Data processing agreement

1.Parties

• The business that has a Usuals account: the controller (you).
• [statutaire naam], registered with the Dutch Chamber of Commerce (KvK) under number [KvK-nummer], located at [straat en huisnummer], [postcode en plaats]: the processor (Usuals).

Terms such as personal data, processing, data subject, sub-processor and personal data breach have the meaning given to them in the General Data Protection Regulation (GDPR).

2.Subject matter and duration

Usuals processes your customers' personal data to provide the service described in the terms of service: digital loyalty cards in Apple Wallet and Google Wallet, with the scanner, messages, reports and the AI assistant.

This agreement runs as long as your account exists, and after that until Usuals has deleted all personal data as described in article 12.

3.Nature and purpose of the processing

Usuals only processes the data for these purposes:

• creating cards, adding them to the Wallet and updating them;
• recording stamps, rewards and visits;
• sending messages you set up or send, only to customers who consented to them;
• creating reports, customer groups and exports for you;
• pseudonymised analysis by the AI assistant, on the paid plans;
• letting your customers view and delete their own data;
• support, security and preventing abuse.

Usuals does not use the data for its own purposes, does not sell it and does not contact your customers on its own initiative.

4.Data subjects and personal data

Usuals is not meant for special categories of personal data, such as health data. You don't put such data in card names, rewards or messages.

5.Processing on your instructions

Usuals only processes the data on your documented instructions. Your instructions are this agreement and what you set up and do in the dashboard, the scanner and the app. If Usuals believes an instruction breaches the GDPR, we tell you right away.

If Usuals is required by law to disclose data, for example to a public authority, we tell you in advance, unless the law forbids it.

6.Confidentiality

Everyone at Usuals with access to the data is bound to confidentiality. Our support team only looks into your account when that is needed for support or security. This is recorded in your account's log.

7.Security

Usuals takes appropriate technical and organisational measures as referred to in Article 32 GDPR. These include at least:

• encrypted connections (TLS) for all traffic;
• storage with providers in the EU, in encrypted storage;
• data separated per business, with access per role (owner or staff);
• passwords stored only as a hash, and sessions that expire;
• QR codes holding a signed code instead of a customer number;
• limits on sign up, login and scanning;
• a log of important actions, including access by support;
• pseudonymisation of data sent to the AI assistant;
• backups, regular updates and access for as few people as possible;
• no real customer data in test and development environments.

Usuals may change these measures where needed, as long as the level of security does not go down.

8.Sub-processors

You give Usuals general authorisation to engage sub-processors. These are the current sub-processors:

Usuals imposes at least the same obligations on sub-processors as in this agreement, and remains responsible to you for their work. We tell you about a new or replacement sub-processor at least 30 days in advance. If you have a reasonable ground to object, we look for a solution together. If that doesn't work out, you can end the agreement.

9.Transfers outside the EEA

Usuals only transfers personal data to countries outside the European Economic Area with appropriate safeguards: an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework, or standard contractual clauses with additional measures where needed.

10.Data breaches

If Usuals discovers a personal data breach affecting your data, we tell you without undue delay, and no later than 48 hours after discovering it. That way you can notify the Autoriteit Persoonsgegevens within 72 hours yourself if needed.

We give you what we know about:

• the nature of the breach and when it happened;
• the types of data and the estimated number of data subjects;
• the likely consequences;
• the measures we have taken or propose;
• a contact person for more information.

We help you with a notification to the supervisory authority or to data subjects, and keep a record of all breaches.

11.Data subject rights and other assistance

Your customers see and delete their data themselves through the link on their card. If Usuals receives another request from a data subject, we forward it to you without undue delay and help you handle it within the legal deadline.

Usuals also helps you, as far as reasonable, with a data protection impact assessment (DPIA) and with questions from the Autoriteit Persoonsgegevens.

12.Return and deletion

As long as your account exists, you export your customers' data as CSV. After the agreement ends, Usuals deletes all personal data within 30 days, unless the law requires us to keep it longer. Backups are overwritten within 35 days after that. On request we confirm the deletion in writing.

13.Audit

On request Usuals gives you the information needed to show that we comply with this agreement. You may have an audit carried out at most once a year by an independent expert bound to confidentiality. You give at least 30 days' notice and bear the costs. If the audit shows we don't comply with this agreement, we fix it at our own cost.

14.Liability

Liability under this agreement follows the arrangements in the terms of service. In addition, each of us is liable as set out in Article 82 GDPR.

15.Final provisions

Where this agreement and the terms of service conflict on the processing of personal data, this agreement prevails. This agreement is governed by Dutch law. We tell you about changes at least 30 days in advance, unless they are needed to comply with the law.

This agreement is also available in Dutch. Where the versions differ, the Dutch text applies.