FaveCard Data Processing Agreement

Background

This Data Processing Agreement (the "DPA") forms an integral part of the FaveCard Terms of Service (the "Terms") entered into between Qualityc Łukasz Fryc (NIP 7372138804, EU VAT PL7372138804, Kasinka Mała 472, 34-734 Kasinka Mała, Poland), operating the FaveCard service ("FaveCard"), and the business customer that has accepted the Terms (the "Customer").

By accepting the Terms, the Customer also accepts this DPA. No separate signature is required. This method of execution is recognised by Article 28(9) of Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR"), which permits Article 28 contracts to be concluded in electronic form.

This DPA reflects the parties' agreement on the terms governing the processing by FaveCard of personal data on behalf of the Customer in the course of providing the Service. Where the Service is used in jurisdictions outside the European Economic Area (the "EEA"), this DPA is also intended to satisfy comparable requirements under UK data protection law, the Swiss Federal Act on Data Protection (FADP), and other applicable data-protection regimes, with the necessary modifications applied implicitly.

1. Definitions

In this DPA, the following terms have the following meanings. Capitalised terms not defined here have the meaning given to them in the GDPR or in the Terms.

• "Applicable Data Protection Law" means all data-protection and privacy laws applicable to a party's processing of Personal Data under this DPA, including (as applicable) the GDPR, the UK GDPR, the UK Data Protection Act 2018, the Swiss FADP, and any successor or supplementary legislation.
• "Controller" has the meaning given in Article 4(7) GDPR.
• "Customer Personal Data" means Personal Data submitted by, or collected on behalf of, the Customer through the Service, where the Customer (or its End Customers, on its instructions) is the Controller.
• "Data Subject" has the meaning given in Article 4(1) GDPR.
• "End Customer" has the meaning given in the Terms.
• "International Transfer" means a transfer of Personal Data to a country, territory, or international organisation outside the EEA (or, where UK data is involved, outside the United Kingdom; or, where Swiss data is involved, outside Switzerland) that is not the subject of an adequacy decision applicable to the relevant transfer.
• "Personal Data" has the meaning given in Article 4(1) GDPR.
• "Personal Data Breach" has the meaning given in Article 4(12) GDPR.
• "Processor" has the meaning given in Article 4(8) GDPR.
• "Schedule" means a schedule attached to this DPA, which forms an integral part of this DPA.
• "Sub-processor" means any third party engaged by FaveCard to process Customer Personal Data on FaveCard's behalf in connection with the Service.
• "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission in Implementing Decision (EU) 2021/914 of 4 June 2021, as updated from time to time.
• "UK Addendum" means the UK International Data Transfer Addendum to the EU Commission SCCs, issued by the UK Information Commissioner under section 119A of the UK Data Protection Act 2018.

2. Roles and Scope

2.1 Customer is Controller

For Customer Personal Data, the Customer is the Controller and FaveCard is the Processor. The Customer determines the purposes and means of processing in accordance with Applicable Data Protection Law and is responsible for ensuring that it has a lawful basis for the processing it instructs FaveCard to carry out.

2.2 FaveCard is Processor

FaveCard processes Customer Personal Data only on the Customer's documented instructions and for the limited purposes set out in this DPA and in Schedule 1. FaveCard does not determine the purposes or means of processing Customer Personal Data, except to the extent permitted under clause 2.3 (reclassification) or clause 2.4 (independent controllers).

2.3 Reclassification — when FaveCard becomes a Controller

The parties acknowledge that, in operating the Service, FaveCard may from time to time make decisions about specific processing activities that go beyond merely acting on the Customer's instructions — for example, in the context of fraud prevention, abuse detection, security monitoring, aggregated and de-identified product analytics, compliance with legal obligations imposed directly on FaveCard, maintenance of the minimal unified customer record described in clause 2.7, or the provision of future end-customer services described in clause 2.8.

To the extent FaveCard determines the purposes and means of any such specific processing activity, FaveCard shall, for that activity only, be considered an independent Controller of the Personal Data processed in connection with that activity, and the remainder of this DPA shall continue to govern all other processing of Customer Personal Data on the Customer's instructions.

This clause is intended to provide a clear allocation of roles in edge cases without converting the parties' general relationship into one of joint controllership within the meaning of Article 26 GDPR. Nothing in this clause permits FaveCard to use Customer Personal Data for marketing to End Customers on FaveCard's own initiative, or for any purpose unrelated to the operation, security, or improvement of the Service.

2.4 Independent Controllers

Some third parties that interact with the Service (notably the Customer's payment processor, Stripe Payments Europe, Limited, for fraud prevention and regulatory compliance) act as independent Controllers of Personal Data they process. Their processing is governed by their own terms with the Customer and is outside the scope of this DPA.

2.5 Excluded data

The Customer agrees not to submit to the Service any Personal Data that is "special category data" within the meaning of Article 9 GDPR (including health, biometric, racial or ethnic, political, religious, sexual orientation, or trade-union data), nor any Personal Data of children under sixteen (16) years of age, nor any payment card data beyond what is processed by Stripe directly. The Service is not designed for such data, and the Customer assumes responsibility for any consequences if it submits such data in violation of this clause.

2.6 Compliance Support Services (managed compliance)

The parties acknowledge that the Customer may require operational assistance to fulfil obligations that, under Applicable Data Protection Law, fall on the Customer in its capacity as Controller — including responding to Data Subject Rights requests, providing transparent privacy notices to End Customers, maintaining records of marketing consent, and notifying Personal Data Breaches to supervisory authorities and Data Subjects.

