Data Processing Agreement

Last Updated: November 12th, 2026

Yollty S.A. · 74, rue du Canal, L-4051 Esch-sur-Alzette, Grand Duchy of Luxembourg · R.C.S. Luxembourg B205415

This Data Processing Agreement (the “DPA”) forms part of the Contract between Yollty and the Business Customer for the use of the Yollty Hub platform, as defined in Yollty’s General Terms and Conditions of Sale (the “Terms”). It sets out how Yollty processes personal data on behalf of the Business Customer, as required by Article 28 of the General Data Protection Regulation.

Parties

  • The Business Customer, as identified during the online sign-up or in the subscription application form, acting as data controller (the “Controller”).
  • Yollty S.A., a société anonyme governed by Luxembourg law, with its registered office at 74, rue du Canal, L-4051 Esch-sur-Alzette, Grand Duchy of Luxembourg, registered with the R.C.S. Luxembourg under number B205415, acting as data processor (the “Processor”).

Definitions

Terms not defined in this DPA have the meaning given to them in the Terms or in the GDPR.

  • “GDPR” means Regulation (EU) 2016/679 and, where applicable, the UK GDPR and the UK Data Protection Act 2018.
  • “Data Protection Laws” means the GDPR and any other data protection or privacy law applicable to the processing under this DPA, including laws implementing the ePrivacy Directive.
  • “Hub Customer Data” means the personal data of End Customers collected through or imported into Yollty Hub, as described in Annex 1.
  • “End Customers” means the customers of the Business Customer and any other individuals whose personal data is processed through Yollty Hub.
  • “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Hub Customer Data.
  • “Subprocessor” means any third party engaged by Yollty to process Hub Customer Data on its behalf.

This DPA applies only to Yollty Hub. It does not apply to the Yollty Classic platform, for which Article 22.2.1 of the Terms applies.

1. Roles of the parties

1.1. The Business Customer is the controller of Hub Customer Data and Yollty is its processor.

1.2. The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are described in Annex 1.

1.3. Yollty acts as an independent controller, and not as processor, for: (a) the account, contact and billing data of the Business Customer and of its users of the dashboard; (b) usage, support and security data relating to the operation of Yollty Hub, such as access logs and error reports; and (c) aggregated data from which no End Customer can be identified, which Yollty may use to operate, secure and improve Yollty Hub. Yollty’s privacy policy describes this processing.

2. Instructions

2.1. Yollty processes Hub Customer Data only on the documented instructions of the Business Customer, including with regard to transfers of personal data to a third country, unless required to do so by EU or Member State law. In that case, Yollty will inform the Business Customer of that legal requirement before processing, unless the law prohibits it.

2.2. The Terms, this DPA and the Business Customer’s use and configuration of Yollty Hub (including its settings, campaigns, automations and segments) constitute the Business Customer’s complete instructions.

2.3. Yollty will inform the Business Customer immediately if, in its opinion, an instruction infringes Data Protection Laws.

3. Confidentiality

Yollty ensures that all persons authorised to process Hub Customer Data are bound by an obligation of confidentiality and only access it to the extent needed to provide the Yollty Services.

4. Security

4.1. Yollty implements appropriate technical and organisational measures to protect Hub Customer Data, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing. These measures are described in Annex 2.

4.2. Yollty may update these measures over time, provided that they continue to ensure a level of security appropriate to the risk, as required by Article 32 of the GDPR.

5. Subprocessors

5.1. The Business Customer gives Yollty general authorisation to engage Subprocessors. The Subprocessors in use at the date of this DPA are listed in Annex 3.

5.2. Yollty will inform the Business Customer of any intended addition or replacement of a Subprocessor at least 30 days in advance, by email or through Yollty Hub. The Business Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Business Customer may terminate the Contract without any indemnity being due, and Yollty will refund any fees paid in advance for the period after termination.

5.3. Yollty imposes on each Subprocessor, by written contract, data protection obligations that provide at least the same level of protection as this DPA (which may be the Subprocessor’s standard data processing terms), and remains fully liable to the Business Customer for the performance of its Subprocessors, subject to Clause 13.

5.4. Services that the Business Customer chooses to connect to Yollty Hub, such as its point-of-sale system (for example Square, Loyverse or Epos Now), its Google Business Profile or its own domain name provider, are not Subprocessors. Yollty exchanges Hub Customer Data with these services on the Business Customer’s instruction when the Business Customer enables the connection, and the Business Customer’s own agreement with the provider governs the provider’s processing. Likewise, where a Subprocessor listed in Annex 3 also processes Hub Customer Data as an independent controller, for example Google or Apple once an End Customer has saved a pass to their Google Wallet or Apple Wallet, that part of its processing is governed by the provider’s own terms with the End Customer, such as the terms of their Apple or Google account, and is not carried out on behalf of Yollty or the Business Customer.

6. International transfers

6.1. Yollty stores Hub Customer Data in the European Union (Google Cloud, Belgium region). Some Subprocessors listed in Annex 3 process limited Hub Customer Data outside the European Economic Area, as described there.

