Data Processing Agreement

Last updated: July 7, 2026

In this DPA, "the Operator", "we", "us" and "our" mean [LEGAL NAME] (ABN [ABN]), a sole trader based in New South Wales, Australia, trading as "Your Loyalty Wallet". "You" and "the Controller" mean the business owner who uses the Service. "Customer Personal Data" means personal data about your customers that we process on your behalf through the Service.

1. Roles of the Parties

For the personal data of your own customers that you collect and manage through the Service, you are the data controller and the Operator is the data processor. You are responsible for having a lawful basis and any necessary consents to collect and use Customer Personal Data, and for providing your customers with your own privacy notice. The Operator remains the controller of the account data of the business owner (you), which is governed by our Privacy Policy.

2. Definitions

Terms such as "personal data", "processing", "controller", "processor", "sub-processor", "data subject", and "personal data breach" have the meanings given in applicable data protection law, including the EU/UK GDPR and the Australian Privacy Principles under the Privacy Act 1988 (Cth).

3. Subject Matter, Duration, Nature and Purpose

Subject matter and duration: processing of Customer Personal Data for as long as you use the Service, plus any short retention/backup period described below. Nature and purpose: hosting and operating a digital loyalty program on your behalf — issuing and tracking stamps, spend progress, vouchers and rewards; sending push notifications and marketing you configure; and providing analytics about your shop. We process Customer Personal Data only to provide the Service to you and on your documented instructions (which include your use of the Service's features and settings).

4. Categories of Data Subjects and Personal Data

Data subjects: your customers who join your loyalty program.

Categories of personal data:

• Identifiers such as name and email address
• Loyalty activity — stamps, qualifying spend, vouchers, and rewards
• Visit and transaction metadata associated with your shop
• Push notification tokens where your customers enable notifications
• Approximate location where a customer uses the Discover map to find your shop

You must not use the Service to send us special categories of data (such as health, biometric, or government identifiers) about your customers.

5. Controller (Your) Obligations

• Ensure you have a valid lawful basis and any required consents to collect and use Customer Personal Data
• Provide your customers with a privacy notice describing your use of their data
• Obtain consent before sending marketing or push notifications where the law requires it
• Give the Operator lawful, documented instructions and not ask us to process data unlawfully

6. Processor (Our) Obligations

The Operator will:

• Process Customer Personal Data only on your documented instructions and to provide the Service, unless required by law (in which case we will tell you, where legally permitted)
• Ensure people authorised to process the data are bound by confidentiality
• Implement appropriate technical and organisational security measures (see Section 8)
• Assist you, taking into account the nature of processing, in responding to data-subject requests and in meeting your security, breach-notification, and impact-assessment obligations
• Make available information reasonably necessary to demonstrate compliance with this DPA
• Delete or return Customer Personal Data at the end of the service, as described in Section 10

7. Authorised Sub-processors

You authorise the Operator to engage sub-processors to help deliver the Service. Each sub-processor is bound by data-protection obligations no less protective than those in this DPA. Our current sub-processors are:

We will give reasonable notice (for example, by updating this page) before adding or replacing a sub-processor, so you have the opportunity to object on reasonable data-protection grounds.

8. Security Measures

We maintain technical and organisational measures appropriate to the risk, including: encryption of data in transit; hashing of passwords and secrets; role-based access controls and least-privilege access; row-level database security that isolates each business's data; rate limiting and abuse protections; audit logging of sensitive operations; and secret management through a dedicated secret store. We review and improve these measures over time.

9. Personal Data Breach Notification

If we become aware of a personal data breach affecting Customer Personal Data, we will notify you without undue delay and provide the information reasonably available to help you meet your own notification obligations (including under the GDPR and the Australian Notifiable Data Breaches scheme).

10. Return and Deletion on Termination

When you stop using the Service, or on your request, we will delete Customer Personal Data associated with your account, except where retention is required by law. You can trigger deletion at any time by deleting your shops or your account. Residual copies in routine backups are cycled out on a rolling basis and remain protected by this DPA until deleted.

11. Assistance with Data-Subject Requests

If one of your customers exercises a right (such as access, correction, or deletion) directly with us, we will refer them to you where appropriate and, taking into account the nature of the processing, help you respond. The Service also provides self-serve tools (data export and account deletion) that your customers can use themselves.

12. Audit and Information Rights

On reasonable prior written request, and no more than once a year (unless a regulator requires otherwise or following a breach), we will make available information reasonably necessary to demonstrate compliance with this DPA. Audits must respect the confidentiality and security of other customers' data and our systems.

13. International Transfers

Customer Personal Data may be processed in countries other than yours, including the United States and the European Union, as described in our Privacy Policy. Where data is transferred across borders, we rely on appropriate safeguards such as standard contractual clauses and our providers' data-protection commitments.

14. Relationship to the Terms and Liability

This DPA forms part of the Terms of Use. If there is a conflict on data-protection matters, this DPA prevails for Customer Personal Data. Each party's liability under this DPA is subject to the limitation-of-liability provisions in the Terms of Use.

15. Governing Law

This DPA is governed by the laws of New South Wales, Australia, and the dispute-resolution and jurisdiction provisions of the Terms of Use apply.

16. Contact

For any questions about this DPA or our processing of Customer Personal Data, contact the Operator at yourloyaltywallet@gmail.com.