Data Processing Agreement (DPA)

1.1 Parties to this Agreement:

• "Data Controller" or "Customer" - You, the business using Stampier's services to manage customer loyalty programs
• "Data Processor" or "Stampier" - Terrene Tech (Stampier), providing the loyalty platform services

1.2 Purpose and Scope:

This DPA governs Stampier's processing of personal data on behalf of the Customer in connection with the Stampier loyalty platform services ("Services"). This DPA applies when the Customer uses Stampier to process personal data of end customers participating in loyalty programs.

1.3 Data Processing Relationship:

• The Customer acts as the Data Controller - determining the purposes and means of processing end customer data
• Stampier acts as the Data Processor - processing data only on documented instructions from the Customer
• This DPA incorporates GDPR Article 28 requirements and EU Standard Contractual Clauses

1.4 Data Storage Location:

2.1 Nature and Purpose of Processing:

2.2 Types of Personal Data Processed:

• Identity Data: Name, email address, phone number (if provided)
• Loyalty Program Data: Stamp collection records, reward redemptions, enrollment dates
• Transaction Data: QR code scans, visit timestamps, program activity
• Technical Data: Device information, IP address (for security purposes only)
• Note: Stampier does NOT process payment card data - all payments are handled by our sub-processor (Stripe)

2.3 Processing Instructions:

Stampier shall process personal data only on documented instructions from the Customer, including:

• Instructions provided through the Stampier platform interface
• These Terms and Conditions and this DPA
• Written instructions sent to legal@stampier.co
• Stampier will inform Customer if, in its opinion, an instruction violates GDPR or other EU/Member State data protection laws

3.1 Security Obligations (GDPR Article 32):

Stampier implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

3.2 Data Retention and Deletion:

• Active data retained for duration of Customer subscription
• Upon subscription termination: data retained for 90 days for potential reactivation
• After 90 days: secure deletion of all personal data unless legal retention required
• Customer may request immediate deletion by contacting privacy@stampier.co
• Deletion method: Secure overwrite using industry-standard protocols

3.3 Testing and Certification:

• Regular security vulnerability assessments
• Penetration testing (annually or after major changes)
• Compliance certifications: ISO 27001, SOC 2 Type II (in progress)

4.1 Authorized Sub-Processors:

The Customer authorizes Stampier to engage the following sub-processors to assist in providing the Services:

4.2 Sub-Processor Obligations:

• Stampier imposes data protection obligations on sub-processors equivalent to those in this DPA
• All sub-processors are contractually bound to comply with GDPR and this DPA
• Stampier remains fully liable to Customer for sub-processor performance

4.3 Changes to Sub-Processors:

To receive sub-processor change notifications, subscribe at: legal@stampier.co

5.1 Customer Responsibility:

As the Data Controller, Customer is responsible for responding to data subject requests. Stampier will provide reasonable assistance to help Customer fulfill its obligations under GDPR Articles 12-23.

5.2 Stampier Assistance:

Stampier will assist Customer in fulfilling the following data subject rights:

5.3 Request Process:

• Customer forwards data subject requests to dpo@stampier.co
• Stampier responds within 48 hours with requested assistance
• Stampier may charge reasonable fees for excessive or repetitive requests

6.1 Breach Notification Obligation (GDPR Article 33):

Stampier shall notify Customer without undue delay and in any event within 24 hours after becoming aware of a personal data breach affecting Customer's data.

6.2 Breach Notification Content:

Stampier's breach notification will include (to the extent known):

• Nature of the breach (type of data, number of data subjects affected)
• Name and contact details of Stampier's Data Protection Officer
• Likely consequences of the breach
• Measures taken or proposed to address the breach and mitigate harm
• Recommended actions for Customer to take

6.3 72-Hour Supervisory Authority Notification:

6.4 Data Subject Notification:

If a breach is likely to result in a high risk to data subjects' rights and freedoms, Customer must notify affected data subjects without undue delay. Stampier will assist by providing:

• List of affected data subjects (if identifiable)
• Template notification text
• Technical details for data subject communications

6.5 Breach Response Procedure:

6.6 Emergency Contact:

For breach notifications and security incidents:

• Email: security@stampier.co (monitored 24/7)
• Phone: +91-XXXX-XXXXXX (emergency hotline - to be established)
• DPO: dpo@stampier.co

7.1 Primary Data Location:

7.2 Limited Third-Country Transfers:

Some sub-processors may transfer data outside the EU/EEA (e.g., Stripe to USA for payment processing). For such transfers, Stampier implements the following safeguards:

7.3 Transfer Impact Assessment:

Stampier has conducted a Transfer Impact Assessment (TIA) for all third-country transfers as required by GDPR and Schrems II case law. Key findings:

• Primary data remains in EU (Finland) - no systematic third-country transfers
• Limited transfers to USA (Stripe) protected by contractual and technical safeguards
• No government access requests received to date
• Encryption and access controls prevent unauthorized access by foreign authorities

7.4 Adequacy Decisions:

Where Stampier transfers data to countries with an EU adequacy decision, no additional safeguards are required. As of the effective date, no sub-processors are located in adequacy countries beyond the EU/EEA.

