and event records when you use the service. Information received from others is used for the relevant invitation, company-affiliation verification or requested transaction under the applicable lawful basis.

4. Purposes and lawful bases

PurposeMain lawful basis
Create, verify, secure and manage accounts; provide role-specific features and requested support.Performance of a contract or pre-contractual steps (GDPR Article 6(1)(b)).
Manage invitations, company relationships, benefits, MAM wallets, Merchant, the marketplace, subscriptions and related transactions.Performance of a contract (Article 6(1)(b)); where appropriate, legitimate interests in managing company relationships (Article 6(1)(f)).
Handle payments, invoices, accounting, tax checks and applicable legal requirements.Performance of a contract (Article 6(1)(b)) and compliance with legal obligations (Article 6(1)(c)).
Prevent fraud and misuse, protect accounts, transactions and economic integrity, and retain strictly necessary security and audit logs.Legitimate interests in security and fraud prevention (Article 6(1)(f)), and legal obligations where applicable (Article 6(1)(c)).
Respond to privacy-rights requests and demonstrate legal compliance.Legal obligation (Article 6(1)(c)) and legitimate interests in establishing and defending rights (Article 6(1)(f)).
Use optional non-essential cookies or send optional marketing communications, only if actually enabled and lawfully permitted.Prior consent where required (Article 6(1)(a) and applicable cookie/direct-marketing rules).

Where we rely on legitimate interests, we assess necessity and balance those interests against your rights and freedoms. You may object where the GDPR permits.

Required and optional information: information marked as mandatory during registration or a transaction is needed to establish the account, verify identity, carry out the relevant operation or comply with law. Without it, we may be unable to provide the requested feature. Profile photographs, optional attachments and non-essential consents are not required for functions that do not depend on them.

5. Who receives personal data

Access is restricted to people and recipients who need the information for legitimate purposes, including:

  • Affiliated companies and authorized cashiers: information needed to identify eligible users, allocate benefits and authorize or reconcile company-related MAM transactions. Visibility depends on role and transaction.
  • Base44 and its underlying technical providers: app infrastructure, authentication, databases, storage, backend operations and security.
  • Stripe and relevant group entities: payment processing, subscriptions, connected-account verification, transfers, payouts, fraud prevention and disputes, according to their respective policies and applicable roles.
  • Google: for authentication if you choose Google sign-in; MAM also uses connected Gmail infrastructure to send some service emails.
  • Authorized Partners: limited information required for invitation management, attribution of introduced businesses and relevant commissions.
  • Professional advisers, auditors, authorities and counterparties: where necessary for legal obligations, legal claims, audits, disputes or requested operations.

We do not sell personal data to data brokers. Any future use of additional service providers, advertising tools or artificial intelligence services receiving personal data will require an updated disclosure and, where necessary, a separate user choice before sharing.

6. Transfers outside the European Economic Area

Some technology, identity, email and payment providers may operate outside the European Economic Area. Before such transfers, the relevant GDPR conditions must be verified, including an applicable adequacy decision or appropriate safeguards such as Standard Contractual Clauses and any required supplementary measures. You can request details of actual destinations and safeguards through the privacy contact. [[VERIFY_ACTUAL_SUBPROCESSORS_COUNTRIES_AND_SAFEGUARDS]].

7. How long data is kept

We keep data only for as long as necessary for the stated purposes or to comply with law. The following criteria apply; the exact periods must match MAM's actual retention schedule:

  • Account and profile information: for the duration of the relationship and, after a valid deletion request, as long as needed to delete or anonymize data that need not be retained.
  • Accounting records, transactions, payouts, invoices and financial audit data: for periods mandated by applicable tax, accounting and other laws, including after account closure. [[SPECIFY_APPLICABLE_STATUTORY_PERIODS]].
  • Access and security logs: [[SECURITY_LOG_RETENTION_PERIOD]], subject to documented investigations or disputes.
  • Support messages and attachments: [[SUPPORT_AND_ATTACHMENT_RETENTION_PERIOD]], subject to legal obligations or ongoing claims.
  • Unaccepted invitations and prospective-user information: [[UNACCEPTED_INVITATION_RETENTION_PERIOD]], based on expiration and fraud-prevention needs.
  • Proof of legal acceptance: as needed to demonstrate compliance and protect rights, under [[LEGAL_ACCEPTANCE_EVIDENCE_RETENTION_PERIOD]].
  • Cookies and preferences: as explained in the Cookie Policy.