6.2. Where Hub Customer Data is transferred to a country outside the European Economic Area or the United Kingdom that is not covered by an adequacy decision, Yollty ensures that the transfer is protected by appropriate safeguards, such as the European Commission’s Standard Contractual Clauses (“SCCs”) and, for transfers from the United Kingdom, the UK International Data Transfer Addendum.

7. Data subject requests

7.1. Taking into account the nature of the processing, Yollty assists the Business Customer, through the features of Yollty Hub or otherwise, in responding to End Customers’ requests to exercise their rights of access, rectification, erasure, restriction, portability and objection.

7.2. Where Yollty Hub provides features that let End Customers exercise their rights themselves, such as changing their communication preferences or deleting their account, the Business Customer instructs Yollty to carry out these requests automatically through those features, as they are made available from time to time, and the result is shown in Yollty Hub. If Yollty receives any other request directly, it will forward it to the Business Customer without undue delay and will not respond itself, except to confirm that the request has been forwarded.

8. Personal Data Breaches

8.1. Yollty notifies the Business Customer without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting Hub Customer Data.

8.2. The notification will describe, as far as known at the time, the nature of the breach, the categories and approximate number of End Customers and records concerned, the likely consequences, and the measures taken or proposed. Yollty will provide further information as it becomes available.

8.3. Yollty takes reasonable steps to contain and remedy the breach, and assists the Business Customer in meeting its obligations to notify the supervisory authority and End Customers.

9. Assistance with compliance

Taking into account the nature of the processing and the information available to it, Yollty provides reasonable assistance to the Business Customer with its obligations under Articles 32 to 36 of the GDPR, including data protection impact assessments and prior consultations with supervisory authorities, where these relate to Yollty Hub.

10. Audits

10.1. Yollty makes available to the Business Customer, on written request, the information reasonably necessary to demonstrate compliance with Article 28 of the GDPR, in a form Yollty chooses, such as this DPA and its Annexes, a written summary of its security measures or answers to a security questionnaire. Yollty is not required to disclose information that is confidential, that concerns its other customers or that could put the security of Yollty Hub at risk. The Business Customer may make such a request no more than once per year, unless a Personal Data Breach has occurred.

10.2. Where this information is not sufficient, the Business Customer may carry out an audit, or have it carried out by an independent auditor bound by confidentiality, no more than once per year (unless a supervisory authority requires it, or the audit follows a Personal Data Breach), with at least 30 days’ written notice, during normal business hours and without disrupting Yollty’s operations. Each party bears its own costs, unless the audit reveals a material breach of this DPA by Yollty.

11. Return and deletion of data

11.1. On termination of the Contract, the Business Customer may export Hub Customer Data from Yollty Hub within 30 days.

11.2. After that period, Yollty deletes Hub Customer Data, including existing copies, unless EU or Member State law requires it to be kept. Backup copies are overwritten in line with Yollty’s backup cycle, and in any case within 30 days. Where the Business Customer deletes an End Customer during the Contract, Yollty keeps a one-way hash of that End Customer’s phone number, from which the number cannot be recovered, and uses it only to prevent fraud and abuse of the Business Customer’s programme and to protect the security of Yollty Hub, for example so that welcome benefits are not granted again if the same person registers again. The hash is deleted with the rest of the Hub Customer Data under this Clause.

12. Obligations of the Business Customer

12.1. The Business Customer is responsible for having a valid legal basis for processing Hub Customer Data. This includes obtaining End Customers’ consent before sending them marketing communications by email, SMS or push notification, and informing them as required by Data Protection Laws.

12.2. Where the Business Customer imports End Customers’ contact details into Yollty Hub, it warrants that these details were collected lawfully and that it holds a valid legal basis, including any consent required, to process them and to send these End Customers communications through Yollty Hub.

12.3. The Business Customer shall not use Yollty Hub to process special categories of personal data (such as health data) unless agreed in writing with Yollty.

12.4. The Business Customer designates a contact person for data protection matters when signing up, in Yollty Hub or by email to Yollty, and keeps this information up to date. Where it has appointed a Data Protection Officer, it provides their contact details.

12.5. Yollty makes available in Yollty Hub a default privacy notice for End Customers, issued in the Business Customer’s name. Unless the Business Customer provides its own privacy notice in Yollty Hub, the Business Customer adopts the default notice as its own, and Yollty shows it to End Customers in the app. The Business Customer remains responsible for checking that the notice it uses accurately describes its processing, in particular any processing of End Customers’ data outside Yollty Hub, and for keeping its details shown in the notice up to date.

13. Liability

Each party’s liability under this DPA is subject to the limitations and exclusions of liability set out in the Terms, to the extent permitted by Data Protection Laws.

14. Order of precedence

In the event of a conflict between this DPA and the Terms regarding the processing of Hub Customer Data, this DPA prevails.

