DigiStamp

⚠️ DRAFT. Content requires review by a UK GDPR/PECR solicitor before commercial launch.

Last updated: 2026-09-07

Data Processing Agreement (DPA)

⚠️ DRAFT — requires review by a UK GDPR-qualified solicitor before commercial launch.

Last updated: 2026-09-07

Parties

  • Controller: Business Owner — a user holding a DigiStamp account.
  • Processor: DigiStamp — Izabela Banachiewicz, sole trader, UK.

1. Subject matter

The Processor processes personal data of the Controller's end customers (name, phone, birthday day/month, visit history) solely to deliver the digital loyalty-program service.

2. Categories of data and data subjects

  • Data subjects: End customers of the Controller.
  • Categories of data: name, phone number, birthday day/month (no year), pseudonymous card token, visit history.

3. Processor obligations (UK GDPR art. 28)

The Processor: a) processes data only on documented instructions of the Controller, b) ensures confidentiality of authorised persons, c) implements appropriate technical and organisational measures (bcrypt, JWT, HTTPS, DB access control), d) engages sub-processors with the Controller's consent (current list § 5), e) assists the Controller with data-subject rights (DSAR, erasure, rectification) — tools available in the panel, f) notifies personal-data breaches without undue delay (max 72h), g) on contract end: deletes or returns data at the Controller's option, h) makes available information necessary to demonstrate compliance.

4. Controller obligations

The Controller warrants they have a lawful basis to process end-customer data and provide required transparency information at their premises.

5. Sub-processors

Current sub-processors:

  • MongoDB (Emergent Cloud) — database hosting.
  • Resend — transactional email (US, UK IDTA).
  • Twilio — SMS (US, UK IDTA, currently disabled / mock).

Sub-processor changes: 30-day advance notice, Controller may terminate free of charge.

6. Non-UK transfers

Governed by UK International Data Transfer Agreement (IDTA) or UK Addendum to SCCs + Transfer Impact Assessment.

7. Term

The DPA runs for the term of the main service. Termination of the main contract = termination of the DPA.

8. Liability

REQUIRES LEGAL REVIEW ⚠️ — standard cap at fees paid to Processor in the preceding 12 months.

9. Governing law

Laws of England and Wales.