By accepting this DPA, the Customer issues to FaveCard a standing instruction, within the meaning of Article 28(3)(a) GDPR, to perform on the Customer's behalf the Compliance Support Services described in Schedule 4. The Compliance Support Services are an exercise of FaveCard's assistance obligations under Articles 28(3)(e) and 28(3)(f) GDPR, escalated to the maximum level of assistance that is technically and organisationally possible at the small-merchant tier.

When performing the Compliance Support Services, FaveCard acts in its capacity as Processor and on the Customer's documented instructions. The Customer remains the sole Controller of Customer Personal Data, and the legal responsibility for compliance with Applicable Data Protection Law continues to rest with the Customer. The Customer may at any time withdraw the standing instruction in writing, in which case the Customer shall, from the date of withdrawal, perform the relevant compliance activities itself; FaveCard's obligations under clauses 7 and 8 shall then revert to the standard processor-assistance model described in those clauses.

2.7 Cross-merchant identity layer — FaveCard as independent Controller of a minimal unified customer record

Independently of its role as Processor under clauses 2.1 and 2.2, the Service maintains a minimal unified customer record for each End Customer who signs up for a Loyalty Program through any Customer on the Service. The unified customer record is indexed by a one-way cryptographic hash of the End Customer's email address and (if provided) phone number, and contains only the following fields: first name, last name (if provided), email address, phone number (if provided), and birthday day/month (if provided).

The purposes of the unified customer record are limited to:

• (a) recognising an End Customer who has previously signed up with another Customer on the Service, so that the End Customer is not required to re-enter basic identifying details at a subsequent signup;
• (b) maintaining the integrity of the Service against duplicate or fraudulent signups using the same email address or phone number across Customers;
• (c) providing a technical foundation for the future end-customer services described in clause 2.8.

The unified customer record does not contain marketing-consent state, transaction history, stamp counts, rewards, notes, behavioural profiles, or any data field beyond those listed in the first paragraph of this clause. Each Customer's marketing-consent audit trail (Schedule 4(d)) is held exclusively within that Customer's tenant of the Service and is not replicated into the unified customer record.

The unified customer record is not shared between Customers. Customer A cannot view End Customer Personal Data submitted to Customer B, and FaveCard shall not disclose any Customer's End Customer Personal Data to another Customer by reference to the unified customer record, nor use the unified customer record to correlate activity across Customers other than to perform the limited purposes listed in (a), (b), and (c) above.

In respect of the processing of the unified customer record, FaveCard acts as independent Controller within the meaning of Article 4(7) GDPR, under the reclassification framework in clause 2.3, on the legal basis of legitimate interest under Article 6(1)(f) GDPR. FaveCard has documented and maintains a balancing test weighing the benefit to the End Customer (continuity across merchants, fraud protection, access to future end-customer services) against the privacy impact of a record that holds only minimal identifying data, contains no marketing or profiling, and is technically segregated from per-merchant loyalty data.

The existence of the unified customer record is disclosed to End Customers in the Customer Privacy Notice hosted by FaveCard under clause 2.6 and Schedule 4(c), under the transparency requirement of Article 13 GDPR. End Customers have the right to object to the processing of the unified customer record at any time under Article 21 GDPR, by writing to privacy@favecard.co; FaveCard shall delete the unified customer record within thirty (30) days of receipt of such an objection. Objection to the unified customer record does not affect the End Customer's per-Customer loyalty data, which remains under the relevant Customer's control as described in Schedule 1 and continues to be governed by this DPA.

For the avoidance of doubt, the existence of the unified customer record does not make the parties joint controllers within the meaning of Article 26 GDPR. FaveCard is independent Controller of the unified customer record, and Customer remains sole Controller of all Customer Personal Data held within its tenant of the Service.

2.8 Future end-customer services

FaveCard is developing, and may in the future offer, services directly aimed at End Customers — including (without limitation) a customer portal, a FaveCard mobile app, and discovery features that suggest loyalty programmes offered by other Customers to End Customers who explicitly opt in (together, the "End-Customer Services").

When any End-Customer Service is launched:

• (a) it shall be offered to End Customers on a separate, explicit, opt-in basis, under a distinct legal basis — typically consent under Article 6(1)(a) GDPR, or a direct service contract under Article 6(1)(b) GDPR between FaveCard and the End Customer;
• (b) FaveCard shall act as independent Controller in respect of the Personal Data processed in connection with the End-Customer Service, and Customer's status as Controller of Customer Personal Data under this DPA shall be unaffected;
• (c) no Customer Personal Data held by FaveCard as Processor under this DPA shall be used to deliver the End-Customer Service without (i) the End Customer's explicit opt-in and (ii) a clear legal basis independent of the Customer's instructions;
• (d) FaveCard shall update this DPA and the Customer Privacy Notice referred to in clause 2.6 to reflect the scope, legal basis, and data-flow implications of each new End-Customer Service before it goes live;
• (e) nothing in this clause shall authorise FaveCard to market to End Customers on its own initiative using data FaveCard holds as Processor under this DPA.

Neither the disclosure in this clause 2.8 nor the existence of the unified customer record under clause 2.7 constitutes a marketing opt-in, a consent, or a legal basis for any End-Customer Service that has not yet been launched. Each End-Customer Service will establish its own lawful basis at the moment it is offered.

3. Processing Instructions

3.1 Documented instructions

FaveCard shall process Customer Personal Data only on the documented instructions of the Customer, including with regard to International Transfers. The Customer's documented instructions consist of:

• (a) the Terms;
• (b) this DPA;
• (c) the configuration choices the Customer makes in the dashboard and in the Service settings;
• (d) the actions the Customer takes through the Service (such as creating a Loyalty Program, configuring an email campaign, exporting data); and
• (e) any further written instructions the Customer provides to FaveCard in writing (including by email to privacy@favecard.co), to the extent they are reasonable and consistent with the Service's functionality.