15. Duration and governing law

15.1. This DPA takes effect on the date the Contract is concluded and remains in force for as long as Yollty processes Hub Customer Data on behalf of the Business Customer.

15.2. This DPA is governed by Luxembourg law. Any dispute is subject to the exclusive jurisdiction of the courts of Luxembourg.

15.3. Yollty’s contact for data protection matters is Alexandros Trepeklis ([email protected]).

Annex 1 – Description of the processing

  • Subject matter: provision of the Yollty Hub loyalty and customer engagement platform to the Business Customer.
  • Duration: the term of the Contract, plus the 30-day export period and the deletion period in Clause 11.
  • Nature and purpose: hosting and managing the Business Customer’s loyalty programme; registering End Customers; recording visits, purchases, points and rewards; issuing Google Wallet and Apple Wallet cards; collecting and managing End Customers’ consent and communication preferences; sending push notifications, emails and SMS on the Business Customer’s behalf; segmentation and automations; referrals; feedback and review requests; POS integrations; reporting and insights; promotions and fortune wheels; staff tablet check-in and redemption; phone and email verification.
  • Categories of data subjects: the Business Customer’s End Customers (loyalty members), including contacts imported by the Business Customer; the Business Customer’s staff, to the extent they are recorded against transactions, check-ins and redemptions.
  • Types of personal data: name; email address; phone number; date of birth, gender and profile photo (if collected); preferred language; loyalty card and wallet identifiers; visit and transaction history (date, store, amount, products purchased); points, tiers and rewards; vouchers, promotions and fortune-wheel results; consent and communication preferences, with the IP address and browser information recorded when consent is given; feedback and ratings; referral information; device identifiers for push notifications; messages sent and their delivery status; customer identifiers from connected point-of-sale systems; staff names and identifiers; any other personal data that the Business Customer chooses to collect or import through Yollty Hub, for example through custom member attributes or imported contact lists, subject to Clause 12.3.
  • Special categories of data: none, unless agreed in writing under Clause 12.3.
  • Frequency: continuous, for the duration of the Contract.

Annex 2 – Technical and organisational security measures

Yollty implements the following measures:

  • encryption of data in transit (TLS) and at rest (AES-256, managed by Google Cloud);
  • role-based access control, with access limited to authorised staff (including per-store access limits for dashboard users and a personal PIN for each staff tablet user);
  • logical separation of each Business Customer’s data (enforced in every database query by the application);
  • regular backups (daily automated database backups kept for 7 days, with point-in-time recovery);
  • logging and monitoring of access to production systems (Google Cloud audit logs; phone numbers and email addresses are masked or left out of application logs);
  • secure development practices and regular security updates (secrets are kept in a managed secret store, and signatures are verified on all incoming point-of-sale webhooks);
  • confidentiality commitments for staff and contractors;
  • a documented procedure for handling Personal Data Breaches.

Annex 3 – Subprocessors

  • Google Cloud EMEA Limited (Google Cloud Platform and Firebase) — Service: hosting, database, file storage, task scheduling and in-app notifications. Location: European Union (Belgium). Safeguard: not applicable (EU); Google Cloud Data Processing Addendum, with SCCs for any access from outside the EEA.
  • ActiveCampaign, LLC (Postmark) — Service: sending emails. Location: United States. Safeguard: EU–US Data Privacy Framework; SCCs (Postmark Data Processing Addendum).
  • Twilio Inc. — Service: sending SMS and phone verification codes. Location: United States. Safeguard: EU–US Data Privacy Framework; Twilio Binding Corporate Rules; SCCs (Twilio Data Protection Addendum).
  • Google LLC (Firebase Cloud Messaging) — Service: sending push notifications. Location: United States and other Google locations. Safeguard: EU–US Data Privacy Framework; SCCs (Google Cloud Data Processing Addendum).
  • Google LLC (Google Wallet API) — Service: Google Wallet passes. Location: United States and other Google locations. Safeguard: EU–US Data Privacy Framework.
  • Apple Inc. (Apple Push Notification service) — Service: Apple Wallet pass updates (device push tokens only; the pass itself is downloaded directly from Yollty). Location: United States. Safeguard: necessary to perform the Business Customer’s loyalty programme for the End Customer, who chose to add its pass to Apple Wallet (Article 49(1)(b) GDPR); device push tokens only.
  • Google LLC (Firebase Authentication) — Service: signing in End Customers and dashboard users. Location: United States and other Google locations. Safeguard: EU–US Data Privacy Framework; SCCs (Google Cloud Data Processing Addendum).
  • Functional Software, Inc. (Sentry) — Service: error monitoring for the app, dashboard and staff tablet. Location: European Union (Germany). Safeguard: not applicable (EU); EU–US Data Privacy Framework and SCCs (Sentry Data Processing Addendum) for access from the United States.
  • Ably Realtime Ltd (Ably) — Service: real-time updates to the dashboard and staff tablet. Location: United Kingdom; processing worldwide on Amazon Web Services. Safeguard: UK adequacy decision; SCCs (Ably Data Processing Addendum).