Data processing agreement

1. Parties and roles

This agreement is between the Venue (controller) and Recouper Ltd (“Recouper”, processor). It covers personal data Recouper processes for the Venue's loyalty scheme. Recouper is a separate controller for customers' sign-in accounts (email address, name and one-time codes), which this agreement does not cover.

2. Details of processing

• Subject matter: running the Venue's digital loyalty card, staff till, offers and Square link.
• Duration: while the Venue uses Recouper, plus the period in section 9.
• Nature and purpose: storing, showing and updating stamps, balances, rewards and offers; adding cash-back from Square payments; sending messages under section 13; showing reports to the Venue.
• Data subjects: the Venue's customers who hold a card, and the Venue's staff using the till.
• Personal data: card identifiers; stamps, balance and rewards; stamp, credit and redemption history with dates and amounts; offers choices; Square customer reference and payment amounts; staff device sessions.
• Special category data: none.

3. Recouper's obligations

Recouper will:

• Process the data only on the Venue's documented instructions, which are these terms and the Venue's use of the app, unless the law requires otherwise, and tell the Venue if it thinks an instruction breaks the law.
• Make sure everyone with access is bound by confidentiality.
• Take the security measures in section 5.
• Use sub-processors only as set out in section 6.
• Help the Venue answer requests from people exercising their data rights.
• Help the Venue with security, breach notification, impact assessments and consultation with the ICO, taking into account the information Recouper has.
• Delete or return the data when the agreement ends, as set out in section 9.
• Give the Venue the information needed to show compliance, and allow audits as set out in section 8.

4. The Venue's obligations

The Venue confirms it has a lawful basis for the processing and has given its customers the required privacy information. It will keep the staff PIN secure and change it when staff who know it leave.

5. Security measures

• All traffic encrypted in transit
• Passwords and session tokens stored only as hashes; Square access tokens encrypted at rest
• Database access limited to Recouper's authorised people, with strong unique credentials
• Limits on repeated PIN and one-time code guesses
• Regular backups by the hosting provider
• Each Venue's data kept apart, so one Venue cannot see another's customers

6. Sub-processors

The Venue gives general authorisation for the sub-processors below. Recouper will give at least 30 days' notice of a new one, and the Venue may object and end the agreement if the objection cannot be resolved. Recouper will put equivalent data protection terms in place with each sub-processor and stays responsible for them.

If the Venue connects its own Square account, Square processes payment data under the Venue's own contract with Square, not as Recouper's sub-processor.

7. Personal data breaches

Recouper will tell the Venue without undue delay, and in any case within 48 hours, after becoming aware of a breach affecting the Venue's data. It will give the information the Venue needs to meet its own 72-hour duty to report to the ICO.

8. Audits

Recouper will answer reasonable written questions about its compliance. On-site or third-party audits are limited to once a year, at the Venue's cost, with 30 days' notice, unless a breach has occurred.

9. End of the agreement

For 30 days after the agreement ends, the Venue can ask for a copy of its scheme data. Recouper then deletes it within a further 60 days, except where the law requires it to be kept. Records kept for accounting are kept with links to customers removed.

10. International transfers

Recouper will transfer data outside the UK only with a safeguard recognised under UK law, such as adequacy regulations (which cover the EU and certified US providers) or the International Data Transfer Addendum.

11. Liability and order of precedence

Liability under this agreement is subject to the limits in the venue terms. If this agreement and the venue terms conflict on data protection, this agreement wins.

12. Aggregated and de-identified data

The Venue instructs and permits Recouper to create aggregated, de-identified data from the scheme data, for example visit frequency, reward redemption rates and offer performance, combined across venues. Recouper will remove anything that identifies a customer or the Venue before using it. Recouper may use this data to run, improve and develop its services, to produce benchmarks and insights for venues, and for its own business purposes, and is the controller of it once de-identified. Recouper will not try to re-identify anyone from it.

13. Messages to customers

The Venue instructs Recouper to send its customers service messages about their cards, such as a reward being ready or a card about to expire, and, only to customers who have opted in to that Venue's offers, the offers and news the Venue writes. Recouper records each customer's choice, includes an unsubscribe link in every marketing message, and limits how many marketing messages each Venue can send a week. The Venue is responsible for what its offers say and for following advertising rules, including not marketing alcohol to anyone under 18. Customer email addresses are not shared with the Venue.