Data Processing Addendum

This Data Processing Addendum ("addendum") forms part of the Rewardfinity Terms of Service between the business that uses Rewardfinity ("you") and Anhad Singh, a sole proprietor based in Etobicoke, Ontario, Canada, who operates Rewardfinity ("we" or "us"). It covers the personal information we process for you about your members, staff and incentive participants ("your data"). You accept it when you accept the Terms; no signature is needed. If it conflicts with the Terms about how your data is handled, this addendum applies.

Roles

You decide why and how your data is used: you are the controller under the GDPR and the UK GDPR, and the organisation responsible for it under other privacy laws. We are your processor or service provider. This addendum does not cover information we handle for our own purposes, such as your account details, billing and our website; the Privacy Policy covers those.

Details of the processing

• Subject matter and purpose: running your loyalty, rewards and staff-incentive programs on Rewardfinity: recording activity, calculating balances, showing member cards and Wallet passes, issuing rewards, sending the messages members asked for, and connecting the tools you choose.
• Duration: while your account exists, and then until deletion as described under "End of the service".
• People concerned: customers who join your program, your staff, and the incentive participants you invite.
• Personal information: the categories listed for members, staff and devices, staff-incentive participants, and the stores and tools you connect under "Information we collect" in the Privacy Policy; for example email address or phone number, optional name and birthday (month and day), join-form answers including photos, consent records, loyalty activity, Wallet and push identifiers, and staff key labels.
• Sensitive information: Rewardfinity is not designed for health, financial-account, government-identifier or other special-category information. Do not ask for it in join-form questions.

Our commitments to you

Instructions. We process your data only on your documented instructions: these terms, the way you configure Rewardfinity, and your written requests, including about transfers to other countries. If a law requires other processing, we will tell you first unless that law forbids it. We will tell you if we believe an instruction breaks data protection law.

Confidentiality. Rewardfinity is run by one person. Anyone we authorise to access your data is bound by a duty of confidentiality.

Security. We protect your data with the measures described on Security at Rewardfinity, including encryption in transit and at rest, hashed credentials, separation between merchants and audit records, and we keep them appropriate to the risk.

Service providers (subprocessors). You authorise us to use the providers listed under Service providers we use. Before a new provider receives your data, we will update that list and email your account owner. If you object on reasonable data protection grounds, tell us at info@rewardfinity.com; if we cannot resolve the objection, you can close your account. We use providers that commit to data protection obligations for the data they process for us, mainly through their own data processing terms, and we remain responsible to you for their processing.

Requests from people. The dashboard lets you export your member list and anonymize a member. If you need more to answer an access, correction, deletion, portability or objection request, we will help. If a member contacts us directly about your program, we will pass the request to you without undue delay and help you answer it.

Breaches. We will notify your account owner without undue delay after becoming aware of a personal data breach affecting your data, with the information we have and more as we learn it, and help you meet your own obligations to notify authorities and the people affected.

Other help. We will give you the information you reasonably need for a data protection impact assessment, or a consultation with a supervisory authority, that concerns Rewardfinity.

Audits. We will make available the information you need to show that this addendum is being met, and answer your reasonable written questions. If that is not enough, or a supervisory authority requires it, you may audit our compliance on reasonable written notice, at your own cost, under confidentiality, and no more than once a year unless after a breach.

International transfers

We are based in Canada, and our providers process data in Canada, the United States, the European Union and other countries. The European Commission and the United Kingdom recognise Canadian privacy law as adequate for commercial organisations. Where your data passes from us to a provider in a country without that recognition, we rely on the standard contractual clauses, with the UK addendum where needed, or an equivalent safeguard that provider offers.

End of the service

You can export your member list and program records as CSV at any time. When you close your account, we delete or de-identify your data within 30 days of verifying the request, as the Privacy Policy describes, except what the law requires us to keep and anonymous ledger entries that no longer identify anyone. Deleted information can remain in encrypted, limited backups until it ages out.

United States privacy laws

Where a US state privacy law applies, we act as your service provider or processor. We do not sell or share your data. We do not keep, use or disclose it for any purpose other than providing Rewardfinity to you, or outside our direct business relationship with you, and we do not combine it with personal information from other businesses, except as those laws allow. We will tell you if we can no longer meet these obligations.

Your part

You are responsible for having a lawful basis, and any consent the law requires, for the information you put into Rewardfinity and the messages you send, and for telling your members how their information is used.

Liability and changes

The liability terms in the Terms of Service apply to this addendum as far as the law allows. We will post changes on this page with a new effective date and email account owners before a material change takes effect.

Contact

Rewardfinity is operated by Anhad Singh, a sole proprietor based in Etobicoke, Ontario, Canada. Questions about this addendum: info@rewardfinity.com.