Privacy Policy

Main data processing information

Personal data processed through the GlobalTips mobile application, designated website and payment functionality made available through them (together, the “Platform”) is processed by GlobalTips Europe, UAB, a company established in Lithuania, legal entity code 305942984, registered address Naugarduko g. 3-401, LT-03231 Vilnius, Lithuania (“Company” or “GlobalTips”) where GlobalTips determines the purposes and means of the processing.

This Privacy Policy applies to personal data relating to Platform users and individuals whose data is processed in connection with Platform transactions, including:

Payers (guests) - individuals making payments such as Tips, Bills or Orders, including in-person Contactless Payments through Mobile Terminal functionality;
Recipients - employees or service workers of Merchants, for example waiters, baristas, concierges or drivers, receiving Tips or other eligible payouts;
Merchants and Merchant Staff - Merchants and their authorized employees or representatives, for example managers, administrators, accountants and staff using the Platform for payment acceptance, accounting, reporting or operational purposes.

A Merchant may act as a separate data controller for personal data it accesses or otherwise processes for its own purposes, including staff management, customer service, loyalty programs and compliance obligations. Payment Service Providers may act as controllers and/or processors depending on the relevant service and legal arrangement.

Definitions

For the purposes of this Privacy Policy:

Platform - the GlobalTips mobile application, designated website and related payment, tipping, QR, Mobile Terminal, reporting and integration functionality.

User - a Payer, Recipient, Merchant or Merchant Staff member, as applicable to the relevant processing activity.

Payer (Guest) - an individual making a payment such as a Tip, Bill or Order payment through payment functionality supported by the Platform.

Recipient - an individual receiving Tips or other eligible payouts through the Platform.

Merchant - a business entity or individual entrepreneur whose goods or services may be paid for through the Platform and whose authorized staff may use Platform functionality.

Merchant Staff - an individual authorized by a Merchant to use the Platform on the Merchant’s behalf, including for payment acceptance, reporting, administration or POS-related purposes.

Tip - a voluntary monetary amount transferred by a Payer for the benefit of a Recipient through the Platform and not constituting payment for goods or services.

Bill - a payment request generated by or for a Merchant for goods or services supplied by the Merchant.

Order - goods or services selected by or for a Payer and payable to a Merchant through the Platform.

Loyalty Program - a promotional or bonus scheme established and managed by a Merchant and made accessible through the Platform.

Payment Method - any payment instrument supported for the relevant payment flow, including eligible payment cards, Apple Pay, Google Pay and other supported contactless or local payment methods.

Mobile Terminal - functionality within the GlobalTips mobile application that enables authorized Merchant Staff to use a compatible mobile device as a contactless payment acceptance interface, including Tap to Pay functionality where available.

Contactless Payment - a payment authorized by presenting a supported contactless payment card, phone, watch or other supported Payment Method to a Mobile Terminal.

POS Integration - an integration between the Platform and a Merchant’s point-of-sale or other business system that enables Bill, Order, transaction or payment-status information to be exchanged between systems.

Payment Service Provider (PSP) - a licensed payment service provider involved in payment or payout processing through the Platform, including Stripe where applicable.

Stripe’s applicable legal and privacy information is available at:

Service Fee - a fee charged by GlobalTips in connection with use of the Platform. Depending on the payment flow and applicable commercial arrangement, a Service Fee may be payable by the Merchant, the Recipient or the Payer. Where payable by the Payer, it is displayed before payment authorization.

Purposes and legal basis of processing

GlobalTips processes personal data for the following purposes, depending on the User’s role, the functionality used and whether GlobalTips has a direct contractual relationship with the relevant User. The applicable legal basis may therefore differ between payment flows.