If FaveCard cannot comply with an instruction for legal, technical, or commercial reasons, it will inform the Customer without undue delay and the parties will discuss in good faith.

3.2 No further use

FaveCard shall not process Customer Personal Data for any purpose other than (i) providing and operating the Service for the Customer, (ii) complying with FaveCard's legal obligations, and (iii) the limited reclassified-Controller activities described in clause 2.3.

3.3 Notice if an instruction breaches law

If FaveCard considers that an instruction from the Customer infringes Applicable Data Protection Law, FaveCard shall promptly inform the Customer of that view. The Customer remains responsible for the lawfulness of its instructions.

3.4 Customer's responsibilities as Controller

The Customer warrants that:

• (a) it has obtained and will maintain a valid lawful basis under Article 6 GDPR (and, where applicable, Article 9) for all Customer Personal Data submitted to the Service;
• (b) transparent privacy notices to End Customers meeting the requirements of Articles 13 and 14 GDPR have been or will be made available; the Customer may rely on the per-business privacy notice template hosted by FaveCard as part of the Compliance Support Services (clause 2.6 and Schedule 4) to satisfy this obligation, or may publish its own privacy notice and link to it from its own properties, in which case the Customer remains responsible for the content and accuracy of its own notice;
• (c) End Customer rights requests under Articles 15-22 GDPR will be received and resolved in accordance with clause 7; under the standing instruction in clause 2.6 and Schedule 4, the Customer instructs FaveCard to receive and resolve such requests on the Customer's behalf, and the Customer shall cooperate with FaveCard where the resolution of a request requires Customer input;
• (d) it will not instruct FaveCard to do anything that would require FaveCard to violate Applicable Data Protection Law or any other law applicable to FaveCard.

4. Personnel

FaveCard shall ensure that any personnel (including employees, contractors, founders acting in an operational capacity, and agents) authorised to process Customer Personal Data:

• (a) are bound by appropriate written confidentiality obligations or are under an equivalent statutory duty of confidentiality;
• (b) receive appropriate training on data-protection obligations and on the Service's security measures, commensurate with their role and the sensitivity of the data they access;
• (c) access Customer Personal Data only on a need-to-know basis and only to the extent necessary to carry out their assigned tasks.

5. Security

5.1 Article 32 measures

FaveCard shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, the nature and scope of processing, and the rights and freedoms of Data Subjects, in accordance with Article 32 GDPR.

A description of the current technical and organisational measures is set out in Schedule 2.

5.2 Updates to security measures

FaveCard may update its security measures from time to time, provided that any update does not materially decrease the overall level of protection. FaveCard will keep Schedule 2 up to date and will notify Customers of material changes via the dashboard or by email.

5.3 Customer's own controls

The Customer is responsible for the secure use of the Service from its side, including the secure storage of credentials, the management of authorised users within its account, and the configuration of the Service's security features (such as multi-factor authentication, role-based access, and IP allow-listing if available).

6. Sub-processors

6.1 General authorisation

The Customer grants FaveCard a general authorisation to engage Sub-processors for the processing of Customer Personal Data, subject to the conditions in this clause 6 and consistent with Article 28(2) GDPR.

6.2 List of approved Sub-processors

The current list of approved Sub-processors is published at favecard.co/legal/subprocessors (the "Sub-processors List") and is also reflected in Schedule 3 to this DPA. The Customer acknowledges and authorises the engagement of all Sub-processors listed in Schedule 3 as of the date the Customer accepts this DPA.

6.3 Notice of changes

FaveCard shall give the Customer at least thirty (30) calendar days' advance notice of any intended addition or replacement of a Sub-processor, by updating the Sub-processors List and (where the Customer has subscribed to notifications under the procedure described on that page) by email.

6.4 Right to object

The Customer may object to the appointment of a new Sub-processor on reasonable data-protection grounds within ten (10) calendar days of FaveCard's notice. If the Customer objects, the parties shall discuss in good faith for up to fourteen (14) calendar days to find a solution. If no solution can be reached, the Customer may terminate the affected portion of the Service with effect from the date the new Sub-processor begins processing, and FaveCard shall refund any prepaid Fees covering the period after termination. Termination is the Customer's sole and exclusive remedy under this clause.

6.5 Emergency replacement

Where a Sub-processor must be replaced urgently (for example, because the Sub-processor has gone out of business, has suffered a security incident, or has had its services terminated), FaveCard may engage the replacement Sub-processor immediately and provide notice as soon as practicable, with a corresponding shortening of the objection window where reasonable.

6.6 Flow-down obligations

FaveCard shall ensure that each Sub-processor is bound by a written agreement that imposes on the Sub-processor data-protection obligations that are no less protective than those imposed on FaveCard by this DPA, in accordance with Article 28(4) GDPR. FaveCard remains fully liable to the Customer for the performance of each Sub-processor's obligations.

7. Assistance with Data Subject Rights

7.1 Direct requests — managed handling

By virtue of the standing instruction in clause 2.6 and Schedule 4, the Customer instructs FaveCard to receive Data Subject Rights requests under Articles 15-22 GDPR (and equivalent rights under Applicable Data Protection Law) directly at privacy@favecard.co and to respond substantively to those requests on the Customer's behalf, within the statutory time limits set out in Article 12(3) GDPR.

When acting on the standing instruction, FaveCard shall:

• (a) acknowledge the request to the Data Subject without undue delay and in any event within seventy-two (72) hours of receipt;
• (b) verify the identity of the Data Subject by reference to information already held in the Service;
• (c) gather, redact, and dispatch the relevant Customer Personal Data, or carry out the rectification, restriction, objection, or erasure requested, to the extent technically and lawfully possible;
• (d) inform the Customer of any request that materially affects the Customer's relationship with the Data Subject (for example, an erasure request that would terminate an active loyalty membership) and, where time permits, give the Customer a reasonable opportunity to comment before responding;
• (e) maintain a record of the request and FaveCard's response in the Customer's account.

