- 25+ years of experience
- Full-service loyalty partner
- Proprietary loyalty and e-commerce platform
Version: September 28, 2026
This privacy statement (“Privacy Statement”) explains how Touch Network B.V. (hereinafter referred to as “Touch,” “we,” “us,” “our”) handles personal data in connection with its professional services (“Services”) and its websites www.touchincentive.com, www.touchloyalty.nl, www.letsoptimise.nl, www.employeebenefits.nl, www.oneconcepts.de, and www.livingbytes.de (each individually referred to as the “Website” and collectively referred to as the “Websites”).
The scope of this privacy statement is limited to processing activities subject to the privacy regulations of the countries of the European Economic Area (“EEA”), such as the General Data Protection Regulation (“GDPR”). If you click the “click to expand” button next to any of the topics below, information about that topic will be displayed. Please note that all definitions used are explained at the bottom of this privacy statement.
Touch Network is responsible for the processing of personal data as described in this privacy statement. Touch Network therefore acts as the data controller within the meaning of the GDPR. The websites are owned and managed by Touch Network. Touch Network is a legal entity incorporated under Dutch law and registered in the Netherlands with the Chamber of Commerce under registration number 84247274.
This privacy statement applies to the companies of the Touch Network Group, namely Touch Tickets B.V., Touch Incentive Marketing B.V., Touch Loyalty Solutions B.V., Jibe Commerce B.V., Sterconcepts B.V., Touch Local Loyalty B.V., Touch Incentive GmbH, and Touch Jibe Tech SRL.
We collect your personal data in various ways:
We collect information that you actively provide to us. For example, when you contact us by email.
We collect information about you when you use our services. Sometimes we process personal data not on our own initiative, but to comply with a legal obligation that applies to us. This is the case, for example, when we retain personal data for an extended period to comply with a legal retention requirement.
We also obtain information from third parties. For example, we may obtain information about you through professional social media platforms such as LinkedIn or other websites.
In principle, you are not required to provide us with information about yourself. However, refusing to provide certain information may negatively impact, for example, your experience on our website or its functionality. If providing certain personal data is a legal or contractual obligation or an essential condition for entering into a contract with us, we will provide additional information about this separately, unless it is already clear. In that case, we will also inform you of the possible consequences if this data is not provided.
The personal data we process about you, the purposes for which we process it, and the legal basis for such processing depend on the specific processing activity. If you click on the processing activities listed below, this additional information will appear.
If you visit our website(s) or contact us, we may process the following personal data about you:
When you visit our website, we may process your personal data for the following purposes:
We use your personal data to communicate with you about our products and services and to inform you about matters that are important to your use of the website(s). We also use your personal data to respond to questions, comments, or requests you have submitted to us and to handle any complaints. This processing of personal data is necessary for the performance of a contract and/or for legitimate interests pursued by Touch Network, namely the conduct of its normal business operations.
When you contact our customer service department, your personal data will be used to provide you with customer service. This processing of your personal data is necessary for the performance of a contract or is necessary to pursue a legitimate interest of Touch Network, namely the conduct of its normal business operations.
If you apply for a job through our website(s), we will use your personal data to process your application. This processing of your personal data is necessary to pursue a legitimate interest of Touch Network, namely hiring staff for Touch Network.
As part of our services, we may process the following personal data about you:
As part of our Services, we may process your personal data for the following purposes and on the following legal grounds:
We rely on the following legal bases for the processing of personal data in connection with our services:
As part of the services we provide to our customers, we process personal data of (contact persons for) our (potential) customers based on the performance of a contract with that customer.
We may process your personal data in connection with the services we provide to customers. This occurs when our legitimate interests outweigh your privacy interests. An example of this is the processing of business contact information.
We are also required to process certain personal data we handle in accordance with legal obligations, such as national tax laws.
In connection with receiving services from suppliers, we may process the following personal data about you:
In connection with receiving services from suppliers, we may process your personal data for the following purposes and on the following legal grounds:
In connection with receiving services from suppliers, we may process your personal data based on the following legal grounds:
In connection with receiving services from our suppliers, we may process personal data of (contact persons at) our suppliers based on the performance of a contract with that party. For example, we process the contract details ourselves to fulfill the contract, such as for payment purposes.
