Data processing agreement

1. Parties and roles

This data processing agreement is between Karl Rizk, sole proprietor, referred to as "Grizzlee", and the Customer that accepted the terms of service. It forms part of those terms and applies whenever Grizzlee processes personal data contained in Customer data. Terms defined in the terms of service have the same meaning here.

The Customer is the controller of that personal data, or the organisation accountable for it under Canadian law. Grizzlee is its processor and service provider. Where the Customer is itself a processor for another business, Grizzlee is its subprocessor and the Customer passes on these commitments.

Grizzlee is the controller of team member account data, partner sign-in accounts, billing data and its own records, which the privacy policy covers. A partner's sign-in account can reach the programs of several Customers, so it is not Customer data. The partner's program information is.

2. Definitions and data protection laws

"Data protection laws" means the laws that apply to the processing, which can include Canada's Personal Information Protection and Electronic Documents Act, Quebec's Act respecting the protection of personal information in the private sector as amended by Law 25, other provincial private sector privacy laws, the EU General Data Protection Regulation, the UK General Data Protection Regulation and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and the California Consumer Privacy Act as amended by the California Privacy Rights Act, with other United States state privacy laws.

"Personal data" includes personal information as those laws define it. "Controller", "processor", "processing", "data subject" and "supervisory authority" have the meanings in the GDPR, and include the equivalent ideas in the other laws. "Standard Contractual Clauses" means the clauses the international transfers section incorporates.

3. Details of the processing

This section and the parties and roles section form Annex I of the Standard Contractual Clauses.

Parties

Data exporter: the Customer, with the contact details on its owner account. Its role is controller, or processor where it acts for another business. Data importer: Karl Rizk, sole proprietor, Montréal, Québec, Canada, contact privacy@grizzlee.ca. Its role is processor, or subprocessor. Both parties sign by accepting the terms of service.

Subject, duration and frequency

Providing the Service to the Customer, continuously, for as long as the terms of service apply, and afterwards until the data is deleted as the deletion and return section describes.

Nature and purpose

Storing, recording and calculating referrals, orders, refunds, rewards, payouts and loyalty activity; running the fraud and self-referral checks the Customer configures; sending emails and wallet pass updates; running the counter game; creating Stripe transfers and discount codes when the Customer instructs it; and delivering webhooks and API responses to the Customer, all on the Customer's instructions.

Data subjects

• The Customer's partners, affiliates and referrers.
• The Customer's end customers, including referred customers, buyers named in orders and people who follow referral links.
• The Customer's loyalty card holders and counter game players.
• The Customer's staff who use a loyalty scanner.

Categories of personal data

• Partners: name, email address, the Customer's ID for the partner, referral codes, labels, custom fields, language, Stripe connected account ID, rewards, payouts and their history, linked customers, and email delivery records with type, status and recipient address.
• End customers: the Customer's customer ID, display name, order email address, orders, amounts, refunds, the referring partner, referral link visit records with program, partner, channel and time, and Stripe customer, charge and invoice IDs.
• Complete order, charge, invoice and refund messages from the Customer's Stripe account or Shopify store, stored encrypted. These can include names, contact details and addresses.
• Keyed hashes of email addresses, phone numbers, payment card fingerprints, device IDs and IP addresses, used for fraud checks. They may also include keyed hashes Grizzlee records itself: the visitor's IP address and SDK device identifier on a referral link visit, the partner's IP address when a partner joins or opens the partner portal, the card fingerprint of the Stripe charge that paid an invoice, and the browser IP address on a Shopify order. Hashes on a referral link visit stay with the visit until a claim moves them to the customer, and unclaimed visits keep them with no expiry yet.
• Loyalty card holders and players: name, email address or phone number, birthday, language, marketing consent with its time and source, card, member code, balance, visits, rewards, game plays and prizes, messages sent to the card, a hash of the game's browser value, Apple Wallet device IDs and push tokens, and when a Google Wallet pass was saved or removed.
• Scanner staff: name, a salted hash of the PIN and the stamps or points each one gave.
• Activity records of changes to programs, rewards and payouts, and copies of the above in webhook payloads waiting for delivery to the Customer.

Special categories

The Service is not designed for health data, government identifiers, financial account numbers or other sensitive data, and none is intended to be transferred. The Customer must not send them.

