Last updated: 18 October 2026
This Privacy Policy explains how personal data is processed when you visit https://loyalz.online (the "Website"), submit an enquiry through it or otherwise communicate with us. It is issued in accordance with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "UAE PDPL").
1.1. Controller. The controller of your personal data is:
GDFAMILY L.L.C-FZ, a company registered in the Meydan Free Zone, Dubai, United Arab Emirates
Formation number: 2205389
Licence number: 2205389.01
Registered address: Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E.
Email: info@loyalz.online
(referred to in this Policy as "LOYALZ", "we", "us" or "our"). LOYALZ is the brand under which GDFAMILY L.L.C-FZ provides loyalty programme consulting services.
1.2. Technical service provider (processor). The Website and the related databases are administered and hosted on our behalf by Individual Entrepreneur Sergey Mikhailovich Belyaev (OGRNIP 319774600181477, TIN 770902234931), located in the Russian Federation (the "Technical Service Provider"). The Technical Service Provider processes personal data only on our documented instructions and under a data processing agreement, as described in Section 8.
1.3. Contact. For any question about this Policy or to exercise your rights, write to info@loyalz.online with the subject line "Personal data".
2.1. This Policy applies to the English-language version of the Website and to personal data we collect through it, including enquiry forms, cookies and similar technologies, and to related correspondence.
2.2. The Russian-language version of the Website (pages with the "-ru" suffix and https://loyalz.online/ru) is operated by Individual Entrepreneur Sergey Mikhailovich Belyaev as an independent operator under Russian Federal Law No. 152-FZ "On Personal Data" and is governed by a separate policy available at https://loyalz.online/privacy-ru.
3.1. Data you provide through enquiry forms: name; company name; corporate email address; phone number (optional); the content of your message; the language version and address of the page from which the form was submitted.
3.1.1. Checklist data. If you complete the loyalty programme checklist on the Website and ask to receive your result by email, we collect your name, work email address and, optionally, company name, together with your answers to the checklist questions, the checklist version and the programme profile calculated from your answers. Until you submit the form, your answers stay in your browser and are not sent to us.
3.2. Data from our correspondence and business relationship: contents of emails and messages, meeting notes, your job title, and data necessary to prepare and perform a contract with you or the organisation you represent.
3.3. Technical data collected automatically: IP address; approximate location derived from the IP address (country level); browser type and version; device type and operating system; date and time of access; pages visited; referring page; cookie and similar identifiers.
3.4. Spam protection data: when you submit a form, our website platform (Tilda) receives technical characteristics of your browser (browser languages, platform, browser vendor, screen size, time zone and installed plugins). Together with the form submission, Tilda also receives the Website's technical security cookies (__ddg*, Section 5.2), which help it tell a person from an automated program. This data is used solely to protect the forms against spam and automated submissions; it is not used to identify you or for analytics.
3.5. We do not collect web analytics data on the English version of the Website and do not record sessions.
3.6. We do not request and do not intend to collect sensitive personal data (such as data on health, religion, political opinions or criminal records). Please do not include such data in your messages.
3.7. Website, quiz and checklist statistics. On every page of the Website we count page views and certain actions: clicks on booking buttons and links, a successful form submission (without its content), scrolling an article to 75%, and moving to the quiz or the checklist. For each event, your browser sends only codes from lists we have defined in advance: the page, the language version, the category of the referring source (for example a search engine, a social network or a direct visit, without the address of the referring page), our campaign code from the UTM tag (only codes from our own list), the device type (mobile or desktop), and the country code. The country code is determined by Tilda, our website platform, in order to serve the appropriate language version. We store only the number of events with the same codes per date.