We may process your personal data in connection with the procurement of services from suppliers based on legitimate interests. This is the case when our legitimate interests outweigh your privacy interests. A common example is the processing of contact information for our business partners.
In some cases, we do not process personal data for the purposes we have specified or those of the party on whose behalf we process the data, but rather to comply with applicable legal obligations—for example, when we are required to retain certain data for longer than is necessary for our own processing purpose in order to comply with a statutory retention requirement.
If you work for us or apply for a job with us, we may process the following categories of personal data:
If we process your personal data because you are employed by us or are applying for a job with us, we may process your personal data for the following purposes:
If we process your personal data because you are our employee or are applying for a job, we base the processing of your personal data on the following legal grounds:
We may process your personal data based on legitimate interests, because you are employed by us or are applying for a job with us. This applies when we process a job application.
We may also process your personal data for the purpose of fulfilling your employment contract.
If and to the extent that your personal data is processed on the basis of legitimate interests, you may request information about the so-called balancing test that was conducted to enable us to rely on this legal basis for processing. You will find our contact information below.
Further processing.
We may intend to further process your personal data for a purpose other than the one for which it was collected, provided that this purpose is compatible with the original purpose of processing. In that case, we will provide you with information about this (these) other purpose(s) and all relevant additional information prior to such further processing.
We will only share your personal data with trusted third parties if:
To provide our services, we share your personal data exclusively on a “need-to-know” basis with:
If necessary, we may transfer personal data to third parties located outside the EEA.
All data transfers are always conducted in accordance with Chapter V of the GDPR and any additional recommendations or decisions issued in this regard by the European Data Protection Board (“EDPB”), the European Commission (“EC”), or any other competent authority or body under applicable privacy laws. If necessary, we may transfer personal data to third parties located outside the EEA.
Transfers of your personal data to a country outside the EEA may be justified, first and foremost, on the basis of what is known as an adequacy decision. This is a decision in which the European Commission determines that, for example, a particular country provides a level of data protection comparable to that of the GDPR. The European Commission publishes an up-to-date overview of these decisions.
If and to the extent that we transfer personal data to third countries for which no adequacy decision applies, we will enter into the applicable version of the model clauses published by the European Commission to ensure data protection, known as the Standard Contractual Clauses (“Transfer SCCs”). If deemed necessary under applicable privacy laws, additional measures will be taken. These may include technical, organizational, and/or contractual measures.
We take appropriate organizational and technical security measures to protect your personal data and prevent its misuse, loss, or alteration. In addition, we restrict access to personal data to those employees, consultants, contractors, and other third parties who need access in the course of their work or the services they provide. The aforementioned individuals are also bound by a duty of confidentiality, either through their employment contracts or through (data processing) agreements.
We have internal security policies that describe in detail how we ensure an appropriate level of technical and organizational security measures. We have implemented an information security management system based on ISO 27001. For example, we will notify the relevant supervisory authority and the individuals concerned if required by applicable privacy laws.
As a general rule, we do not retain your personal data for longer than is strictly necessary for the purposes for which we process your personal data.
If you or another person successfully exercises one of your privacy rights, the personal data in question may no longer be permitted to be retained. In such cases, we may process your personal data for a shorter period than specified under the “general rule.” See the “Your Rights” section below for more information on this.
In exceptional cases, we may process your personal data for a longer period. In such cases, we may process your personal data for longer than specified under the “general rule.” This applies if we need to process your personal data for a longer period in light of:
Please contact us using the contact information listed below if you would like more information about how long we process your personal data.
Right to Withdraw Consent
To the extent that our processing of your personal data is based on your consent (see above), you have the right to withdraw your consent at any time.
You have the right to request access to your personal data. This allows you to receive a copy of the personal data we hold about you (though not necessarily the documents themselves). We will also provide you with further information about how we process your personal data.
You have the right to request the correction of the personal data we hold about you. This allows you to have any incomplete or inaccurate data we hold about you corrected.
