Loyoly

Loyoly is a French SaaS loyalty and customer engagement platform from Loyoly SAS, headquartered in Paris. It helps direct to consumer e commerce brands run point based loyalty programs, referral campaigns, VIP tiers, user generated content collection and customer reviews. Loyoly plugs into the major commerce platforms (Shopify, Magento, WooCommerce, BigCommerce, Salesforce Commerce Cloud) and offers a JavaScript widget plus a server side API.

What Loyoly does on a retailer site

Once installed, Loyoly displays a loyalty widget on the customer account page and a floating launcher across the site. Members earn points for purchases, reviews, referrals and social engagement, and redeem them for vouchers. The platform handles the issuance of referral codes, the moderation of user generated content (photos, videos, reviews) and the campaign rules engine.

Data and cookies set

Loyoly processes the customer first name, last name, email, country, point balance, redemption history, referral code chains and any user generated content submitted (photo, video, review text). The widget writes first party cookies (loyoly_uid, loyoly_referral, loyoly_session) to identify the visitor, persist a referral attribution between landings, and remember the widget state. No advertising or cross site identifier is dropped.

GDPR and ePrivacy implications

Loyoly is a data processor on behalf of the retailer (Art 28 GDPR). The widget cookies are non strictly necessary because the retailer site operates without them, which means Art 5(3) ePrivacy requires prior consent. Consent under Art 6(1)(a) is the basis for the widget; performance of contract (Art 6(1)(b)) covers the loyalty program for confirmed members. User generated content (photos with potentially identifiable individuals) must have a clear submission notice and moderation policy.

Consent requirements

Configure the CMP so that the Loyoly widget loads only after the visitor has accepted the relevant category (typically Functional or Marketing depending on the CMP taxonomy). Use a static placeholder for the loyalty entry point until consent. The privacy notice should mention Loyoly, the data shared, the location of processing (EU) and the user generated content workflow.

Data transfers and hosting

Loyoly hosts its production stack on AWS in eu west 3 (Paris) and eu west 1 (Ireland) for backup. All sub processors are EU based. No transfer to the United States is performed in routine operation. Verify the latest sub processor list in the Loyoly DPA, especially when adding optional integrations like reviews syndication.

Practical compliance steps

Sign the Loyoly DPA, add Loyoly to your records of processing as a sub processor. Wrap the widget script in your CMP and use a placeholder before consent. Document the user generated content workflow including moderation, retention and the right of withdrawal. Limit the data shared with Loyoly to the strict minimum required for the loyalty program. Review the sub processor list yearly.