Data processing agreement

You are the controller of the personal data of your own customers — the people who join your loyalty programme, top up a balance, buy or redeem a gift card, or leave you feedback. You decide what is collected, why, on what lawful basis and for how long.

We are your processor for that data. We process it only on your documented instructions, which are given by your configuration of the service and by these terms. If we think an instruction breaks data protection law, we will tell you.

We are a controller in our own right for your account data and our own business records. That is covered by our privacy policy, not by this agreement.

• process personal data only on your documented instructions, unless the law requires otherwise — in which case we tell you first, unless the law forbids that;
• ensure everyone we authorise to process the data is bound by confidentiality;
• take the technical and organisational measures required by Article 32 — see clause 5;
• engage sub-processors only on the terms in clause 4;
• help you respond to requests from data subjects — see clause 6;
• help you meet your obligations under Articles 32 to 36, including security, breach notification and data protection impact assessments;
• delete or return the data at the end of the service — see clause 9;
• give you the information you need to demonstrate compliance, and allow audits — see clause 8.

You give us general authorisation to engage sub-processors. The current list — who they are, what they do, where they process and the transfer safeguard — is published at /legal/subprocessors. It is a live page, not a schedule buried in a PDF.

We give at least 30 days' notice before a new or replacement sub-processor starts processing. If you object on reasonable data protection grounds within that time we will discuss it in good faith; if we cannot resolve it you may terminate the affected service without penalty for the unused remainder of your term.

Each sub-processor is bound by data protection obligations no less protective than these, and we remain liable to you for their performance.

Our current measures include:

• encryption in transit (HTTPS/TLS) and encryption at rest by our database host;
• row-level isolation between businesses in the database, enforced by policy and verified by automated cross-tenant tests;
• hashed API keys and passwords;
• rate limiting on public endpoints and protection against server-side request forgery;
• multi-factor authentication with per-page step-up, read-only access and an append-only audit ledger on our internal support tooling;
• access restricted to authorised personnel who need it, with every access to a business account logged;
• code review and automated tests before release.

The full picture, including what we do not yet have, is on our security page. We would rather you read an honest list than a flattering one.

You answer your customers' requests; we give you the tools to do it without waiting on us. From the dashboard you can, for any customer record: export it, correct it, restrict processing of it, and erase or anonymise it. Erasure revokes their wallet passes, unregisters the device from push, and cleans up the associated payment records.

If a data subject contacts us directly about data we hold for you, we will not answer on your behalf. We will forward the request to you without undue delay and help you respond.

We will notify you without undue delay, and in any event within 48 hours of becoming aware of a personal data breach affecting data we process for you. The notice will describe what happened, the categories and approximate number of people and records affected so far as we know, the likely consequences, and what we are doing about it.

We will cooperate with your investigation. As controller, it is your decision whether the incident must be reported to a supervisory authority or communicated to the people affected.

We will give you the information reasonably necessary to demonstrate our compliance with this agreement. You may audit us on 30 days' written notice, once a year — or more often if a supervisory authority requires it or after a breach affecting your data. Audits happen in business hours, cause as little disruption as possible, and any auditor is bound by confidentiality.

You set the retention period for your customer records — never, 12, 24 or 36 months — in your settings. A nightly job enforces it automatically, anonymising records that fall outside it. Each record that becomes due is listed for you 7 days before it is anonymised, so nothing disappears without warning.

When your account closes you have a 30-day grace period to export everything and to reopen if you change your mind. At the end of it we delete the data, apart from what we must keep by law, and backups roll off on their normal cycle. On request we will confirm the deletion in writing.

Your customers' data is stored in the European Union — our database is in Ireland and our application functions run in Dublin. Some sub-processors process outside the UK and EEA; each entry at /legal/subprocessors names where and the safeguard relied on — adequacy (including the Data Privacy Framework where a provider is certified), or the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

Liability under this agreement is subject to the limits in our terms of service, except where the law does not allow it to be limited. This agreement lasts as long as we process personal data for you. Where it conflicts with the terms of service on a data protection matter, this agreement wins. It is governed by the laws of England and Wales.

Questions about this agreement, or a countersigned copy: hello@thetappi.com. Data protection matters: hello@thetappi.com.