Where a request cannot be resolved within the standard one-month statutory window, FaveCard may extend the response period by up to two further months in accordance with Article 12(3) GDPR and shall notify the Data Subject of the extension and the reasons for it.

The Customer may at any time instruct FaveCard, in writing, to cease handling Data Subject Rights requests under this clause and to forward them instead to a Customer-nominated contact, in which case the standard processor-assistance model described in clause 7.2 applies.

7.2 Assistance to the Customer

Taking into account the nature of the processing, FaveCard shall provide reasonable assistance to the Customer (by appropriate technical and organisational measures, insofar as this is possible) in fulfilling the Customer's obligations to respond to Data Subject requests, including by providing relevant data export tools in the dashboard, by enabling the Customer to delete or correct Customer Personal Data, and by providing reasonable additional support on request. This clause applies in particular where the Customer has withdrawn the standing instruction in clause 7.1 or where a request concerns data held outside the Service that FaveCard cannot itself resolve.

7.3 Cost of assistance

Standard self-service tools provided in the dashboard, and the substantive handling of Data Subject Rights requests under clause 7.1 within ordinary volumes, are included in the Service at no separate charge. Where the volume of requests received in respect of a single Customer materially exceeds the volume reasonably anticipated for a Customer of the Customer's size and usage profile (for example, in the wake of a public incident or a coordinated campaign), or where the Customer requests bespoke assistance that goes materially beyond standard tools and standard request handling, FaveCard may charge a reasonable fee based on the time spent, communicated in advance.

7.4 Schedule 4 cross-reference

The detailed scope, service levels, and operational mechanics of FaveCard's substantive handling of Data Subject Rights requests on the Customer's behalf are set out in Schedule 4 (Compliance Support Services).

8. Personal Data Breaches, DPIAs, and Prior Consultation

8.1 Breach notification to the Customer

FaveCard shall notify the Customer of a Personal Data Breach affecting Customer Personal Data without undue delay and in any event within seventy-two (72) hours of becoming aware of the breach. The notification shall be made by email to the address associated with the Customer Account and shall include, to the extent then known to FaveCard:

• (a) a description of the nature of the breach, including the categories and approximate number of Data Subjects and records concerned;
• (b) the name and contact details of FaveCard's contact point;
• (c) the likely consequences of the breach;
• (d) the measures FaveCard has taken or proposes to take to address the breach and to mitigate its possible adverse effects.

Where FaveCard cannot provide all the information at the time of the initial notification, it will provide it in phases without undue delay.

8.2 Notification to authorities and Data Subjects — managed handling

By virtue of the standing instruction in clause 2.6 and Schedule 4, the Customer instructs FaveCard to prepare and dispatch on the Customer's behalf:

• (a) notifications to the Customer's competent supervisory authority under Article 33 GDPR within the statutory seventy-two (72) hour window from the moment FaveCard becomes aware of the breach; and
• (b) notifications to affected Data Subjects under Article 34 GDPR, where the breach is likely to result in a high risk to their rights and freedoms, without undue delay.

FaveCard shall make reasonable efforts to consult the Customer on the substance of any notification before dispatch, where time permits, and shall in any case provide the Customer with a copy of the notification immediately after dispatch. The Customer remains legally responsible as Controller for the content and timeliness of the notifications, and FaveCard acts only on the standing instruction issued under this DPA.

The Customer may at any time withdraw the standing instruction in writing, in which case the Customer shall, from the date of withdrawal, fulfil the Article 33 and Article 34 obligations itself; FaveCard's obligations shall then revert to the standard processor-assistance model in clause 8.1, and the Customer shall be solely responsible for notifying its supervisory authority and affected Data Subjects.

8.3 DPIAs and prior consultation

FaveCard shall provide reasonable assistance to the Customer with any data-protection impact assessment (Article 35 GDPR) and, where applicable, with prior consultations with supervisory authorities (Article 36 GDPR), to the extent the assistance reasonably relates to the processing carried out by FaveCard under this DPA and to the extent the relevant information is available to FaveCard.

9. International Transfers

9.1 Default position

FaveCard processes Customer Personal Data primarily within the EEA, using cloud infrastructure regions located in the European Union (currently Google Cloud europe-west4 for Cloud Functions and eur3 multi-region for Firestore). Where processing remains within the EEA, no International Transfer mechanism is required.

9.2 Transfers to Sub-processors outside the EEA

Some Sub-processors listed in Schedule 3 are established in, or may process Customer Personal Data in, countries outside the EEA — in particular, the United States. For such transfers, FaveCard relies on one of the following safeguards in the order set out below, applying the first available safeguard:

• (a) An adequacy decision of the European Commission, where one applies to the receiving country or sector. In particular, FaveCard relies on the EU–US Data Privacy Framework (DPF) adequacy decision dated 10 July 2023 for transfers to US recipients that have validly self-certified under the DPF.
• (b) The Standard Contractual Clauses (SCCs) adopted by Implementing Decision (EU) 2021/914, as further described in clause 9.3 below.
• (c) Where the SCCs do not apply for any reason, another transfer mechanism permitted under Article 46 GDPR.