When there is no longer a lawful reason to keep information, it must be erased or anonymized. Access to records retained under legal requirements is restricted to those remaining purposes.

8. Account and data deletion

You can initiate account deletion from your Profile by selecting “Delete account” where available. Disabling account access or marking an account as deleted does not, by itself, mean that every associated personal record has been erased. Where there are pending transactions, balances, contractual requirements or records that must legally be retained, some information may remain for limited purposes and applicable periods.

You can also request deletion without signing in: write to [[MONITORED_PRIVACY_EMAIL]] from, or identifying, the email associated with your account, with the subject “MAM account deletion request”. We may request reasonable identity verification to prevent fraudulent deletion. We will explain the outcome and any categories of data that must be retained by law.

Public account-deletion request page: [[PUBLIC_ACCOUNT_DELETION_REQUEST_URL]]. This must work after uninstalling the app and must not require people to reinstall it.

If the in-app option is blocked because of a company relationship, subscription or financial transaction, you may still submit a request to erase or restrict personal data using the privacy contact; we will assess separately what can be erased and what must lawfully remain.

9. Your privacy rights

Subject to applicable law, you may request access, rectification, erasure, restriction, portability and objection, and may withdraw previously given consent without affecting earlier lawful processing. You also have applicable rights concerning decisions based solely on automated processing under GDPR Article 22.

To exercise your rights, contact [[MONITORED_PRIVACY_EMAIL]]. We will respond without undue delay and normally within one month, subject to extensions permitted by law and appropriately communicated. You may lodge a complaint with a competent supervisory authority, including the Spanish Data Protection Agency (AEPD) or, where competent, the Italian Data Protection Authority (Garante).

10. Cookies and communications

Essential cookies may be required for authentication, security and service operation. Optional categories, such as analytics and marketing, should operate only where the applicable lawful basis exists and users' choices are respected. See our Cookie Policy for categories and durations. If a consent can no longer be changed using the available controls, contact our privacy address or manage permissions through your browser/device. Withdrawing optional consent should not affect services that do not depend on the optional processing.

Security, invitation, transaction, payment and support messages are service communications. Any optional marketing must remain separate and capable of being withdrawn.

11. Security

MAM uses authenticated, role-based access controls, server-side validation, event records and external payment services to restrict access and help maintain transaction integrity. Connections to the public service use HTTPS. No information system can provide absolute security; incidents are handled in line with applicable legal obligations.

12. Automated calculations and checks

MAM uses automated rules to manage MAM balances, reference prices, quotes, transaction eligibility, Merchant authorizations and integrity checks. Such rules can determine whether a requested operation is available and its relevant amounts. If you want an explanation, need to contest a result or seek human intervention where the law requires it, contact privacy or support. Any processing falling within GDPR Article 22 requires additional disclosures and safeguards.

13. Minimum age and children's data

MAM is intended for people legally able to register and carry out the relevant transactions under applicable law and the Terms and Conditions. The platform's adopted minimum age is [[VERIFIED_MINIMUM_AGE]]. The service is not designed to knowingly collect information from children who do not meet those requirements. If you think that has happened, please contact us so we can investigate.

14. Updates and further information

We may update this policy when features, service providers or legal obligations change. The current version will be posted on this page and, where required, we will provide additional notice or seek specific consent. Previous published versions are retained for traceability where supported by the platform.

Privacy contact: [[CONTROLLER_LEGAL_ENTITY]] — [[MONITORED_PRIVACY_EMAIL]].

We value your privacy

We use cookies to enhance your browsing experience, analyze site traffic, and serve relevant content. You can choose to accept all cookies, reject non-essential ones, or manage your preferences at any time. See our and for details.