Hoox Privacy Policy
What Happens When Using Our Service
February 2025
Introduction
Welcome to Hoox! Hoox is a platform that allows you to manage and redeem rewards you earn from merchants whose products you purchase online or through payment stations in stores, or from the issuer of your payment card you use to make a purchase. Each of these businesses that give you rewards will be referred to here as a "Rewarder", and the platform that lets you manage your rewards will be referred to as the "Platform".
The Platform is owned and operated by HooxPay Inc. (the "Company", or "we", "us", "our"). The Platform is available at rewards.hooxpay.com.
This Privacy Policy (“Policy”) explains how the Rewarders and us process your information on the Platform.
The Platform is not intended for users under the age of 16. We do not knowingly collect or process information of children under the age of 16 or knowingly allow minors under the age of 16 to use the Platform.
This Policy may be amended from time to time. We will post any change to this Policy on our Platform at a reasonable time in advance of the effective date of the change, and we will also make efforts to proactively notify you of the changes if we have your details.
Contact us
If you have any questions, comments or concerns regarding this Policy or the processing of your personal information on the Platform, please contact us by email at info@hooxpay.com.
What personal information is collected and why
Scenario | Purposes | Categories of information processed |
|---|---|---|
Registering to the Platform | Creating your account on the Platform; our business development | Your full name, email address, password, your company. You may also register using your account on third-party services such as Google, in which case we will collect any personal information that is publicly available on your third-party account. We will also collect non-personal business information about the company. |
Activity on the Platform | Providing you with statistics about your use of the Platform; improving the Platform; our business development | Your activity on the Platform, including pages you clicked, campaigns you created and simulations you ran. |
Contacting us for support or with feedback | Providing you with support in the operation of the Platform; maintaining our customer relations with you; our business development | Full name, phone number, email address, the content of your inquiry or feedback |
You do not have a legal obligation to provide the above Information; however, if you choose to not share this information with us, we may not be able to create your account on the Platform or provide you with support.
Methods and sources for collecting your personal information
We collect the personal information from several sources:
-
Directly from you, when you register to the Platform or when you contact us for support, and through your use of the Platform.
-
Through the device you use to access our Platform.
-
From third parties through which you register to our Platform, such as Google.
Sharing your personal information
We will not share your information with third parties, except in the events listed below or when you provide us your explicit and informed consent.
Scenario | Purposes | Third parties involved |
|---|---|---|
We will share your information with our service providers who assist us with the internal operations of the Platform. These companies are authorized to use your personal information in this context only as necessary to provide these services to us and not for their own promotional purposes | Operating the Platform and managing our business | For enhanced security protocol list of 3rd parties is not publicly published; For list of 3rd parties involved contact us at support@hooxpay.com |
If you abused your rights to use the Platform or violated any applicable law while engaging with the Rewarders or us | Responding to, handling, and mitigating suspected violations of law in connection with our business | Competent authorities, legal counsels, and advisors |
If a judicial, governmental, or regulatory authority requires the Rewarders or us to disclose your information | Complying with a binding request from a competent authority | Competent authorities |
If the operation of the Platform or our business is organized within a different framework, or through another legal structure or entity | Enabling a structural change in the operation of the Platform and our business | The target entity of the merger or acquisition, legal counsels, and advisors. |
Data retention and security
We retain your information for as long as needed to operate the Platform, and thereafter as needed for record-keeping matters, but no longer than 5 years.
We will retain your information for as long as needed to operate the Platform. Thereafter, we will still retain your personal information as necessary to comply with our legal obligations, resolve disputes, establish, and defend legal claims and enforce our agreements. However, we will not retain your data for more than five years.
We implement measures to secure your information
We implement measures to reduce the risks of damage, loss of information and unauthorized access or use of information, such as HTTPS with RSA 2048 bit key and TLS. We also never store full payment card numbers or banking credentials on our Platform.
However, these measures do not provide absolute information security. Therefore, although efforts are made to secure your personal information, there is no guarantee that it will be immune from information security risks.
Your rights
As a user of our Platform, you have the following rights in relation to your personal information:
Right to review your information. You have the right to review, either by yourself or through an authorized representative or a guardian, any information we have stored about you in our databases.
Right to request to rectify your information. If, upon reviewing your information, you find your information to be incorrect, incomplete or outdated, you have the right to ask us to rectify your information or delete it. We will inform you within 30 days whether we can comply with your request.
Right to have your personal data deleted, under certain circumstances, such as when the information is no longer necessary for the purposes the information was collected.