9.3 Standard Contractual Clauses — incorporation by reference

To the extent FaveCard transfers Customer Personal Data to a Sub-processor outside the EEA in reliance on the SCCs, the parties agree that the SCCs are incorporated into this DPA by reference and form part of it, with the following specifications:

• The applicable Module of the SCCs is whichever Module reflects the actual factual situation. For the typical case where FaveCard acts as Processor on the Customer's behalf and engages a Sub-processor outside the EEA, this will be Module 3 (Processor to Processor). Where the Customer itself is established outside the EEA and instructs FaveCard (within the EEA) to process Customer Personal Data, the relevant Module may be Module 4 (Processor to Controller in third country).
• The SCCs are deemed signed by both parties on the date the Customer accepts this DPA. Both parties hereby grant each other authority to deem the SCCs signed on their behalf for all relevant Modules.
• Schedules 1, 2, and 3 to this DPA serve, with the necessary adaptations, as Annexes I, II, and III respectively to the SCCs.
• The optional clauses of the SCCs apply as follows:
  • Clause 7 (Docking clause): not applied.
  • Clause 9 (Use of sub-processors): Option 2 — General written authorisation, with the notice period set in clause 6.3 of this DPA.
  • Clause 11 (Redress): the optional independent dispute resolution body is not selected.
  • Clause 17 (Governing law): the law of Poland.
  • Clause 18 (Choice of forum and jurisdiction): the courts of Poland (Kraków).
• Where the Sub-processor and FaveCard have already executed SCCs directly between themselves, the directly-executed SCCs prevail over this incorporation by reference.

9.4 UK and Switzerland

Where Customer Personal Data is transferred from the United Kingdom to a third country, the UK International Data Transfer Addendum (UK Addendum) is incorporated by reference into this DPA, with the EU SCCs serving as the underlying Approved EU SCCs and Schedules 1-3 of this DPA serving as the corresponding Annexes.

Where Customer Personal Data is transferred from Switzerland to a third country, the SCCs apply with the modifications required by the Swiss Federal Act on Data Protection (FADP), and references to "GDPR" are read as references to the FADP and "supervisory authority" as references to the Swiss Federal Data Protection and Information Commissioner.

9.5 Updating transfer mechanisms

If the European Commission, the European Data Protection Board, or a competent court invalidates a transfer mechanism that FaveCard relies on (for example, by invalidating the DPF), FaveCard shall, within a reasonable time, transition to an alternative valid mechanism and update this clause and the Sub-processors List accordingly.

10. Deletion and Return

10.1 At the Customer's choice

Upon termination or expiration of the Terms, FaveCard shall, at the Customer's choice, delete or return all Customer Personal Data to the Customer.

10.2 Default behaviour

Unless the Customer notifies FaveCard otherwise within fifteen (15) days of termination or expiration, FaveCard shall delete the Customer Personal Data within sixty (60) days of termination, subject to the limited retention exception in clause 10.4 below. During the 60-day window the Customer may export Customer Personal Data via the export tools available in the dashboard.

10.3 Backups

Customer Personal Data residing in routine backup media may be retained for an additional period not exceeding the standard backup retention cycle (currently up to 35 days beyond the deletion of live data), after which it is overwritten in the ordinary course. During that period, the data is isolated from active systems and is not accessed or used for any purpose other than disaster recovery.

10.4 Legal retention exception

FaveCard may retain Customer Personal Data beyond the 60-day deletion period to the extent and for as long as required by Applicable Data Protection Law or other applicable law, including (in particular) the obligation under Polish tax law (Ordynacja podatkowa Art. 70 § 1 and Ustawa o rachunkowości Art. 74) to retain billing and accounting records for a minimum of five (5) years from the end of the relevant tax year. Retained data shall be subject to the same confidentiality and security obligations as during the term of the Terms, and shall not be processed for any purpose other than the legal obligation that justifies its retention.

10.5 Certificate of deletion

On request, FaveCard shall provide the Customer with a written certificate confirming the deletion of Customer Personal Data in accordance with this clause.

11. Audits

11.1 Information rights

FaveCard shall make available to the Customer all information reasonably necessary to demonstrate compliance with the obligations laid down in this DPA and in Article 28 GDPR. Such information may include independent third-party audit reports, security questionnaires, and the description of technical and organisational measures in Schedule 2.

11.2 Audits in lieu of on-site inspections

The Customer's audit rights under Article 28(3)(h) GDPR are satisfied, in the first instance, by FaveCard providing copies of relevant third-party audit reports (such as ISO 27001 certifications, SOC 2 reports, or equivalent attestations) where available, together with the documentation referenced in Schedule 2. Where no such attestations are currently held, FaveCard will provide documentation-based responses to reasonable due-diligence questionnaires.

11.3 On-site audits

If the documentation provided under clause 11.2 is insufficient to demonstrate compliance with this DPA in connection with a specific concern, the Customer (or an independent third-party auditor mandated by the Customer and acceptable to FaveCard) may carry out an audit on FaveCard's premises, subject to the following conditions:

• (a) the Customer gives FaveCard at least thirty (30) days' written notice;
• (b) the audit is conducted during normal business hours and in a manner that does not unreasonably interfere with FaveCard's operations;
• (c) the auditor signs a confidentiality agreement on terms reasonably acceptable to FaveCard before being given access;
• (d) the audit is limited in scope to the specific concern and to the processing of the requesting Customer's data;
• (e) the audit is conducted no more than once per twelve-month period, except where required by a supervisory authority or in connection with the investigation of a Personal Data Breach affecting the Customer.

11.4 Cost

Each party bears its own costs in connection with audits under this clause, except that the Customer shall reimburse FaveCard for FaveCard's reasonable internal costs of supporting an on-site audit, unless the audit reveals a material breach of this DPA by FaveCard (in which case FaveCard bears its own costs).

11.5 Confidentiality of audit results

Audit reports and any information disclosed during an audit are Confidential Information of FaveCard for the purposes of clause 9 of the Terms.

