Last updated: May 2026
Who We Are
WAX Group (“we”, “us”, “our”) operates the WAX Locals Card programme at waxgroup.co.uk. The WAX Locals Card is a digital loyalty card available via Apple Wallet and Google Wallet.
Data Controller:
NQY Sports Ltd (trading as WAX Group)
If you have any questions about this policy or how we handle your data, contact us at: []
What Data We Collect
When you sign up for a WAX Locals Card, we collect:
- First name and last name
- Email address
- Your marketing consent (recorded with a timestamp)
When you add your card to Apple Wallet, Apple shares a device push token with us. This is a technical identifier used solely to send you pass update notifications — it does not identify you personally.
We do not collect payment information, ID documents, or any sensitive personal data.
Why We Collect It and Our Lawful Basis
| Purpose | Lawful Basis |
|---|---|
| Issuing and delivering your digital WAX Locals Card | Consent |
| Sending you news, offers, and promotions from WAX Group by email | Consent |
| Sending push notifications to your wallet when your card is updated | Consent |
| Maintaining our records of card membership | Legitimate interests |
You are asked to give explicit consent at the point of sign-up. You may withdraw your consent at any time (see Your Rights below).
How We Use Your Data
Your name is printed on your digital card to personalise it and prevent unauthorised sharing.
Your email address is added to our mailing list (managed via MailerLite) so we can send you news, offers, and updates from WAX Group and participating local businesses. You will not receive emails from third parties.
Your device push token is used only to notify your Apple Wallet when your card has been updated — for example when a new promotion is available. We do not use it for any other purpose.
We do not use your data for automated decision-making or profiling.
Who We Share Your Data With
We use a small number of trusted third-party services to operate the WAX Locals Card:
MailerLite — our email marketing platform. Your name and email address are transferred to MailerLite to manage our mailing list and send you communications. MailerLite is GDPR-compliant and acts as a data processor on our behalf. You can review their privacy policy at .
Apple Inc — if you add your card to Apple Wallet, Apple’s PassKit service facilitates the delivery and updating of your pass. Apple receives the pass data (your name, card details) in order to display it on your device. Apple’s privacy policy is available at .
walletpasses.io — if you are an Android user and choose to add your card to Google Wallet, your pass file is processed by walletpasses.io to convert it into a Google Wallet-compatible format. Their privacy policy is available at .
Krystal Hosting — our UK-based web host stores our website data, including your card record, on secure UK servers.
We do not sell, rent, or trade your personal data to any third party.
How Long We Keep Your Data
We retain your card record (name, email, card serial) for the duration of the WAX Locals Card programme or until you ask us to delete it. Device push tokens are deleted automatically when you remove the card from your wallet.
Email marketing data held in MailerLite is retained until you unsubscribe or request deletion.
Cookies
The WAX Locals Card sign-up page sets two first-party cookies on your device when you complete the form:
| Cookie | Purpose | Duration |
|---|---|---|
wax_locals_verified | Remembers that you have already signed up so the form is not shown again | 30 days |
wax_locals_token | Stores a reference to your personal card so we can show your download button on return visits | 30 days |
These cookies are functional and do not track you across other websites. No advertising or analytics cookies are set by this plugin.
Your Rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you
- Correct any inaccurate data
- Erase your data (“right to be forgotten”)
- Withdraw consent at any time — this will not affect the lawfulness of processing before withdrawal
- Object to or restrict processing of your data
- Complain to the Information Commissioner’s Office (ICO) at if you believe we have mishandled your data
To exercise any of these rights, email us at []. We will respond within 30 days.
To unsubscribe from marketing emails, click the unsubscribe link in any email we send you, or contact us directly.
Security
Your data is stored in a password-protected database on UK-based servers. Card serial numbers and access tokens are randomly generated and unique to each cardholder. Certificate files used to sign passes are stored outside the publicly accessible web directory.
Changes to This Policy
We may update this policy from time to time. The “last updated” date at the top of this page will reflect any changes. Significant changes will be communicated by email where appropriate.