Retention

For the term of the terms of service, then as the deletion and return section describes.

Competent supervisory authority

For the EU Standard Contractual Clauses, the supervisory authority of the EU member state where the Customer is established. A Customer not established in the EU uses the authority of the member state where its representative under Article 27 of the GDPR is established. For the UK, the Information Commissioner. For Switzerland, the Federal Data Protection and Information Commissioner.

4. Customer instructions

Grizzlee processes personal data only on the Customer's documented instructions, including about transfers of personal data to another country. The terms of service, this agreement, the Customer's settings and its use of the dashboard and API are those instructions. Grizzlee will tell the Customer promptly if it believes an instruction breaks data protection laws, and may decline to follow it.

Grizzlee may process personal data otherwise only where the law requires it, and will tell the Customer first unless the law forbids that. Grizzlee counts rewarded orders to bill the Customer and uses Customer data to secure the Service and detect abuse of it. It uses Customer data for no other purpose of its own.

5. Customer responsibilities

• Having a lawful basis and any consent needed for the processing, including consent for commercial electronic messages under Canada's Anti-Spam Legislation and similar laws for the emails and wallet messages Grizzlee sends for the Customer.
• Giving data subjects the privacy information the law requires, including that the Customer uses Grizzlee and the providers listed on the subprocessors page, and any notice or consent the law requires for the cookies, browser storage and device identifiers the Service uses for the Customer. This includes consent before Grizzlee's SDK stores a device identifier on a visitor's device, where e-privacy rules require it.
• Deciding whether the identity signals and fraud rules it uses are proportionate, and meeting the duties that apply to the automated decisions they make.
• Carrying out any privacy impact assessment the law requires of it, including before communicating personal information of Quebec residents outside Quebec.
• Answering requests from data subjects and authorities about its data.
• Keeping its own logins and API keys secure, and sending server API keys only from its servers.

6. Confidentiality of personnel

Grizzlee limits access to personal data to the personnel who need it to provide, secure or support the Service, and makes sure they are bound by confidentiality obligations that continue after their work ends.

7. Security measures

This section forms Annex II of the Standard Contractual Clauses. Grizzlee maintains at least these technical and organisational measures, reviews them at least once a year and after any significant change to the Service, and may replace them with measures that give the same or better protection:

Hosting and network

• The server and the PostgreSQL database run on Amazon Web Services in its Canada (Central) region.
• The database is not publicly accessible. It sits in private subnets and accepts connections only from the application server.
• The application server accepts public traffic on HTTP and HTTPS only. HTTP redirects to HTTPS. Administration uses AWS Systems Manager, with no public SSH access, and the server requires session tokens for its instance metadata.

Encryption

• Traffic to the Service uses TLS, with certificates managed by the web server, and HTTP Strict Transport Security.
• The application connects to the database over TLS and verifies the database certificate.
• The database, its automated backups and snapshots, and the server disk are encrypted at rest. Release files are stored encrypted in Amazon S3, which refuses requests without TLS.
• Stripe and Shopify credentials, stored order messages from those services, webhook signing secrets, tracking keys and Apple pass tokens are also encrypted in the database with AES-256-GCM, under a key kept in AWS Secrets Manager.
• Identity signals are stored only as HMAC-SHA256 hashes under a key derived for each company, so they cannot be compared across companies.

Access control

• Every person signs in with a verified email address. Each company is separate, and every request is checked against the company's membership.
• Team members have fixed roles: owner, admin, editor or viewer. Viewers can only read. Only owners can delete a company or grant the owner role.
• Server API keys carry scopes and optional expiry dates, are stored only as SHA-256 hashes and are shown once. The company comes from the key, never from the request body.
• The application uses a database role with no rights to change the schema. A separate role applies migrations.
• Inbound webhooks from Stripe and Shopify, and Google Wallet callbacks, are checked against their signatures. Outbound webhooks are signed with HMAC-SHA256.
• Public endpoints such as referral capture, card sign-up and scanner pairing are rate limited.

Resilience

• The database is backed up automatically each day, with backups kept for 14 days and deletion protection turned on.
• The Service currently runs on a single application server. It has no standby server and no availability commitment.