12. Liability

12.1 Liability under this DPA

Each party's liability arising out of or in connection with this DPA, whether in contract, tort, or otherwise, is subject to the limitations and exclusions set out in Section 12 of the Terms, including the cap on liability and the carve-outs for matters that cannot be limited or excluded under applicable law.

12.2 Joint and several liability under SCCs

To the extent any Data Subject brings a direct claim against FaveCard under the SCCs, FaveCard's liability to that Data Subject is governed by the SCCs themselves and is not limited by this clause 12 or by Section 12 of the Terms. As between the Customer and FaveCard, however, the limitations in Section 12 of the Terms continue to apply.

13. Term

This DPA enters into force on the date the Customer accepts the Terms and continues for as long as the Terms are in force, and thereafter for the period during which FaveCard processes Customer Personal Data in connection with deletion, return, or legally-required retention. Termination of the Terms automatically terminates this DPA, except for clauses that by their nature should survive termination (including clauses 1, 2.1, 2.3, 2.7, 2.8, 9, 10, 11.5, and 12).

14. Miscellaneous

14.1 Order of precedence

In case of any conflict between the documents that govern the relationship between FaveCard and the Customer, the order of precedence is: (1) this DPA (for matters of data protection only), (2) the SCCs (where incorporated by reference), (3) the Terms, (4) the Privacy Policy, (5) the Sub-processors List.

14.2 Severability

If any provision of this DPA is held to be invalid or unenforceable under any Applicable Data Protection Law, that provision shall be modified to the minimum extent necessary to make it valid and enforceable, and the remaining provisions shall continue in full force and effect.

14.3 Governing law

This DPA is governed by the law of the Republic of Poland, except where the SCCs (incorporated by reference under clause 9) require a different governing law for transfer-related matters, in which case the SCCs prevail for those specific matters.

14.4 Notices

Notices under this DPA shall be given by email in accordance with Section 16 of the Terms. Notices to FaveCard concerning data-protection matters specifically should be addressed to privacy@favecard.co.

14.5 Language

This DPA is drafted in English, which is the authoritative version. Translations may be provided for convenience; in case of conflict, the English version prevails, except where mandatory law requires otherwise.

14.6 Updates to this DPA

FaveCard may update this DPA from time to time to reflect changes in Applicable Data Protection Law, in the structure of the Service, or in industry practice. Updates that materially decrease the level of data-protection commitments to the Customer require the same notice procedure as material changes to the Terms (Section 14 of the Terms). Updates that maintain or improve the level of commitments take effect on publication.

Schedule 1 — Subject Matter, Nature, Purpose, Duration, Categories of Data

This Schedule serves as Annex I to the Standard Contractual Clauses where the SCCs are incorporated by reference under clause 9.3, with the necessary adaptations.

1.1 Parties

• Data exporter: the Customer (acting as Controller of Customer Personal Data).
• Data importer: Qualityc Łukasz Fryc (FaveCard), acting as Processor of Customer Personal Data on the Customer's behalf, with registered address at Kasinka Mała 472, 34-734 Kasinka Mała, Poland; NIP 7372138804; EU VAT PL7372138804; contact privacy@favecard.co.

1.2 Subject matter

The processing by FaveCard of Customer Personal Data in the course of providing the FaveCard digital loyalty card platform to the Customer.

1.3 Nature of processing

Hosting, storage, structuring, retrieval, transmission, display, deletion, and other operations necessary to operate the Service, including:

• account creation and management;
• generation, distribution, and updating of wallet passes through Apple Wallet, Google Wallet, and comparable wallet platforms;
• delivery of transactional and (where opted in) marketing emails on behalf of the Customer;
• recording of stamp counts, rewards, and loyalty program activity;
• analytics and reporting on Loyalty Program performance for the Customer's own use;
• provision of customer support and incident response.

1.4 Purpose of processing

To enable the Customer to operate digital loyalty programs and to deliver the Service in accordance with the Terms.

1.5 Duration of processing

For the duration of the Terms, plus the deletion or retention periods set out in clause 10 of this DPA.

1.6 Categories of Data Subjects

• End Customers (cardholders) of the Customer's Loyalty Programs.
• The Customer's authorised users (employees, contractors, agents) who access the dashboard or otherwise use the Service.

1.7 Categories of Personal Data

• End Customer data (Customer is Controller, FaveCard is Processor): first name, email address, optional phone number, optional birthday (day and month only), wallet pass identifiers, stamp counts, rewards earned, loyalty-program transaction history, marketing consent state, device and browser information collected during signup, IP address.
• Authorised user data: first name, last name, email address, role within the Customer's organisation, dashboard activity logs.

For completeness, and separately from the Customer Personal Data listed above, the Service also maintains the minimal unified customer record described in clause 2.7 of this DPA, in respect of which FaveCard acts as independent Controller and not as Processor. That record falls outside the scope of this Schedule 1 because it is not Customer Personal Data within the meaning of this DPA.

1.8 Sensitive Personal Data

None — see clause 2.5 of this DPA. The Service is not designed to process special categories of Personal Data within the meaning of Article 9 GDPR.

1.9 Frequency of transfer

Continuous, on a per-event basis (whenever the Customer or an End Customer interacts with the Service).

1.10 Retention period

As set out in clause 10 of this DPA. Default deletion within 60 days of termination of the Terms, subject to backup-cycle and legal-retention exceptions.

1.11 Sub-processor processing

The same categories of Personal Data, the same nature, the same purpose, and the same duration as above, transferred to Sub-processors only to the extent necessary for the specific function each Sub-processor performs, as described in Schedule 3.

Schedule 2 — Technical and Organisational Measures

This Schedule serves as Annex II to the Standard Contractual Clauses where the SCCs are incorporated by reference under clause 9.3, with the necessary adaptations.