On the quiz pages (https://loyalz.online/quiz and https://loyalz.online/quiz-ru) we count how many times the quiz is started and completed, which result is shown and which "Share" buttons are clicked. On the checklist pages (https://loyalz.online/checklist and https://loyalz.online/checklist-ru) we count how many times the short or full version of the checklist is started and completed, and how many times a result is requested by email. Your browser sends a request containing only the event type to our cloud function hosted by Yandex.Cloud LLC. We store only the number of events of each type per date. Your checklist answers, name, email address, IP address, browser or device information (other than the device type and country code for website events), cookies, identifiers and the exact time of the event are not included in the request and are not stored, and logging of these requests is disabled. These events are not linked to your checklist form submission or to each other. These statistics do not identify you and are not personal data. Your IP address, which is technically required to deliver the request, is processed by the hosting platform only while the request is transmitted and is not stored. For this counting, the Website, the quiz and the checklist do not use cookies or identifiers and do not store any information in your browser. Aggregated statistics that do not identify you may be kept without a time limit.
| Purpose | Personal data | Legal ground under the UAE PDPL |
|---|---|---|
| Responding to your enquiry and communicating with you regarding it, including preparing a possible contract | Data listed in Section 3.1 | Your consent given in the enquiry form; steps taken at your request prior to entering into a contract |
| Providing you, at your request, with the result of the online checklist by email | Data listed in Section 3.1.1 | Your consent given in the checklist form |
| Sending you an individual email offering to discuss your checklist result, and using your answers in that discussion if you contact us | Name, email address, company, checklist answers and result | Your consent given in the checklist form |
| Preparing, concluding and performing a contract with you or your organisation | Data listed in Sections 3.1 and 3.2 | Performance of a contract or steps prior to entering into it; your consent |
| Operating, securing and protecting the Website (including protection against DDoS attacks, protection of forms against spam and serving the correct language version) | Technical data listed in Sections 3.3 and 3.4, strictly necessary cookies | Processing necessary to provide the Website you requested; protection of the Website and its users |
| Compliance with legal obligations and defence of legal claims | Any of the above, as strictly necessary | Compliance with obligations under applicable law; establishment, exercise or defence of legal claims |
Your checklist answers are not shared with analytics services, and receiving a checklist result does not subscribe you to any mailing list: we do not send promotional materials to addresses received through the checklist form. We do not use your personal data for direct marketing without your separate, express consent, and we do not carry out automated decision-making, including profiling, that produces legal or similarly significant effects for you.
5.1. Cookies are small text files placed on your device. We also use your browser's local storage for similar purposes. Cookie identifiers are personal data under the UAE PDPL.
5.2. Strictly necessary (always on). These are required for the Website to function and cannot be switched off:
| Name | Provider | Purpose | Duration |
|---|---|---|---|
lz_consent (local storage) | LOYALZ | Remembers that you have seen the cookie notice | 12 months |
__ddg* | DDoS-Guard (used by Tilda, our website platform) | Protection of the Website against attacks and malicious traffic; when a form is submitted, distinguishing a person from an automated program | Up to 1 year |
iso_code (local storage), visited (session storage) | Tilda | Determining the country of access from the IP address to show the appropriate language version, and page display | Until cleared / end of session |
lz_lang (local storage) | LOYALZ | Remembers the language version you selected so that you are not redirected again | 12 months |
5.3. We do not use analytics, advertising or marketing cookies, Yandex Metrica, Google Analytics, social media pixels or session recording on the English version of the Website.
5.4. Language version. When you open a page of the English version of the Website, the country of access is determined from your IP address by Tilda (our website platform). Visitors from the Russian Federation and certain CIS countries are automatically directed to the corresponding page of the Russian-language version of the Website (this does not apply to this Privacy Policy), which is operated by Individual Entrepreneur Sergey Mikhailovich Belyaev under a separate policy (Section 2.2). You can switch to the English version at any time using the EN/RU switch; your choice is remembered and you will not be redirected again. Your IP address is not stored for this purpose.
5.5. Managing cookies. We use only strictly necessary cookies, which do not require your consent. You can delete cookies and local storage in your browser settings, but some parts of the Website may then not work properly.
