Data Processing Agreement (DPA)

Last updated: 2026-10-04 Processor: Izabela Banachiewicz (sole trader, UK), trading as MyDigiStamp Business address: 108 Wood Lane, West Bromwich, B70 9PX, United Kingdom Contact: contact@mydigistamp.com Controller: the business owner using MyDigiStamp

This DPA is incorporated by reference into the Terms of Service and governs processing of end-customer personal data by MyDigiStamp on behalf of the business owner (controller). It is required by UK GDPR art. 28.

1. Scope and roles

• Controller — you, the business owner running the loyalty program.
• Processor — MyDigiStamp.
• Data subjects — your end customers (loyalty-card holders) and, for Premium online integration, online shoppers whose orders trigger stamps.

2. Categories of personal data processed

• Name (optional)
• Phone number (optional)
• Birthday day and month only — never year
• Loyalty-card token (pseudonymous UUID)
• Visit history (timestamps, stamp types)
• SMS log (destination, message, status — 30-day retention)
• E-commerce integration data (Premium): customer email, customer name, order ID, order total + currency, order status

Explicitly excluded: payment card data (handled directly by Stripe as a separate controller).

3. Processing purpose and duration

Purpose: operate the loyalty program as directed by controller. Duration: lifetime of controller's account + 30 days.

4. Processor's obligations

• Process only on documented instructions of the controller (configured via the app).
• Confidentiality — all persons with access are bound to confidentiality.
• Security — bcrypt-hashed credentials, HTTPS everywhere, encryption at rest (MongoDB Atlas), 2FA for super-admin, brute-force lockout, automated retention, audit log for support access.
• Assist controller with DSARs, DPIAs and breach notifications.
• Notify controller of a breach without undue delay — see breach procedure in /app/legal/internal/breach-procedure.md.

5. Sub-processors

| Sub-processor | Service | Location | |---|---|---| | Emergent | Hosting + MongoDB Atlas + transactional email delivery (via Emergent Email API, which uses Resend as its own sub-processor on Emergent-managed sender domain) | Hosting: data is hosted by Emergent on cloud infrastructure; we are confirming the exact region and will update this section. Email delivery via Resend: EU / USA. | | Resend | Transactional email delivery (sub-processor engaged by Emergent, not directly by MyDigiStamp) | EU / USA | | Twilio | SMS (currently inactive) | UK + USA | | IONOS | Business email inbox (contact@mydigistamp.com) | EU |

Stripe is a separate data controller for payment data, not a MyDigiStamp sub-processor.

The processor imposes the same data-protection obligations on each sub-processor as set out in this DPA, by written contract or equivalent (UK GDPR art. 28(4)).

6. International transfers

Non-UK transfers rely on UK International Data Transfer Agreement (IDTA) or Standard Contractual Clauses with UK addendum, as published by the ICO. [LAWYER — confirm mechanism per sub-processor.]

7. Audit

Controller has the right to audit processor's compliance:

• Max one audit per year (unless a serious breach justifies more).
• 30 days' written notice.
• Conducted by controller or an independent 3rd-party auditor bound by confidentiality.
• Reasonable costs borne by the controller.

[LAWYER]

8. End of agreement

On termination of the Terms of Service, processor will, at controller's choice:

• Delete all end-customer data within 30 days, OR
• Return the data as a JSON export (available via GET /auth/export-my-data while account is live).

Backups are rotated per retention policy; retained copies are not re-used.

9. Governing law

England & Wales. See Terms §17.