Additional Information for Individuals in EEA And UK
Data Controller. HooxPay Inc. is the controller of your personal information processed on the Platform. Our offices are located at 1065 SW 8th st., Miami FL 33130, the United States.
International data transfers. To facilitate processing your information through the Platform and by our service providers, we will transfer your information to and within countries such as the United States and Israel. We do so under an adequacy decision or under the terms of a data transfer agreement which contains standard data protection contract clauses with adequate safeguards determined by the EU Commission and the UK Information Commissioner’s Office.
Legal basis for processing your personal data. We process your personal data based on the following legal basis:
Purpose or Scenario | Legal Basis |
|---|---|
Registering to the Platform | Our legitimate interest in the proper operation of the Platform and our business. |
Activity on the Platform | Our legitimate interest in the improvement of the Platform and our business development. |
Contacting us for support or with feedback | Performance of our Terms of Use contract with you. Our legitimate interest in providing you with support in the operation of the Platform, maintaining our customer relations with you and our business development. |
Sharing your data with our service providers | Our legitimate interest in the operation of the Platform and our business. |
Responding to, handling, and mitigating suspected violations of law in connection with our business | Our legitimate interest in defending and enforcing against violations and breaches that are harmful to our business. |
Complying with a binding request from a competent authority | Our legitimate interest in complying with mandatory legal requirements imposed on us. |
Enabling a structural change in the operation of the Platform and our business | Our legitimate interest in our business continuity. |
Data subject rights. If you are in the EEA or the UK, you have the following rights:
-
Right to Access and receive a copy of your personal information that we process.
-
Right to Rectify inaccurate personal information we have concerning you and to have incomplete personal information completed.
-
Right to Data Portability, that is, to receive the personal information that you provided to us, in a structured, commonly used, and machine-readable format. You have the right to transmit this data to another person or entity. Where technically feasible, you have the right to have your personal information transmitted directly from us to the person or entity you designate.
-
Right to withdraw your consent to processing your personal information, easily and at any time, if the basis for our processing is your consent. We may continue to process personal information with respect to which your consent is not necessary. Withdrawing your consent will not affect the lawfulness of the processing we carried out based on your consent before such withdrawal.
-
Right to Object to our processing of your personal information based on our legitimate interest. However, we may override the objection if we demonstrate compelling legitimate grounds, or if we need to process such personal information for the establishment, exercise, or defense of legal claims.
-
Right to Restrict us from processing your personal information (except for storing it): (a) if you contest the accuracy of the personal information (in which case the restriction applies only for a period enabling us to determine the accuracy of the personal information); (b) if the processing is unlawful and you prefer to restrict the processing of the personal information rather than requiring the deletion of such data by us; (c) if we no longer need the personal information for the purposes outlined in this Policy, but you require the personal information to establish, exercise or defend legal claims; or (d) if you object to our processing based on our legitimate interest (in which case the restriction applies only for the period enabling us to determine whether our legitimate grounds for processing override yours).
-
Right to be Forgotten, under certain circumstances, such as when you object to our processing of your personal information based on our legitimate interest and there are no overriding legitimate grounds for the processing. However, notwithstanding such a request, we may still process your personal information if it is necessary to comply with our legal obligations, or for the establishment, exercise, or defense of legal claims. If you wish to exercise any of these rights, please contact us through the channels listed in this Policy.
When you contact us with a request, we reserve the right to ask for reasonable evidence to verify your identity before we provide you with information. If we are not able to provide you with the information that you have asked for, we will explain the reason.
Subject to applicable law, you have the right to lodge a complaint with your local data protection authority. If you are in the EU, then according to Article 77 of the GDPR, you can lodge a complaint to the supervisory authority, in the Member State of your residence, place of work, or place of an alleged infringement of the GDPR. For a list of supervisory authorities in the EU, click here.
If you are in the UK, you can lodge a complaint to the Information Commissioner’s Office (ICO) pursuant to the instructions provided here.
Additional Information for Individuals in The United States
HooxPay Inc. is providing the following additional information to its clients residing in the United States, pursuant to applicable state privacy laws in the U.S.
We do not sell your information to any third party, or share it for cross-context behavioral advertising. Furthermore, we do not collect, use or share sensitive information.
We keep the personal information specified below as long as necessary to operate the Platform. Following that period, we shall see to it that the information is not accessed, other than in extraordinary events such as legal claims.
Categories of personal information we collect and process and their sources
Below are the categories of personal information we have collected and/ processed over the past 12 months, and the source of that information.