You have the right to request the deletion of your personal data. This allows you to ask us to delete or erase personal data when: (i) the personal data is no longer necessary, (ii) you have withdrawn your consent, (iii) you have objected to the processing activities, (iv) the personal data has been processed unlawfully, (v) the personal data must be erased pursuant to a legal obligation, or (vi) the personal data was collected in connection with the provision of information society services. We are not required to comply with your request to the extent that the processing is necessary: (i) for the exercise of the right to freedom of expression and information, (ii) to comply with a legal obligation that requires such processing, (iii) for reasons of public interest in the area of public health, (iv) for archiving purposes, or (v) for the establishment, exercise, or defense of legal claims.
You have the right to object to the processing of your personal data when we rely on legitimate interests as the legal basis for the processing (see above). To the extent that the processing of your personal data is carried out for direct marketing purposes, we will always comply with your request. Even when processing is carried out for other purposes, we will cease processing unless we have compelling legitimate grounds for the processing that outweigh your interests, rights, and freedoms, or that are related to the establishment, exercise, or defense of legal claims.
You have the right to request restriction of the processing of your personal data if: (i) you contest the accuracy of the personal data, for the period during which we verify your request, (ii) the processing is unlawful and you request restriction instead of erasure, (iii) we no longer need the personal data, but you need it to establish, exercise, or defend legal claims, or (iv) you have objected to the processing, during the period in which we verify your request. If we have restricted the processing of your personal data, this means that we will only store it and will no longer process it in any other way, unless: (i) with your consent, (ii) to establish, exercise, or defend legal claims, (iii) to protect the rights of another natural or legal person, (iv) or for reasons of substantial public interest.
You have the right to request that your personal data be transferred to you or to a third party of your choice (right to data portability). We will provide your personal data to you or to that third party in a structured, commonly used, and machine-readable format. Please note that this right applies only to processing carried out by us using automated means, and only if our legal basis for such processing is your consent or the performance of a contract to which you are a party (see above).
You have the right not to be subject to a decision based solely on automated processing that has significant consequences for you. In this regard, we would like to inform you that we do not use automated decision-making when processing your personal data.
In addition to the rights mentioned above, you have the right at any time to file a complaint with a supervisory authority, specifically in the EU member state where you have your habitual residence, where you work, or where an alleged violation of the GDPR has occurred. A list of supervisory authorities and their contact information is available through the European Commission. However, we would appreciate it if you would give us the opportunity to address your concerns before contacting the supervisory authority; therefore, please contact us first.
Exercising the above rights is free of charge and can be done by phone or email using the contact information provided below. If requests are manifestly unfounded or excessive—particularly due to their repetitive nature—we will either charge you a reasonable fee or refuse to comply with the request.
We may ask you for specific information to verify your identity before we respond to a request you submit regarding one of your rights.
We will inform you of the outcome of your request without undue delay and, in principle, within one month of receiving it. Depending on the complexity of the request and the number of requests, this period may be extended by an additional two months. We will notify you of any such extension within one month of receiving the request. Applicable privacy laws may allow or require us to deny your request. If we are unable to comply with your request, we will inform you of the reasons for this, subject to any legal or regulatory restrictions.
If you have any questions, comments, or requests, please contact us at privacy@touchincentive.com or using the contact information below:
Touch Network B.V.
Blaak 16
3011 TA Rotterdam
Netherlands
Touch Network reserves the right to delete your personal data at any time without prior notice. In that case, Touch Network will not be liable to pay you any compensation as a result of the termination of your account.
Touch Network reserves the right to update this privacy statement from time to time. If necessary, Touch Network will notify you of any changes to this privacy statement. The current version is always available on our website.
All applicable privacy laws, including the General Data Protection Regulation (“GDPR”) and the relevant national implementing legislation.
The current version of the privacy policy.
Touch Network B.V.
Blaak 16
3011 TA Rotterdam
The Netherlands
Chamber of Commerce number: 84247274
11.2 Other terms defined in the Applicable Privacy Laws, such as personal data, (joint) controller, processor, data subject, and processing, have the meanings set forth in the Applicable Privacy Laws.