Provision of Platform services - to provide accounts, payment, tipping, QR, Mobile Terminal, payment receipt, feedback, reporting, loyalty and administrative functionality. Legal basis: performance of a contract or steps taken at the request of the data subject where a direct contractual relationship applies (GDPR Art. 6(1)(b)); legitimate interests in operating payment and business-facing functionality, including where GlobalTips provides infrastructure to a Merchant without entering into a direct contract with the Payer (GDPR Art. 6(1)(f)); and legal obligations where applicable (GDPR Art. 6(1)(c)).
Payment and payout processing - to initiate, route, reconcile and support payments and payouts and to transmit necessary data to PSPs, including Stripe. Legal basis: performance of a contract where applicable (GDPR Art. 6(1)(b)); legitimate interests in enabling and administering reliable payment flows, including Merchant payment acceptance where no direct contract exists with the Payer (GDPR Art. 6(1)(f)); and compliance with applicable legal obligations, including financial, AML/KYC and accounting obligations where applicable (GDPR Art. 6(1)(c)).
Mobile Terminal operation and security - to enable and secure contactless payment acceptance, verify device or payment-session conditions, prevent misuse and support payment functionality. This may include processing technical device information and location-related information where required for operation, security or validation. Legal basis: legitimate interests in secure payment processing, fraud prevention and provision of payment infrastructure to Merchants (GDPR Art. 6(1)(f)); performance of a contract where a direct contractual relationship applies (GDPR Art. 6(1)(b)); and legal obligations where applicable (GDPR Art. 6(1)(c)).
POS synchronization and reconciliation - to match payments with Bills or Orders and exchange payment status with a Merchant’s POS or integration provider. Legal basis: performance of GlobalTips’ contract with the Merchant where applicable and legitimate interests in accurate reconciliation and business operations (GDPR Art. 6(1)(b), (f)).
Digital payment confirmations and payment receipts - to send or provide a payment confirmation or payment receipt requested by a Payer, including by email where voluntarily provided. Legal basis: legitimate interests in providing requested transaction information and supporting payment administration (GDPR Art. 6(1)(f)); performance of a contract where applicable (GDPR Art. 6(1)(b)).
Merchant administration and operational analytics - to provide Merchants with transaction, Tip, feedback and operational statistics, including information associated with individual Merchant Staff or Recipient accounts where enabled, for business administration, reconciliation, service quality and staff management. The GlobalTips Staff application may process and display staff performance data associated with individual Merchant Staff or Recipient accounts, including the number of reviews collected, the number of orders accepted and the percentage of payments that include Tips for statistics and performance assessment. Legal basis: performance of a contract with the Merchant and legitimate interests in operating and administering the service (GDPR Art. 6(1)(b), (f)).
Customer service - to answer questions, handle complaints and process feedback. Legal basis: legitimate interests and, where necessary, performance of a contract (GDPR Art. 6(1)(f), (b)).
Feedback administration - to receive and administer feedback, including relevant technical information such as IP address and time of submission where necessary for service integrity. Legal basis: performance of a contract and legitimate interests (GDPR Art. 6(1)(b), (f)).
Loyalty Programs - to enable participation in Merchant Loyalty Programs and share relevant data with the relevant Merchant. Legal basis: consent where required (GDPR Art. 6(1)(a)) and/or performance of the requested loyalty service.
Marketing communications - to send marketing communications from GlobalTips or, where applicable, facilitate Merchant communications where the legally required consent has been obtained. Legal basis: consent (GDPR Art. 6(1)(a)) or another lawful basis permitted for the relevant communication under applicable law.
Platform improvement and analytics - to analyze usage, performance and product functionality. Where analytics technologies require consent, they are activated only after the required consent has been given. Legal basis: consent (GDPR Art. 6(1)(a)) and, for strictly necessary service analytics or security logs where permitted, legitimate interests (GDPR Art. 6(1)(f)).
Legal compliance and fraud prevention - to comply with tax, accounting, financial, sanctions, AML/CFT and other legal obligations; prevent, detect and investigate fraud, misuse and security incidents; and establish, exercise or defend legal claims. Legal basis: legal obligation and legitimate interests (GDPR Art. 6(1)(c), (f)).

Communications and notifications

The Platform may deliver different types of notifications and communications:

(i) Service notifications - including payment confirmations, Tips received, payout notifications, payment-status or security messages and other essential communications. These are necessary for the service and do not require marketing consent.

(ii) Administrative notifications - including legally required notices and material updates to legal documents. These may be delivered through the Platform, email or other appropriate channels.

(iii) Marketing communications from GlobalTips - sent through channels requiring consent only where the User has provided the legally required prior consent. Consent may be withdrawn at any time.

(iv) Merchant marketing or Loyalty Program communications - sent or made available where the User has joined the relevant Loyalty Program or otherwise provided the consent required by law. The Merchant is responsible for the content and lawfulness of its own marketing communications.

(v) Inbox messages - the Platform may include an Inbox in which the User can view messages from GlobalTips or Merchants. Where a message constitutes direct marketing under applicable law, any consent requirements applicable to the relevant delivery method will be observed.