This Schedule describes the technical and organisational measures that FaveCard has in place to protect Customer Personal Data, in accordance with Article 32 GDPR. FaveCard may update these measures from time to time, provided that any update does not materially decrease the overall level of protection.

2.1 Encryption

• In transit: all communications between Customer devices, the FaveCard dashboard, the public business pages, and FaveCard's backend are protected using TLS 1.2 or higher with industry-standard cipher suites. HTTPS is enforced for all public endpoints.
• At rest: Customer Personal Data is encrypted at rest by the underlying Google Cloud infrastructure using AES-256 (or equivalent) Google-managed keys for Firestore and Cloud Storage.

2.2 Access control

• Authentication: access to FaveCard production systems is gated by Firebase Authentication and Google Cloud Identity. Multi-factor authentication is enforced for all administrative access to the production environment.
• Authorisation: access is granted on a need-to-know and least-privilege basis. Roles are defined for the founder and (where applicable) future operational personnel. Customer-side roles inside the dashboard are configurable by the Customer.
• Audit logging: privileged actions on production infrastructure are logged centrally in Google Cloud audit logs and retained for at least twelve months.

2.3 Network and infrastructure security

• Cloud infrastructure: the Service is hosted on Google Cloud Platform with network controls including private VPC routing where applicable, identity-aware access proxies for administrative endpoints, and isolation between projects/environments (production vs sandbox).
• Firewall and DDoS protection: inbound traffic to public endpoints is protected by Google Cloud's edge protections (including DDoS mitigation) and Vercel's edge layer for the public business page.
• Vulnerability management: automated dependency scanning is in place for the application codebases. Critical vulnerabilities are patched without undue delay.

2.4 Application security

• Secret management: secrets (API keys, signing keys, OAuth credentials) are stored using Google Cloud Secret Manager and accessed by Cloud Functions only at runtime through the Firebase Secrets mechanism.
• Input validation: API endpoints validate inputs against typed schemas defined in shared contracts.
• Security logging: application errors and security events are captured by Sentry (EU region, Frankfurt) for triage and response.

2.5 Backup and recovery

• Backups: Firestore data is backed up automatically by Google Cloud's managed backup systems. Backups are retained for the standard backup cycle (currently up to 35 days).
• Recovery testing: disaster-recovery procedures are reviewed periodically and updated as the infrastructure evolves.

2.6 Incident response

• Detection: errors and anomalies are surfaced via Sentry alerts and Google Cloud monitoring.
• Response: the founder serves as the primary incident-response contact. Personal Data Breaches are notified to affected Customers in accordance with clause 8.1 of this DPA.
• Documentation: breaches and incidents are recorded in an internal register, including the nature, scope, response, and outcome.

2.7 Personnel measures

• Confidentiality obligations: all personnel with access to Customer Personal Data are bound by written or statutory confidentiality obligations.
• Training: personnel receive training on data protection and security commensurate with their role.
• Background checks: at the current scale (sole proprietorship), background checks are not formally administered. Where future personnel are engaged, FaveCard will reassess this measure.

2.8 Sub-processor management

• New Sub-processors are subject to a documented review of their security posture and data-protection commitments before being engaged.
• Sub-processors are listed in Schedule 3 and on the public Sub-processors List.

2.9 Data minimisation and purpose limitation

The Service is designed to collect only the data fields necessary for the Loyalty Program functionality. Optional fields (such as End Customer birthday) are clearly marked as optional in the signup flow.

2.10 Documentation and review

This Schedule is reviewed at least annually and after any material change to the Service or to the underlying infrastructure. Updates are reflected in the version of this DPA published at favecard.co/legal/dpa.

Schedule 3 — Approved Sub-processors

This Schedule serves as Annex III to the Standard Contractual Clauses where the SCCs are incorporated by reference under clause 9.3, with the necessary adaptations.

The current, authoritative list of approved Sub-processors is maintained at:

favecard.co/legal/subprocessors

The Sub-processors List is incorporated into this DPA by reference and forms an integral part of Schedule 3. As of the date of the version of this DPA the Customer accepts, the approved Sub-processors are those listed on the Sub-processors List as of that date. Subsequent additions and replacements are subject to clause 6 of this DPA.

For the avoidance of doubt, the Sub-processors as of the effective date of this DPA include (each of which is described in detail on the Sub-processors List):

1. Google Cloud Platform (Google Ireland Limited / Google LLC) — application hosting, database, storage
2. Apple Push Notification Service (Apple Inc. / Apple Distribution International Ltd.) — Apple Wallet pass updates
3. Google Wallet API (Google LLC) — Google Wallet pass generation
4. Stripe Payments Europe, Limited and Stripe, Inc. — payment processing
5. Resend (Plus Five Five, Inc., d/b/a Resend) — transactional email delivery
6. Loops (Astrodon Corporation, d/b/a Loops) — FaveCard's marketing email to business customers
7. Sentry (Functional Software, Inc., d/b/a Sentry) — error monitoring (EU region)
8. PostHog (PostHog, Inc. / Hiberly Ltd.) — product analytics (EU instance)
9. Vercel Inc. — public business page hosting

Schedule 4 — Compliance Support Services

This Schedule sets out the Compliance Support Services that FaveCard performs on the Customer's behalf as a standing instruction under clause 2.6 of this DPA. The Compliance Support Services are an exercise of FaveCard's assistance obligations under Articles 28(3)(e) and 28(3)(f) GDPR, escalated to the maximum level of assistance that is technically and organisationally possible at the small-merchant tier.

For all Compliance Support Services, FaveCard acts as Processor on the Customer's documented instructions. The Customer remains the sole Controller of Customer Personal Data and retains ultimate legal responsibility under Applicable Data Protection Law.

4.1 Scope of services

The Compliance Support Services consist of the following five activities.

