Accord de traitement des données

01About this agreement

This data processing agreement (“DPA”) forms part of the LoyaltyFlow terms of service between your business (“you”, the controller) and FPontes LTD, trading as LoyaltyFlow (“we”, the processor). It applies whenever we process personal data on your behalf to provide LoyaltyFlow, and is intended to meet Article 28 of the UK GDPR and, where it applies, the EU GDPR.

If this DPA and the terms of service disagree about data protection, this DPA applies.

02Roles

You are the controller of the personal data about your members and your staff that you, your staff or your members put into LoyaltyFlow. We process that data for you.

We are a controller in our own right for the information we need to run our own business, such as billing and account security, as described in our privacy policy.

03Your instructions

We process personal data only on your documented instructions. Your instructions are these terms, this DPA and the way you set up and use LoyaltyFlow. If the law requires us to process data in another way, we will tell you first, unless the law forbids it. We will tell you if we believe an instruction breaks data protection law.

04What we process

Subject matter and duration

Providing LoyaltyFlow to you, for as long as you use it, plus the wind-down and deletion periods described in End of the service.

Nature and purpose

• storing your members and their cards;
• creating, signing and updating Apple Wallet and Google Wallet passes;
• recording the stamps, points and rewards your staff add and redeem;
• emailing members a link to their own card when they ask for it;
• showing your campaign and automation messages on the cards of members who agreed to receive them;
• analytics and exports for you;
• matching Square payments to members, if you connect Square;
• deleting data when you, your members or the retention rules require it.

People the data is about

• your members (customers who join your card);
• your staff and other users of your account.

Types of personal data

• Members: name; phone number and/or email address; language; birthday (optional); records of their choices (time, wording and IP address); card balance and history; Wallet device identifiers and push tokens; referral links; Square customer reference (if connected).
• Staff: name, email address, role, PIN (stored as a one-way hash), shop phone records and activity log entries.

We don’t expect to process special category data, and you must not put it into LoyaltyFlow.

05Our commitments

• Confidentiality. Everyone we authorise to process your data is bound by a duty of confidentiality.
• Security. We take the measures in Security measures to protect your data.
• Requests from people. Members can delete their card and stop messages themselves from their card page, and you can find, export, correct and delete members in your dashboard. We will help further where reasonable.
• Help with compliance. Taking into account the nature of the processing and the information available to us, we will help you with security, breach notifications, data protection impact assessments and consultations with regulators.

06Sub-processors

You give us general permission to use sub-processors. We will tell you at least [30] days before we add or replace one, by email or in your dashboard, so you can object. If we can’t address a reasonable objection, you can cancel. We put data protection terms in place with each sub-processor that protect your data at least as well as this DPA, and we remain responsible for them.

Current sub-processors [to be confirmed before launch]:

If you connect Square, data is exchanged between LoyaltyFlow and your own Square account on your instructions; Square acts under your agreement with Square.

07International transfers

Some sub-processors process data outside the UK and the European Economic Area, for example in the United States. Where they do, we make sure an appropriate safeguard is in place, such as adequacy regulations, the UK International Data Transfer Addendum or the EU Standard Contractual Clauses. [To be confirmed in the legal review.]

08Personal data breaches

We will tell you without undue delay, and where possible within 48 hours, after we become aware of a personal data breach affecting your data. We will give you the information we have that you need to meet your own obligations, and keep you updated.

09End of the service

When your plan ends you can still export your data from the dashboard. 90 days after your plan ends we delete your account data, including members and cards, and we email you an export link before we do. Copies in backups are overwritten within [backup period]. We may keep data where the law requires us to.

10Information and audits

We will give you the information reasonably needed to show that we meet this DPA. We will also allow audits by you or an auditor you appoint, with reasonable notice, at your cost and no more than once a year, unless a regulator requires it or there has been a breach. We may first answer an audit request by sharing documentation.

11Your responsibilities

You are responsible for having a lawful basis for the personal data you collect and import, for giving your members the information the law requires (your join page shows your shop’s details and the wording members agree to), for respecting the choices members make, and for giving us lawful instructions.

12Security measures

• Encryption in transit (HTTPS) for the website, the app, the API and Wallet updates.
• Passwords and staff PINs stored as one-way hashes.
• Integration tokens, such as Square’s, encrypted with a separate key.
• Short-lived sign-in tokens, and session tokens that are hashed and rotated.
• Each shop’s data kept separate by account, with role-based access for owners, managers and staff.
• Limits on sign-in and PIN attempts, and rate limits on joins and scans.
• Logs that don’t contain phone numbers, email addresses or tokens.
• An activity log of staff and admin actions.
• Daily database backups.
• Automatic deletion of unused cards and of ended accounts’ data.

13Liability

Each party’s liability under this DPA is subject to the limits in the terms of service, except where the law does not allow it.

14Contact

Data protection questions: info@fpontes.com.