1. Parties and scope
1.1 This Data Processing Agreement ("DPA") is concluded between the business that uses MezaTap (the "Controller") and MezaTap, a sole proprietorship (eenmanszaak) registered with the Netherlands Chamber of Commerce (KVK) under number 42086035, VAT number NL005484324B92 (the "Processor").
1.2 This DPA forms part of the agreement for the use of MezaTap under our Terms of Service (the "Agreement") and applies to all personal data that the Processor processes on behalf of the Controller. The Controller accepts this DPA when signing up.
1.3 Terms such as personal data, processing, controller, processor, sub-processor, and personal data breach have the meaning given in the General Data Protection Regulation ("GDPR").
1.4 If this DPA conflicts with the Terms of Service on the processing of personal data, this DPA prevails.
2. Subject, nature, and purpose
The Processor processes personal data only to provide the Service to the Controller: issuing and updating digital loyalty cards, recording stamps and rewards, sending card updates and messages set up by the Controller, providing the dashboard and scan page, and the related support, security, and backups. Annex 1 describes the processing in more detail.
3. Instructions
3.1 The Processor processes personal data only on documented instructions of the Controller, including with regard to transfers outside the EEA, unless required to do so by EU or Dutch law. In that case the Processor informs the Controller before processing, unless the law prohibits this.
3.2 The Agreement, this DPA, and the settings and actions of the Controller in the Service form the Controller's documented instructions.
3.3 The Processor informs the Controller immediately if, in its opinion, an instruction infringes the GDPR or other data protection law.
3.4 The Processor does not use the personal data for its own purposes, does not sell it, and does not combine it with data of other customers, except in anonymised and aggregated form that cannot be traced to individuals.
4. Responsibilities of the Controller
The Controller is responsible for:
- having a valid legal basis for the processing, including consent for commercial messages where required;
- informing card holders about the processing, for example by referring to the card holder section of the MezaTap Privacy Policy and its own privacy notice;
- the lawfulness of its instructions and of the data it enters;
- the security of its own devices and accounts, and the access it grants to its staff.
5. Confidentiality
The Processor ensures that persons authorised to process the personal data are bound by confidentiality and have access only to the extent needed for their tasks.
6. Security
6.1 The Processor takes appropriate technical and organisational measures to protect the personal data against loss and unlawful processing, taking into account the state of the art, the costs, and the risks. Annex 3 describes these measures.
6.2 The Processor may update the measures, provided the level of protection does not decrease.
7. Sub-processors
7.1 The Controller gives general authorisation for the use of sub-processors. The current sub-processors are listed in Annex 2.
7.2 The Processor informs the Controller at least 30 days in advance of any intended addition or replacement of a sub-processor, by email or in the dashboard. The Controller may object on reasonable grounds within that period. If the parties cannot resolve the objection, the Controller may terminate the Agreement before the change takes effect, without any costs.
7.3 The Processor imposes on each sub-processor, by written agreement, the same data protection obligations as those in this DPA, and remains responsible towards the Controller for the performance of the sub-processor's obligations.
8. Transfers outside the EEA
The Processor transfers personal data outside the European Economic Area only if the conditions of Chapter V GDPR are met, for example on the basis of an adequacy decision of the European Commission, including the EU-US Data Privacy Framework, or the Standard Contractual Clauses, with additional measures where needed.
9. Assistance
9.1 Taking into account the nature of the processing, the Processor assists the Controller with appropriate measures to respond to requests from card holders exercising their rights. The dashboard allows the Controller to view, edit, export, and delete card holder data. If the Processor receives a request directly, it forwards it to the Controller without undue delay and does not respond itself unless the Controller instructs it to.
9.2 The Processor assists the Controller, with the information available to it, in meeting its obligations regarding security, data breach notifications, data protection impact assessments, and prior consultation with the supervisory authority.
9.3 Assistance that goes beyond what the Service offers as standard, and that is not caused by a failure of the Processor, may be charged at reasonable rates after prior notice.
10. Personal data breaches
10.1 The Processor notifies the Controller without undue delay, and in any event within 48 hours after discovery, of a personal data breach affecting the Controller's personal data.
10.2 The notification contains, to the extent known: the nature of the breach, the categories and approximate number of people and records concerned, the likely consequences, and the measures taken or proposed. Information that is not yet available is provided as soon as possible.
10.3 The Processor takes reasonable measures to limit the consequences of the breach and to prevent repetition. The Controller decides whether to notify the supervisory authority and the people affected.
11. Audits
11.1 The Processor makes available to the Controller all information necessary to demonstrate compliance with this DPA.
11.2 If that information is not sufficient, the Controller may, at most once per year and with at least 30 days' notice, have an audit carried out by an independent expert bound by confidentiality. The audit must not unreasonably disrupt the Processor's business or give access to data of other customers. The Controller bears the costs, unless the audit shows a material breach by the Processor.
12. Term, deletion, and return
12.1 This DPA applies for as long as the Processor processes personal data for the Controller.
12.2 Before the account is closed, the Controller can export its card holder data from the dashboard. After closing, the Processor deletes the personal data within 14 days, and from backups within 30 days after that, unless EU or Dutch law requires storage.
13. Liability
The liability of each party under this DPA is governed by the limitations in article 13 of the Terms of Service, except to the extent the GDPR does not allow such limitation.
14. Governing law
Dutch law applies to this DPA. Disputes are submitted to the competent court in The Hague (Rechtbank Den Haag).
Annex 1. Description of the processing
| Item | Description |
|---|---|
| Data subjects | Card holders of the Controller; the Controller's staff when they record stamps |
| Personal data | First name, email address, phone number, language, stamp and reward history with date, time, location and staff account, consent record including IP address, card identifiers and device push tokens, and data the Controller adds, such as date of birth, tags, and notes; for staff, optionally the approximate device location when stamping |
| Special categories | None. The Controller must not enter special categories of personal data |
| Nature of processing | Collecting, storing, organising, updating, displaying, sending messages, exporting, and deleting |
| Purpose | Providing the loyalty programme of the Controller through the Service |
| Duration | For the term of the Agreement, followed by deletion under article 12 |
Annex 2. Sub-processors
| Sub-processor | Service | Location | Transfer safeguard |
|---|---|---|---|
| Hosting provider | Servers, database, backups | European Economic Area | Not applicable |
| Resend, Inc. | Sending emails to card holders | United States | EU-US Data Privacy Framework or Standard Contractual Clauses |
| Apple Inc. | Delivering and updating Apple Wallet cards | United States | EU-US Data Privacy Framework or Standard Contractual Clauses |
| Google LLC | Delivering and updating Google Wallet cards | United States | EU-US Data Privacy Framework or Standard Contractual Clauses |
| Cloudflare, Inc. | Bot protection on the join form | Global network | EU-US Data Privacy Framework or Standard Contractual Clauses |
| Functional Software, Inc. (Sentry) | Error monitoring, without names or email addresses by default | United States | EU-US Data Privacy Framework or Standard Contractual Clauses |
The Controller can request the full name and location of the hosting provider at info@mezatap.com.
Annex 3. Technical and organisational measures
- Encrypted connections (TLS) for all traffic to the Service
- Passwords stored only as secure hashes
- Separation of data per customer account at application level
- Role-based access for the Controller's staff
- Rate limiting and bot protection on public forms
- Cryptographically signed wallet cards and secret authentication tokens per card
- Logging of important actions in the dashboard
- Access to production systems limited to authorised persons, with two-factor authentication for administrator accounts
- Regular backups and a procedure for handling personal data breaches
- Deletion of data after closing an account, as described in article 12