Data minimisation

• Referral link visits do not record the IP address or browser details in readable form. Any IP address, device identifier or card fingerprint recorded for fraud checks is kept on Grizzlee's servers only as a keyed hash.
• Wallet passes carry the card holder's first name only.
• Emails to partners are logged by type and status, without their content.

8. Subprocessors

The Customer gives Grizzlee general authorisation to use the subprocessors on the subprocessors page, which forms Annex III of the Standard Contractual Clauses. Grizzlee will bind each subprocessor by a written contract with data protection obligations no less protective than this agreement, and remains fully responsible to the Customer for its subprocessors' performance. On request, Grizzlee will give the Customer a copy of those data protection terms, with commercial details removed.

Grizzlee will notify the owner of each company by email at least 30 days before a new or replacement subprocessor starts processing personal data. If an urgent change is needed to keep the Service running or secure, Grizzlee will notify as soon as it can, and the objection period runs from that notice.

The Customer may object on reasonable data protection grounds within the notice period by writing to privacy@grizzlee.ca. The parties will discuss the objection in good faith. If they cannot resolve it, the Customer may end the terms of service and receive a refund of any prepaid fees for the period after termination.

9. International transfers

Grizzlee stores Customer data in Canada. Some subprocessors process it in other countries, as the subprocessors page shows, including the United States. The Customer authorises these transfers.

Adequacy

The European Commission, the United Kingdom and Switzerland recognise Canada as giving adequate protection for organisations subject to the Personal Information Protection and Electronic Documents Act. Those decisions cover transfers from those places to Grizzlee.

Standard Contractual Clauses

Where a transfer to Grizzlee of personal data protected by the EU GDPR, the UK GDPR or the Swiss Federal Act on Data Protection is not covered by an adequacy decision, the parties incorporate these clauses by reference:

• EU: the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914, Module Two where the Customer is a controller and Module Three where it is a processor. Clause 7 applies. Clause 9(a) uses Option 2, with the notice period in the subprocessors section. The optional wording in Clause 11(a) does not apply. Clause 13 follows Annex I. Clause 17 uses Option 1, and the law of Ireland governs. Under Clause 18(b), disputes go to the courts of Ireland.
• UK: the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner, version B1.0, in force from 21 March 2022. Tables 1 to 3 are completed with the information in this agreement. Under Table 4, either party may end the addendum as its Section 19 allows.
• Switzerland: the EU clauses above, with these changes. The Federal Data Protection and Information Commissioner is the competent supervisory authority for transfers governed by the Swiss Federal Act on Data Protection. References to the GDPR include that Act. "Member state" in Clause 18(c) does not prevent data subjects in Switzerland from bringing claims where they habitually live.

Onward transfers

Grizzlee transfers personal data to a subprocessor in a country without an adequacy decision only under the EU standard contractual clauses, with the UK addendum and Swiss changes where needed, or another safeguard data protection laws recognise, such as the subprocessor's certification under the EU-US Data Privacy Framework and its UK and Swiss extensions.

Quebec

For personal information of Quebec residents, Grizzlee will help the Customer complete the privacy impact assessment Quebec law requires before communicating information outside Quebec, by describing where and how the information is processed and protected.

10. Automated fraud decisions

The fraud and self-referral rules the Customer turns on can block a reward without human review. Grizzlee applies only the rules and settings the Customer chooses. For each decision, Grizzlee records which rules fired and which kinds of signal matched, and makes that record available in the dashboard and the API, so the Customer can tell the person affected what led to the decision and review it. The Customer is responsible for informing data subjects and for any human review the law requires.

11. Data subject requests

The Service lets the Customer handle most requests itself. It can read records through the dashboard and the API, export loyalty card holders, correct partner details, and erase a partner, customer or card holder from the dashboard or with the API.

If Grizzlee receives a request about Customer data directly, including a consumer request under the CCPA, it will send it to the Customer without undue delay and will not answer it except to say who to contact. Grizzlee will give reasonable help with requests the Service does not cover, including access, correction, deletion, portability, de-indexation and objection.

12. Personal data breaches

Grizzlee will notify the Customer without undue delay, and within 72 hours, after it confirms a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer data. This includes a confidentiality incident under Quebec law and a breach of security safeguards under federal Canadian law.