6.1. We disclose personal data only to the extent necessary for the purposes in Section 4 and only to the following recipients:
a) the Technical Service Provider (Section 1.2): administration and hosting of the Website, processing of enquiries, technical support;
b) service providers acting on our or the Technical Service Provider's instructions:
c) competent public authorities, courts and law enforcement bodies, where disclosure is required by applicable law, in which case we disclose only the minimum data required;
d) professional advisers (lawyers, auditors) bound by confidentiality, where necessary to protect our legal rights.
6.2. We do not sell or rent personal data and do not disclose it to third parties for their own marketing purposes.
6.3. Each service provider is bound by confidentiality and data protection obligations and may process personal data only for the purpose of providing its services to us.
6.4. The Website contains links to third-party resources, including LOYALZ pages on social media. If you follow such a link, your data is processed in accordance with that resource's own rules.
7.1. The databases of the Website, the enquiry forms and our corporate email are hosted on servers located in the Russian Federation. Personal data processed through the Website is stored and processed exclusively in the Russian Federation and is not transferred from the Russian Federation to any other country, including the United Arab Emirates.
8.1. Personal data collected by us in the United Arab Emirates is transferred to and processed in the Russian Federation by the Technical Service Provider and the service providers listed in Section 6.1(b).
8.2. As at the date of this Policy, the Russian Federation has not been recognised by the UAE Data Office as a country providing an adequate level of personal data protection. We therefore transfer your personal data in accordance with Article 23 of the UAE PDPL on the basis of:
a) your express consent to the transfer, given when you submit an enquiry or checklist form; and
b) a data processing agreement with the Technical Service Provider, which requires it to process personal data only on our instructions, to keep the data confidential, to store it only in the Russian Federation, not to transfer it onward, to apply security measures and to notify us of any personal data breach, and in general to ensure a level of protection not lower than that required by the UAE PDPL.
8.3. Enquiries submitted through the Website are handled on our behalf by the Technical Service Provider. Our personnel in the United Arab Emirates do not have access to personal data collected through the Website and stored in the Russian Federation; we process in the United Arab Emirates only personal data that you provide to us directly (for example, when you correspond with us or enter into a contract with us). The Technical Service Provider also complies with Russian Federal Law No. 152-FZ "On Personal Data", including its requirements on data localisation, security and cross-border transfer.
8.4. Please note that the laws of the Russian Federation may differ from the laws of the United Arab Emirates and may allow public authorities of the Russian Federation to request access to personal data in the cases provided for by Russian law. If such a request is received, it will be handled in accordance with Section 6.1(c).
8.5. You may withdraw your consent to the transfer at any time (Section 10). Since the Website and our correspondence are hosted in the Russian Federation, after withdrawal we will no longer be able to process new enquiries submitted through the Website. You may still contact us by other means agreed with us.
9.1. We keep personal data only for as long as necessary for the purposes for which it was collected:
a) enquiries that did not result in a contract: until the purposes are achieved, and no longer than 3 years from the date the form is submitted, or until you withdraw your consent, whichever occurs first;
b) data related to a contract: for the term of the contract and thereafter for the period required by applicable law, including UAE commercial and tax record-keeping requirements, or for the limitation period for legal claims;
c) records of consents given in enquiry forms (the consent boxes ticked and the date and time of submission): together with the enquiry data, for the periods set out in items (a) and (b), and for 3 years after withdrawal of consent, as evidence of lawful processing.
d) checklist data: for 12 months from the date the form is submitted, or until you withdraw your consent. If you contact us about our services, the data is then kept as set out in items (a) and (b).