(a) Receiving and resolving Data Subject Rights requests

FaveCard shall:

• maintain a published contact address for Data Subject Rights requests at privacy@favecard.co;
• accept and acknowledge requests received at that address relating to End Customer Personal Data hosted in the Customer's tenant of the Service;
• verify the identity of the Data Subject by reference to information already held in the Service;
• resolve requests under Articles 15 (access), 16 (rectification), 17 (erasure), 18 (restriction), 20 (portability), and 21 (objection) GDPR within the statutory window of one (1) month from receipt, extendable by up to two (2) further months in complex cases per Article 12(3) GDPR;
• inform the Customer of any request that materially affects the Customer's relationship with the Data Subject and, where time permits, give the Customer a reasonable opportunity to comment before responding;
• maintain a per-Customer record of requests received, decisions taken, and responses dispatched, accessible to the Customer on request.

(b) Detecting and notifying Personal Data Breaches

FaveCard shall:

• monitor the Service for indicators of Personal Data Breaches affecting Customer Personal Data;
• on detection of a breach, notify the affected Customer in accordance with clause 8.1 of this DPA;
• prepare a notification to the competent supervisory authority that meets the content requirements of Article 33(3) GDPR;
• where the breach is likely to result in a high risk to the rights and freedoms of Data Subjects, prepare a notification to the affected Data Subjects that meets the content requirements of Article 34(2) GDPR;
• dispatch the notifications described above on the Customer's behalf within the statutory windows (seventy-two (72) hours to the supervisory authority under Article 33 GDPR; "without undue delay" to Data Subjects under Article 34 GDPR);
• where time permits, consult the Customer on the substance of the notification before dispatch and, in any case, provide the Customer with a copy immediately after dispatch.

(c) Hosting and maintaining a per-business privacy notice

FaveCard shall:

• publish and maintain a Customer Privacy Notice drafted to meet the requirements of Articles 13 and 14 GDPR for the typical processing carried out by Customers using the Service;
• interpolate into the Customer Privacy Notice the Customer's identifying details (name, registration number / NIP, contact email, registered address) so that each Customer's End Customers see a notice that correctly identifies their merchant;
• keep the interpolated identifying details in sync with the details the Customer has entered in its dashboard profile, updating the published notice without undue delay after a profile change;
• make the Customer Privacy Notice available at a stable URL accessible from the End Customer signup form (currently /legal/customer-privacy?company={slug});
• review the underlying notice template at least annually and after any material change in the Service or in Applicable Data Protection Law.

The Customer may, in lieu of relying on the Customer Privacy Notice provided by FaveCard, publish its own privacy notice and link to it from its own properties; in that case the Customer remains responsible for the content and accuracy of its own notice.

(d) Maintaining a marketing-consent audit trail

FaveCard shall:

• record, for each End Customer that interacts with a Customer's signup form, the marketing-consent state captured at the moment of signup (opt-in, no opt-in, or refusal where presented);
• record the timestamp, IP address, user agent, the locale of the form shown, and the exact text version of the marketing-consent label and privacy notice that was displayed at the moment of capture;
• preserve this audit trail for as long as the End Customer's record exists in the Customer's tenant, and for a reasonable period thereafter to support proof of consent in the event of a regulatory inquiry or Data Subject complaint;
• make the audit trail accessible to the Customer on request and to a supervisory authority where lawfully required.

(e) Enforcing the Acceptable Use Policy on outbound communications

FaveCard shall:

• maintain the Acceptable Use Policy (the "AUP") published at favecard.co/legal/acceptable-use, which prohibits, among other things, sending marketing communications to recipients without proof of consent, importing third-party email lists without consent provenance, and using the Service to communicate with prohibited categories of Data Subjects;
• monitor outbound communications sent through the Service for AUP violations using reasonable technical means (including bounce-rate, complaint-rate, and unsubscribe-rate thresholds);
• on detection of an apparent AUP violation, notify the Customer and suspend the affected outbound communication channel for the Customer until the issue is resolved;
• in cases of repeated or egregious AUP violations, terminate the affected portion of the Service in accordance with the Terms.

4.2 Service levels

4.3 Limitations

The Compliance Support Services are bounded by what is technically and organisationally possible within the Service. In particular:

• (a) FaveCard can only resolve requests in respect of Customer Personal Data that is held within the Service. Requests that concern data held outside the Service (for example, on the Customer's till system, in a paper register, or in the Customer's own marketing systems) cannot be resolved by FaveCard and shall be forwarded to the Customer.
• (b) FaveCard cannot fulfil requests that would require it to exceed the technical capabilities of the Service or to breach Applicable Data Protection Law or any other applicable law.
• (c) FaveCard cannot make legal determinations that are reserved to the Customer as Controller (for example, whether a particular request is "manifestly unfounded or excessive" within the meaning of Article 12(5) GDPR). Where such a determination is required, FaveCard shall consult the Customer.

4.4 Cost

The Compliance Support Services are provided at no separate charge as part of the Service, within the volumes reasonably anticipated for a Customer of the Customer's size and usage profile. Where volume materially exceeds those expectations (for example, in the wake of a public incident or a coordinated campaign), clause 7.3 of this DPA applies.

4.5 Withdrawal of standing instruction

The Customer may at any time withdraw the standing instruction issued under clause 2.6 and this Schedule, in whole or in part, by written notice to FaveCard. Withdrawal takes effect on receipt by FaveCard. From the date of withdrawal, the Customer shall perform the relevant compliance activities itself, and FaveCard's obligations revert to the standard processor-assistance model described in clauses 7 and 8 of this DPA.

Withdrawal of the standing instruction does not relieve the Customer of any responsibility under Applicable Data Protection Law and does not entitle the Customer to a refund.

Version history