8.1 Audit Rights (GDPR Article 28(3)(h)):

Customer has the right to audit Stampier's compliance with this DPA and GDPR. Stampier offers the following audit options:

8.2 Audit Process:

1. Customer submits audit request to legal@stampier.co
2. Parties agree on audit scope, timing, and confidentiality terms
3. Customer (or appointed auditor) conducts audit remotely or on-site
4. Stampier provides reasonable assistance and access to relevant records
5. Audit findings shared with both parties; remediation plan agreed if needed

8.3 Audit Limitations:

• Audits must not disrupt Stampier's normal business operations
• Access to confidential/proprietary information subject to NDA
• Audits limited to data processing relevant to Customer's data only
• Third-party auditors must be approved by Stampier (approval not unreasonably withheld)

8.4 Compliance Documentation:

Stampier maintains records of processing activities as required by GDPR Article 30, including:

• Categories of processing activities
• Categories of data subjects and personal data
• Transfers to third countries and safeguards
• Technical and organizational security measures
• Data breach incident logs

9.1 Liability for GDPR Violations (Article 82):

Each party shall be liable for damages caused by its own violations of GDPR. Specifically:

• Customer Liability: Customer is liable for violations of its obligations as Data Controller (e.g., unlawful processing instructions, failure to respond to data subject requests)
• Stampier Liability: Stampier is liable for violations of its obligations as Data Processor (e.g., unauthorized processing, failure to implement security measures, unauthorized sub-processor engagement)
• Joint Liability: If both parties contributed to the same damage, they are jointly and severally liable, with the right to claim back from the other party the portion corresponding to their responsibility

9.2 Limitation of Liability:

9.3 Indemnification:

• By Stampier: Stampier will indemnify Customer against third-party claims arising from Stampier's breach of this DPA or GDPR obligations as Data Processor
• By Customer: Customer will indemnify Stampier against third-party claims arising from Customer's unlawful processing instructions or violations of GDPR as Data Controller

9.4 Regulatory Fines:

Each party is responsible for GDPR fines imposed by supervisory authorities due to its own violations. If a fine is imposed jointly, liability will be apportioned based on fault.

10.1 Term:

This DPA enters into force on the date Customer first uses Stampier Services to process personal data and remains in effect for the duration of the Services.

10.2 Effect of Service Termination:

Upon termination or expiration of the Services, Stampier shall (at Customer's choice):

10.3 Legal Retention:

Stampier may retain personal data to the extent required by applicable law (e.g., tax records, dispute resolution). Such retained data:

• Will be held securely and confidentially
• Will only be processed to the extent required by law
• Will be deleted when retention obligation expires

10.4 Survival:

The following provisions survive termination: Confidentiality (Section 3), Liability (Section 9), Audit rights (for 2 years post-termination), and any provisions required for legal compliance.

11.1 Relationship to Terms and Conditions:

This DPA is incorporated into and forms part of the Stampier Terms and Conditions. In case of conflict between this DPA and the Terms, this DPA prevails with respect to data protection matters.

11.2 Amendments:

Stampier may update this DPA to reflect changes in law or regulatory guidance. Material changes will be notified to Customer at least 30 days in advance. Continued use of Services after the effective date constitutes acceptance.

11.3 Severability:

If any provision of this DPA is held invalid or unenforceable, the remaining provisions remain in full force and effect. Invalid provisions will be replaced with valid provisions achieving the same economic purpose.

11.4 Governing Law and Jurisdiction:

• EU Customers: Law of EU Member State where Customer is established; courts of that Member State have jurisdiction
• UK Customers: Laws of England and Wales (or Scotland/Northern Ireland); UK courts have jurisdiction
• Other Customers: Indian law governs; courts of Sambhal, Uttar Pradesh, India have jurisdiction

11.5 Order of Precedence:

In case of conflict, the following order applies:

1. EU Standard Contractual Clauses / UK IDTA (for international transfers)
2. This Data Processing Agreement
3. Stampier Terms and Conditions
4. Stampier Privacy Notice

11.6 Language:

This DPA is executed in English. If translated, the English version prevails in case of discrepancies.

11.7 Entire Agreement:

This DPA, together with the Terms and Conditions, constitutes the entire agreement between the parties regarding data processing and supersedes all prior agreements on this subject.