9.2. When the retention period expires, personal data is securely deleted or anonymised.
10.1. Under the UAE PDPL you have the right to:
a) obtain information about the processing of your personal data, including its categories, purposes, recipients, retention period and safeguards for international transfers;
b) receive a copy of your personal data, and request its transfer to another controller in a structured, machine-readable format where technically feasible;
c) request the correction of inaccurate personal data or the completion of incomplete data;
d) request the erasure of your personal data where it is no longer necessary, where you withdraw consent, or where it is processed unlawfully;
e) request the restriction of processing in the cases provided for by law;
f) object to and request the cessation of processing, including processing for direct marketing purposes;
g) object to decisions based solely on automated processing that produce legal effects concerning you;
h) withdraw your consent at any time, including consent to the international transfer, without affecting the lawfulness of processing based on consent before its withdrawal;
i) lodge a complaint with the UAE Data Office if you believe that your personal data has been processed in breach of the UAE PDPL.
10.2. How to exercise your rights. Send a request to info@loyalz.online with the subject line "Personal data". We may ask you to confirm your identity before responding. We will respond without undue delay and in any event within 30 days of receiving your request, unless a different period is established by law. Requests are free of charge, except where they are manifestly unfounded or excessive.
11.1. We and the Technical Service Provider apply appropriate technical and organisational measures to protect personal data against unauthorised or accidental access, destruction, alteration, blocking, copying, disclosure and other unlawful actions, including:
a) encryption of data in transit (HTTPS/TLS);
b) access to personal data only for authorised persons on a need-to-know basis, protected by individual credentials and multi-factor authentication where available;
c) written confidentiality obligations of all persons with access to personal data;
d) protection of the Website against DDoS attacks and malicious traffic;
e) backups stored only in the Russian Federation;
f) regular review of access rights and security measures.
11.2. Personal data breaches. If a personal data breach occurs that may affect your privacy, confidentiality or security, we will notify the UAE Data Office and, where required by the UAE PDPL, you, and will take measures to limit its consequences.
12.1. This Section applies in addition to the rest of this Policy where you are a citizen of the Russian Federation or where the processing of your personal data is otherwise subject to Russian Federal Law No. 152-FZ "On Personal Data" of 27 July 2006 ("Law 152-FZ").
12.2. Processing on behalf of the Controller. The Technical Service Provider processes your personal data on behalf of GDFAMILY L.L.C-FZ under Article 6(3) of Law 152-FZ. It complies with the principles and rules of processing, confidentiality and security requirements established by Articles 18.1 and 19 of Law 152-FZ, and is included in the register of personal data operators maintained by the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor).
12.3. Localisation. The recording, systematisation, accumulation, storage, clarification (updating, modification) and retrieval of personal data of citizens of the Russian Federation are carried out using databases located in the Russian Federation, in accordance with Article 18(5) of Law 152-FZ.
12.4. No cross-border transfer from the Russian Federation. Personal data collected through the Website and stored in the Russian Federation is not transferred from the Russian Federation to the territory of any foreign state, including the United Arab Emirates, and the Controller's personnel outside the Russian Federation are not granted access to it.
12.5. Your rights under Law 152-FZ. In addition to the rights listed in Section 10, you have the right to receive information about the processing of your personal data; to require the clarification, blocking or destruction of personal data that is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose; to withdraw your consent; to require the cessation of processing; and to appeal against unlawful actions or omissions to Roskomnadzor or to a court.
12.6. Response time. Requests governed by Law 152-FZ are answered within 10 (ten) working days of receipt. This period may be extended by no more than 5 (five) working days, in which case you will be sent a reasoned notice of the extension.
12.7. If you wish to receive services under a contract with Individual Entrepreneur Sergey Mikhailovich Belyaev rather than with GDFAMILY L.L.C-FZ, please use the Russian-language version of the Website, which is governed by the policy available at https://loyalz.online/privacy-ru.
The Website is intended for business clients and is not directed at persons under 18. We do not knowingly collect personal data of children. If you believe that a child has provided us with personal data, please contact us at info@loyalz.online and we will delete it.
We may update this Policy from time to time. The current version is always available at https://loyalz.online/privacy with the date of the last update shown at the top. If changes affect the purposes of processing, the recipients of personal data or international transfers, we will request your consent again where required by law.
GDFAMILY L.L.C-FZ
Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E.
Email: info@loyalz.online