The notice will describe, as far as Grizzlee then knows, what happened, the categories and approximate number of people and records affected, the likely consequences, the steps taken or proposed, and a contact for more information. Grizzlee will update it as it learns more, take reasonable steps to contain the breach, and help the Customer notify authorities and individuals and keep its incident register. Notifying the Customer is not an admission of fault.

13. Assessments and consultations

Taking into account the nature of the processing and the information available to it, Grizzlee will help the Customer meet its obligations on security of processing, breach notification, data protection impact assessments, privacy impact assessments and prior consultation with authorities about the Service, as Articles 32 to 36 of the GDPR and the equivalent provisions of other data protection laws require. This agreement and the security measures section are Grizzlee's main help with security.

14. Deletion and return

Before ending the Service, the Customer can retrieve its data with the API and the loyalty card holder export. Records the dashboard does not export can be requested from support@grizzlee.ca. If the terms of service end without the owner deleting the company, the Customer can still export its data for 30 days, and Grizzlee then deletes the company as described below.

When a company is deleted, Grizzlee immediately turns off its keys, connections, webhooks, pages and emails and removes its team members. A background task then erases the personal data of every partner, customer and card holder. Erasure removes names, email addresses, phone numbers, birthdays, display names, identity signal hashes, written reasons about the person and the stored order messages linked to them.

Erasure keeps amounts, dates, statuses, the ledger, and the IDs that link records, including the Customer's own customer and partner IDs. Company deletion also keeps the company name, the encrypted connection credentials, and stored order messages from Stripe or Shopify that never matched a customer. Backups containing deleted data expire within 14 days, except a final snapshot kept if the database itself is removed.

On the Customer's written request to privacy@grizzlee.ca, Grizzlee will delete or anonymise these kept items within 30 days, except billing records and records the law requires it to keep, and will confirm in writing when it has done so.

15. Information and audits

Grizzlee will make available the information needed to show it meets this agreement and Article 28 of the GDPR, including answers to reasonable security questionnaires. If that is not enough, or an authority requires it, Grizzlee will allow and contribute to audits, including inspections, by the Customer or an independent auditor it mandates who is bound by confidentiality and is not a competitor of Grizzlee. Audits are limited to once a year unless an authority requires more, with 30 days' written notice, during business hours, at the Customer's cost, and in a way that does not expose other customers' data.

16. California and other US state laws

Where the CCPA or a similar state law applies, Grizzlee processes personal information only for these business purposes: hosting and storing Customer data; recording referrals, orders, refunds and loyalty activity; calculating, approving and reversing rewards and payouts; creating Stripe transfers and discount codes the Customer instructs; running the fraud and self-referral checks the Customer configures; sending partner emails, card links and wallet updates; running the counter game; delivering webhooks and API responses; providing support; and securing the Service and detecting abuse of it. Grizzlee:

• does not sell or share personal information,
• does not retain, use or disclose it for any purpose other than those business purposes, including any commercial purpose of its own,
• does not retain, use or disclose it outside the direct business relationship with the Customer,
• does not combine it with personal information from other sources or from other customers, except as those laws allow a service provider to do,
• will not try to re-identify any de-identified information it receives,
• complies with those laws and gives personal information the level of protection they require,
• will notify the Customer promptly if it can no longer meet those laws,
• lets the Customer take reasonable and appropriate steps to check that Grizzlee uses personal information consistently with the Customer's obligations, including through the information and audits section,
• lets the Customer, on notice, take reasonable and appropriate steps to stop and remediate unauthorised use,
• helps the Customer answer consumer requests as the data subject requests section describes,
• binds each subprocessor by a written contract with the same restrictions.

Grizzlee certifies that it understands and will follow these restrictions.

17. Liability and precedence

Each party's liability under this agreement is subject to the limits in the terms of service, to the extent data protection laws allow. If documents conflict, the Standard Contractual Clauses win where they apply, then this agreement on the processing of personal data, then an order form, then the terms of service.

18. Term and changes

This agreement lasts as long as Grizzlee processes Customer data. We may update it to reflect changes in law or in the Service, with the notice the terms of service require for material changes. Notices under this agreement go to the owner's email address and, from the Customer, to privacy@grizzlee.ca.