Sources of personal data

Depending on the relevant functionality, GlobalTips may obtain personal data directly from the User; from the Merchant or authorized Merchant Staff; from Payment Service Providers, including Stripe; from POS and integration providers; and automatically from the User’s device, browser or interaction with the Platform.

Categories of personal data we process

The categories of data processed depend on the User’s role, the relevant payment flow and the functionality used.

For Payers (guests)

identification and contact information, such as name, email address or phone number, where voluntarily provided or required for a requested feature;
transaction and payment-related data, such as Merchant, Bill or Order reference, Tip amount, total amount, currency, timestamps, transaction identifiers, payment status, card brand, masked card information or tokenized identifiers where provided by the PSP;
payment receipt information, including an email address where voluntarily provided for delivery of a payment receipt or payment confirmation;
technical data, such as device type, browser, IP address, cookies and log data when the Payer uses a web or app-based GlobalTips interface;
feedback data voluntarily provided in reviews or comments;
Loyalty Program data, including participation, rewards and activity history where applicable.

For Contactless Payments through a Mobile Terminal, sensitive payment credentials are handled through the applicable payment technology and PSP. Merchant Staff do not receive the Payer’s full card credentials through the GlobalTips Platform.

For Recipients and Merchant Staff

identification and account data, such as name, position, employer, phone number, email address and account identifiers;
payment and payout information required to receive or transfer Tips or other eligible payouts, including bank or payout-account information where applicable;
KYC/AML data where required by the PSP or applicable law, for example identity-document details and date of birth;
transaction and operational data associated with the staff account, including Tips, payments accepted, payment status, transaction timestamps and related operational metrics, including the number of reviews collected, the number of orders accepted and the percentage of payments that include Tips;
Mobile Terminal and device data, such as device model, operating system, GlobalTips mobile application version, device capabilities, NFC/payment capability information, technical diagnostics and security-related identifiers where applicable;
location-related information where required for the operation, security or validation of Mobile Terminal payment acceptance;
technical data such as browser, IP address, cookies and usage logs.

For Merchants and administrative Merchant Staff

Merchant identification and registration information, including company name, registration details and tax identifiers;
contact information for authorized Merchant representatives and staff;
business account data, including contracts, invoices, reports, configuration and integration information;
payment, settlement, reconciliation and transaction information;
POS Integration and technical configuration data;
technical data relating to use of the Merchant dashboard, GlobalTips mobile application or administrative tools.

For all Users

service data relating to transactions and interactions within the Platform;
technical, security and log data necessary to operate, protect and troubleshoot the Platform.

Disclosure of your information

GlobalTips shares personal data only where necessary for the purposes described in this Privacy Policy and in accordance with applicable law. Recipients may include:

Payment Service Providers: Payments and payouts are processed with the involvement of licensed PSPs, including Stripe where applicable. Depending on the service and legal relationship, a PSP may act as an independent controller and/or as a processor. Stripe processes personal data in accordance with its applicable terms and the Stripe Privacy Policy.
Merchants: Relevant data may be shared with the Merchant in connection with Bills, Orders, payment status, reconciliation, feedback, Loyalty Programs, payment receipts, customer service, business reporting or staff administration. The Merchant may act as a separate controller for its own processing purposes.
Recipients: Information necessary to identify or settle a Tip and administer Tip-related functionality may be made available to the relevant Recipient and, where applicable, the Merchant.
POS and integration providers: Where a Merchant enables a POS Integration or other business-system integration, Bill, Order, transaction and payment-status information necessary for synchronization and reconciliation may be exchanged with the relevant provider.
Service providers and contractors: Trusted service providers, for example hosting, infrastructure, analytics, communications and customer-support providers, may process personal data on GlobalTips’ behalf subject to appropriate contractual safeguards.
Authorities and regulators: Personal data may be disclosed where required by applicable law or a lawful request from a competent authority, court or regulator.
Professional advisers and corporate transaction parties: Data may be disclosed where reasonably necessary to obtain legal, audit, accounting or other professional advice, or in connection with a merger, investment, reorganization or sale, subject to applicable safeguards.

Data retention

GlobalTips retains personal data only for as long as necessary for the purposes for which it was collected and to comply with applicable legal requirements. When determining an appropriate retention period, GlobalTips considers the nature, amount and sensitivity of the data; the purposes for which it is processed; applicable tax, accounting, financial, AML/KYC and other statutory retention requirements; relevant limitation periods; the need to resolve transactions, disputes or legal claims; security and fraud-prevention needs; and whether the data can be deleted or anonymized.

