Data Processing Agreement

This Data Processing Agreement ("DPA") is intended to form part of the Terms of Service between the provider of Iseka Loyalty ("Processor", "we") and each business using the Service ("Controller", "you"). It applies where we process personal data of your loyalty customers on your behalf, and is intended to meet Article 28 of the UK GDPR.

The Service is provided by Yeskendir Zharimbet, trading as Iseka Loyalty (a sole trader — Iseka Loyalty is a trading name, not a separate legal entity or registered company). Service address for legal notices: Discovery, 50 Waterline Way, London, SE8 3NB, United Kingdom. Until the processing details marked [TO CONFIRM] in this document are verified and legal review and approval are complete, this DPA is a draft for review only and is not incorporated into any contract.

1. Subject matter, duration, nature and purpose

• Subject matter: processing of loyalty-programme customer data through the Iseka Loyalty platform.
• Duration: for the term of your subscription, plus the deletion period in section 8.
• Nature and purpose: hosting, storing and transmitting loyalty card data so you can run your programme — enrolment, stamp recording, reward issuance and redemption, optional Apple Wallet passes, and programme analytics shown to you.
• Data subjects: your loyalty customers (members of the public who join your programme).
• Categories of data: card identifiers and stamp/reward history; optional contact details (name, email, phone) and sign-up form answers, only where your form asks for them; marketing opt-in status. The platform is not designed for special-category data and you must not collect it.

2. Documented instructions

We process customer data only on your documented instructions: providing the Service as configured by you, plus actions you initiate (such as anonymising a member). If we believe an instruction infringes data protection law, we will tell you.

3. Confidentiality

Access to customer data is limited to persons bound by confidentiality obligations and granted only where needed to operate or support the Service.

4. Security measures

We maintain technical and organisational measures including:

• Database-enforced row-level security: each business's data is isolated, and all changes go through server-side, audited operations — client code cannot write loyalty data directly.
• Customer card access via unguessable secret links; only a hash of the secret is stored.
• Staff actions (stamps, redemptions, data changes) recorded in an audit log.
• HTTPS encryption in transit. No independently verified provider security certification is claimed in this draft.
• Rate limiting and failed-lookup counting on scanner endpoints to resist card-code guessing.

5. Subprocessors

You authorise the subprocessors listed below. We will give at least 14 days' notice of any intended new subprocessor by email or dashboard notice, and you may object on reasonable data-protection grounds within that period; if we cannot accommodate the objection, you may terminate.

We remain responsible for each subprocessor's performance of its data-protection obligations and will flow down terms no less protective than this DPA.

6. Data subject rights and controller assistance

Taking into account the nature of the processing, we will help you respond to data subject requests (access, rectification, erasure, restriction, portability, objection). The dashboard lets you view, correct and anonymise member records yourself; for anything else, contact us at isekaagency@gmail.com.

7. Personal data breaches

We will notify you without undue delay after becoming aware of a personal data breach affecting your customer data, with the information reasonably available to help you meet your own notification duties. Breach contact: isekaagency@gmail.com.

8. Deletion and return

The intended obligation on request or at the end of the subscription is to return or delete your customer data as you choose, subject to legal retention duties. Member anonymisation is available self-service. [TO CONFIRM — end-of-subscription return/deletion process and timetable have not been operationally verified] Residual backup expiry and deletion must be verified with the provider; no deletion deadline is confirmed. [TO CONFIRM — backup retention window]

The operator confirms daily database backups. A restore test has not been verified; daily snapshots do not establish a guaranteed recovery time or an individual-record backup-erasure deadline.

9. Audits and information

We will make available the information reasonably necessary to demonstrate compliance with this DPA and allow for audits, subject to reasonable notice, confidentiality, and each party bearing its own costs.

10. International transfers

Where processing involves a transfer outside the UK, it will be covered by an adequacy regulation, the UK IDTA or UK addendum to EU standard contractual clauses, or another lawful safeguard. [TO CONFIRM — per-provider mechanism once data regions are verified]

11. Precedence and law

If this DPA conflicts with the Terms of Service, this DPA prevails for data-protection matters. This DPA is governed by the same law and jurisdiction as the Terms of Service.

Annex A — Processing details (Article 28(3))