Tenth

Privacy notice

What we hold about you, why, and what you can make us do about it.

Last updated 2026-08-20 · Black Flame Digital Ltd

Black Flame Digital Ltd, a company registered in England and Wales (number 11861684) whose registered office is 45 Sir Peter Blake Way, DA10 1HB, United Kingdom, runs Tenth. We are registered with the Information Commissioner’s Office under reference ZC228066. This notice says what we hold, why, and what you can make us do about it.

Where this notice says “we”, it means Black Flame Digital Ltd. Where it says “the shop”, it means the business whose card you hold — a separate company, and for your card data the one in charge.

If you hold a card

What we hold

Worth stating plainly, because it is less than people expect:

  • A random card number and a short code — the ones on your card. They identify the card, not you.
  • Each stamp and each reward, with the time, and which staff name was picked at the till.
  • Whether you ticked the marketing box, and when.
  • For an iPhone card, a device identifier and a push token, so your card can be told to refresh when a stamp is added.
  • A cookie in the browser you joined from, so that browser can download its own card again and so a second scan finds the card you already have instead of making another.

What we do not hold

No name. No phone number. No address. No email. We do not ask for an email address and a shop has no way to add one for you. Your card works forever without one.

This is a deliberate choice with a real cost to us: it means neither we nor the shop can contact you, so nobody can email you an offer — and nobody can email you when you have nearly finished a card either. We think that is the right trade. It also means that in practice we usually cannot tell who you are.

Why, and on what basis

Running the card — contract
You asked for a stamp card. A stamp card that does not remember your stamps is not one.
Showing the shop how their scheme is doing — legitimate interests
The shop sees counts and patterns: how many cards, how many are completed, how many people came back. This is the shop’s legitimate interest in understanding its own scheme. It works on the card number, not on you, and we keep it that way by not holding anything that would identify you.
Marketing — consent
Only if you tick the box, and you can change your mind. As we hold no email address or phone number, there is currently no channel through which that marketing could reach you.

Who is responsible

The shop, not us. The shop that issued your card decides the scheme and is the data controller for it. We run it for them as their processor, under the data processing terms. So a request about your card is best made to the shop — but you can send it to us at support@tenthcards.co.uk and we will pass it on and help.

Your rights

You have the usual UK GDPR rights: access, rectification, erasure, restriction, objection, and portability. Two honest notes on how they work here:

  • Erasure genuinely deletes. Ask, and the card, its whole stamp history and its device registrations are removed, along with your customer record if it was your last card on Tenth. It cannot be undone and the stamps cannot be recovered afterwards — so if you want a copy, ask for that first.
  • We may not be able to identify you. Since we hold no name or email, the practical way to prove a card is yours is to show us the card: its short code, or the pass on your phone. If you cannot, we may be unable to act on a request, which is a consequence of holding so little rather than an excuse.

You can also delete the pass from your wallet yourself at any time. That removes it from your phone and stops us pushing to it, but it does not delete the stamp record — ask us for that.

How long we keep it

  • While the card exists, because the card is that history.
  • 24 months of no stamps and no rewards, and the card is deleted automatically along with everything on it. This runs nightly; it is not a promise we keep by hand.
  • Diagnostic records of wallet activity: 90 days.
  • If the shop leaves Tenth, its cards and their history are deleted.

If you run a shop

Here we are the controller. We hold the email address you registered with, your shop’s name, branding, address and location, your staff names, and records of what your account did — on the basis of our contract with you, and our legitimate interest in keeping the service secure. Your shop name, logo and location are published on your customers’ cards and sent to Apple and Google, which is the point of the service.

We keep it while your account is open and for six years afterwards, which is the ordinary limitation period for a contract claim.

Everyone: the website

We use Google Analytics on this website. See the cookie notice, which also lists the cookies we set ourselves and flags a consent gap we have not yet closed.

Who else sees the data

  • Supabase — database, sign-in and file storage, EU region.
  • Vercel — hosting.
  • Postmark — sends our emails to shops: sign-in codes, and word that a shop has been approved or needs a change. It never receives anything about a customer.
  • Stripe — takes payment from shops that subscribe. Stripe sees the shop’s billing details; it never receives anything about a customer or their card. We do not see or store card numbers.
  • Google — Google Wallet holds the Android card and receives the card number, stamp count and shop branding. Google Analytics for the website.
  • Tawk.to — live chat on our website. The widget loads with the page, so they see the page being viewed and the visitor’s IP address whether or not a conversation is started, and anything typed if one is. It is never offered on a customer’s enrolment page or a shop’s till.
  • Apple — Apple Wallet holds the iPhone card. The push message we send is empty: it tells the phone to come and fetch, and carries nothing about you.

We do not sell personal data, and we do not share your stamp history with other shops. Apple and Google are outside the UK; those transfers rely on the UK International Data Transfer Addendum or an adequacy decision.

Complaints

Tell us first: support@tenthcards.co.uk. If we do not put it right you can complain to the Information Commissioner’s Office at ico.org.uk, or call 0303 123 1113.

Changes

The date at the top of this page is when it last changed. For a change that materially affects shops we email them; a card holder has no email address with us, so for card holders the current version on this page is the notice that applies.