Payer payment and transaction data is retained for as long as necessary to administer and reconcile the relevant transaction, address payment issues or disputes, prevent fraud and comply with applicable financial, tax, accounting and other legal requirements. Marketing and Loyalty Program data is retained only while needed for the relevant purpose and in accordance with the User’s consent status and applicable law.
Recipient payment, payout and KYC/AML data is retained for as long as required to provide payout functionality, administer the account and comply with applicable financial, tax, AML/KYC, accounting and other regulatory requirements.
Merchant business, contractual, payment and accounting data is retained during the contractual relationship and thereafter for the periods necessary to comply with applicable statutory retention, limitation, tax, accounting, compliance and legal-claims requirements.
Technical, device, security and log data is retained for periods reasonably necessary for security, troubleshooting, fraud prevention, service operation and analytics where permitted, after which it is deleted or anonymized unless a longer period is required for legal, security or dispute-resolution purposes.

Where a PSP or Merchant acts as a separate controller, that party may apply its own retention periods under its privacy documentation and legal obligations.

International transfers

GlobalTips and the third parties involved in providing the Platform may process personal data in the European Economic Area (EEA) and, where necessary, in other countries.

Where GlobalTips transfers personal data outside the EEA to a country that has not been recognized as providing an adequate level of data protection, GlobalTips will use an applicable lawful transfer mechanism and appropriate safeguards, such as Standard Contractual Clauses approved by the European Commission, where required.

Stripe is a global payment provider and may transfer personal data internationally in accordance with its Privacy Policy and applicable transfer safeguards. Users can review Stripe Privacy Policy.

User rights

Subject to the conditions and exceptions provided by applicable data-protection law, Users may have the following rights:

right of access;
right to rectification;
right to erasure;
right to restriction of processing;
right to data portability;
right to object to processing based on legitimate interests and to direct marketing;
right to withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal;
right to lodge a complaint with a competent supervisory authority.

To exercise rights relating to processing for which GlobalTips is the controller, contact support@globaltips.io. Where a Merchant or PSP is the relevant controller, the User may need to contact that organization directly.

Cookies and analytics

The website forming part of the Platform uses cookies and similar technologies, including browser local storage (localStorage), to ensure proper operation, improve performance and, where consent is given, conduct analytics.

Necessary cookies and storage

Necessary technologies are used for functions such as session management, security and storage of consent choices. They do not require consent where applicable law permits their use without consent.

Analytics and performance technologies

Where enabled with the User’s consent, analytics technologies may be used to collect statistics about use of the website and improve the user experience. GlobalTips uses tools including:

Google Tag Manager - management of analytics and marketing tags on the website;
Google Analytics - analysis of website traffic and website use;
Amplitude - product analytics and analysis of user behaviour on the website.

Legal basis where consent is required: User’s consent (GDPR Art. 6(1)(a)).

Before consent-based analytics data is collected through Google Analytics or Amplitude, the User is asked to provide consent through the website consent banner. The User’s choice may be stored locally in the browser, including in localStorage under the key gt_consent_state, and is used to control activation of analytics tools. Until the required consent is given, consent-based analytics tools are not activated for analytics collection.

The User may change or withdraw a previous consent choice through the cookie or consent controls made available on the website or, where such controls rely on localStorage, by clearing the relevant website storage so that the consent choice can be presented again.

After consent is given, Google Analytics may use cookies including:

_ga - used to distinguish users; default expiration may be up to 2 years;
_ga_* - used to persist session state; default expiration may be up to 2 years.

Actual storage periods may be affected by browser settings and service configuration.

More information about Google’s processing is available at:

Marketing cookies

Marketing cookies or similar technologies may be used on the website only where the consent required by applicable law has been obtained, including to provide personalized offers or measure campaign effectiveness.

Contacts and complaints

If you have questions about this Privacy Policy or how GlobalTips processes personal data, contact:

GlobalTips Europe, UAB Naugarduko g. 3-401, LT-03231 Vilnius, Lithuania Email: support@globaltips.io

If you believe that your data-protection rights have been violated, you have the right to lodge a complaint with the competent data-protection supervisory authority, including the authority in your EU Member State of residence, work or the place of the alleged infringement where applicable.