Categories of personal information | Details of the personal information that was collected | Sources of information |
|---|---|---|
Identifiers | Name, mobile phone, email address. | 1. Directly from you. 2. Through the device you use to access our Platform. |
Professional or employment related information | Company name | 3. From third parties through which you register to our Service, such as Google. |
Information that identifies, relates to, describes, or is capable of being associated with, a particular individual | Content of your inquiry | |
Internet or other electronic network activity information | Your activity on the Platform |
Business purposes for the collection of personal information
Categories of personal information (per the table above) | Business purposes |
|---|---|
Identifiers Professional or employment related information Information that identifies, relates to, describes, or is capable of being associated with, a particular individual Internet or other electronic network activity information | 1. Performing services through the Platform. 2. Debugging to identify and repair errors that impair existing intended functionality. 3. Detecting and preventing security incidents. 4. Undertaking activities to verify or maintain the quality or safety of the Platform and to improve, upgrade, or enhance the Platform. |
Disclosures to third parties
Below are the categories of personal information we shared with third parties over the past 12 months, and the categories of third-party entities we share them with.
Categories of personal information (per the table above) | Categories of entities we give the information to, and why |
|---|---|
Identifiers Professional or employment related information Information that identifies, relates to, describes, or is capable of being associated with, a particular individual Internet or other electronic network activity information |
|
Your rights
The right to know. You have the right to know whether we are processing your personal information. If we do, you have the right to know the following information, which we will provide to you after we receive your request and verify your identity:
-
The categories of personal information we collected about you.
-
The categories of sources from which the personal information was collected.
-
The purposes for which we collect personal information.
-
The categories of third parties with whom we share personal information.
-
The specific pieces of personal information we collected about you.
The right to obtain a copy of your personal information. If your data is available in a digital format, you have the right to obtain a copy of the personal information that you previously provided to us, in a portable and readable format (to the extent this is technically feasible).
The right to delete your personal information. In some cases, state privacy laws provide for the right to request the deletion of your personal information.
The right to correct inaccurate personal information. Once we receive a request from you to correct your data, and verify your identity, we will examine the veracity of the corrected information provided by you, consider your request to correct, and inform you of our decision.
To establish the veracity of the personal information as per your request, we will consider all the circumstances pertaining to the personal information the correction of which is requested. We may also require you to provide documentation in support of your request to correct the personal information.
The right to opt-out of processing for solely-automated profiling. You have the right to opt-out of solely-automated processing of your personal information to evaluate, analyze, or predict your personal aspects related to your economic situation, health, personal preferences, interests, reliability, behavior, location, or movements, where that processing is done in furtherance of a decision that produces a legal or similarly significant effect on you.
The right to non-discrimination as a result of exercising your rights. You have the right to not be discriminated by us for exercising the rights granted to you under applicable law. If you exercise your rights, we cannot:
-
deny you services.
-
charge different prices or fees for services, also through discounts, benefits, or fines.
-
provide you with a different level or quality of services.
-
propose that you receive different prices or tariffs for services.
Please note that we may charge a different fee or provide a different level or quality of services, if the difference is reasonably related to the value we gain from your personal information.
Filing requests
Should you wish to exercise your rights under applicable laws as specified above, please contact us by email at info@hooxpay.com.
To verify your identity, we will ask you to provide additional information, through a verification process in which you will be asked to provide us with two items of information known to you and to us.
Note you may appoint an authorized agent to file requests to exercise your rights on your behalf. To this end, you must provide your authorized agent with written approval to do so. The authorized agent will have to present us with proof, attesting that you authorized them to act on your behalf. Furthermore, we will require verification of your identity, as explained above.
Our response to your requests
We will respond to your requests within 45 days (or within 90 days, where the law permits and we determine it necessary considering the complexity and number of the requests you have filed). If we take longer than 45 days, we will inform you of the extension within the initial forty-five-day response period, together with the reason for the extension.
We may deny your request in the following cases:
-
If we believe in good faith, based on reasons which are documented in writing, that your request is fraudulent or is an abuse of your rights under applicable law.
-
If we conclude that the request is irrelevant, based on all the circumstances at issue (e.g., if you requested to correct your personal information, and we find that it is likely to be accurate).
-
If it is contrary to federal or state law.
-
Due to discrepancy in the required documentation.
-
If the fulfilment of your request turns out to be impossible or involves disproportionate effort.
We will provide you with a detailed explanation including sufficient facts to enable you to meaningfully understand why we cannot fulfil your request.
You may appeal our decision to deny your request by submitting a written appeal to info@hooxpay.com.