Data Processing Agreement

1. Parties and purpose

This agreement is between the café that created a TapStik account (the “Café”, the controller) and TapStik, a trade name of Indus Selection (sole proprietorship), Violethof 5, 5044 KM Tilburg, the Netherlands, registration KvK 42199635, VAT ID NL005215239B58 (“TapStik”, the processor). It is part of the Terms for cafés and starts when the Café accepts them.

It applies to the personal data TapStik handles for the Café when it runs the Café’s loyalty program (“Café Data”). Words such as “personal data”, “processing”, “controller”, “processor” and “personal data breach” mean what they mean in the GDPR (Regulation (EU) 2016/679).

2. What is processed

The subject matter, nature, purpose, duration, kinds of data and people concerned are in Annex I. TapStik processes Café Data only to provide the TapStik service to the Café.

3. Instructions

TapStik processes Café Data only on the Café’s documented instructions: these Terms, this agreement, and what the Café does in its dashboard and staff screens. If the law requires TapStik to do something else, it tells the Café first unless the law forbids that.

If TapStik thinks an instruction breaks data protection law, it tells the Café at once and may pause that instruction.

4. The Café’s responsibilities

• The Café has a legal basis for using its customers’ data in TapStik and tells them about it (the notice at /eu/privacy can be used for that).
• The Café sends offers only to customers who agreed to them and are 16 or older, and stops when they withdraw.
• The Café does not put special categories of data (such as health information) into TapStik, and tells its staff not to.
• The Café answers its customers’ requests; TapStik helps as set out in section 9.

5. Confidentiality

TapStik makes sure that everyone it allows to process Café Data is bound by confidentiality, and only gives access to people who need it to run and support the service.

6. Security

TapStik takes the technical and organisational measures in Annex II, which fit the risk of this kind of data (Art. 32 GDPR), and keeps them up to date. It may change them if the level of protection does not go down.

7. Sub-processors

The Café allows TapStik to use the sub-processors in Annex III (the same list as at /eu/subprocessors).

TapStik tells the Café at least 30 days before it adds or replaces one. The Café may object on reasonable data-protection grounds within that time; if the two cannot agree, the Café may end the service without penalty.

TapStik has a written agreement with every sub-processor that puts the same data-protection duties on it, and remains responsible to the Café for what the sub-processor does.

8. Transfers outside the EEA

Café Data is stored and processed by the sub-processors in Annex III, which are in the United States and certified under the EU–US Data Privacy Framework, or covered by Standard Contractual Clauses.

TapStik’s team works from Indonesia and can reach Café Data there, for support and backups. For that, the Café and TapStik agree to the Standard Contractual Clauses in Commission Implementing Decision (EU) 2021/914 (Module Two, controller to processor), which are part of this agreement as set out in Annex IV. The Café is the “data exporter” and TapStik the “data importer”. If TapStik later becomes established in the EEA, or the transfer is otherwise covered, these clauses apply only as far as they are still needed.

9. Helping the Café

• Requests from customers: if a customer asks TapStik directly, TapStik passes it to the Café within 5 working days and does not answer it itself unless the Café says so. The Café can export its customer list and erase customers in its dashboard; TapStik helps with anything the dashboard cannot do. Customers can also switch offers off themselves.
• TapStik helps the Café with its duties on security, personal data breaches, data protection impact assessments and prior consultation (Art. 32 to 36 GDPR), as far as that is possible with what TapStik knows.

10. Personal data breaches

TapStik tells the Café without undue delay after it becomes aware of a personal data breach affecting Café Data, and aims to do so within 48 hours, so the Café can meet its own 72-hour duty to the authority. The message says, as far as known: what happened, the kinds and rough number of people and records, the likely consequences, and what TapStik has done and will do.

TapStik keeps a log of every breach, investigates, limits the harm and helps the Café with its own notices.

11. Deleting and returning data

While the account is open the Café can export its data. TapStik deletes a customer’s card 24 months after the customer’s last visit unless the Café deletes it earlier.

When the service ends, the Café can export its data for 30 days. After that TapStik deletes the Café Data within 30 days, and backups are overwritten no later than 30 days after that. TapStik keeps data longer only where the law requires it, and then only for that.

12. Information and audits

TapStik gives the Café the information it needs to check that this agreement is followed. The Café may audit TapStik (or have an independent auditor do it) once a year, and after a personal data breach, with at least 30 days’ notice, during working hours, without disturbing the service, at the Café’s cost, and under confidentiality. A recent independent report or a clear written answer may take the place of an audit where it covers the same ground.

13. Liability, term and law

Liability under this agreement follows the Terms for cafés, except where the Standard Contractual Clauses or the law say otherwise.

This agreement lasts as long as TapStik handles Café Data for the Café. If it conflicts with the Standard Contractual Clauses, the clauses win; then this agreement; then the Terms. Dutch law applies, and the courts named in the Terms decide disputes.

Annex I: description of the processing

• Parties: the Café (controller, data exporter) and TapStik (processor, data importer). Contact for TapStik: info@tapstik.eu. The Café’s contact is the owner’s email on its account.
• People concerned: the Café’s customers (loyalty card holders) and the Café’s own owner and staff users.
• Customer data: name, email address, phone number (optional), Google account ID (only if they use Google sign-in), language, stickers, rewards and visit dates, usual order and short staff notes, the record of their choice about offers (words shown, time, channel), and a TapStik account if they have one.
• Owner and staff data: name, email address, a password or PIN stored only as a hash, and what they did in the dashboard or on the staff screen (for example stickers given).
• Special categories of data: none are intended. The Café must not enter them.
• Purpose and nature: running the Café’s digital loyalty program: storing, showing and updating cards, counting stickers and rewards, signing customers in, sending the emails and links the Café’s settings call for, backups and support.
• How often: continuously, while the account is open.
• How long: as in section 11.
• Transfers to sub-processors: for the same purposes, as in Annex III.
• Competent supervisory authority (clause 13 of the clauses): the authority of the Café’s country; for a Café in the Netherlands, the Autoriteit Persoonsgegevens.

Annex II: technical and organisational measures

• Access: owner accounts need a verified email and a password of at least 12 characters, stored only as a scrypt hash. Session, reset and sign-in tokens are stored only as hashes. Each café can only reach its own data; every dashboard, staff-screen and admin action checks that first.
• Guessing and abuse: limits on sign-ins, one-time links and PIN attempts per address and per email.
• Staff screens: staff sign in with a name and a 4-digit PIN on a device the owner paired; the staff screen locks after 5 idle minutes; staff do not see revenue, settings, exports, emails or full phone numbers.
• Customers: a phone number alone never opens a card. Cards are recovered with Google or a one-time email link.
• Admin access for TapStik: only listed addresses, by a one-time emailed link.
• In transit: HTTPS with HSTS, a strict content security policy and other security headers.
• At rest: data is kept in a private store, not a public one; uploaded images are checked before they are accepted.
• Backups: nightly, kept 30 days; expired sessions and links are removed nightly.
• Minimising data: no advertising or third-party tracking, essential cookies only, the phone number is optional, and staff see only part of it.
• Making sure it keeps working: security review of the application and automated scans; dependencies are updated when security advisories are published.
• People: access to production data is limited to the TapStik team members who run and support the service, who are bound by confidentiality.
• Incidents: a written breach procedure with a log and a named person in charge.
• Rights: the Café can export and erase customer data in its dashboard; customers can switch offers off in “My cards” and with the link in every message.