Data Processing Agreement (DPA)

Last Updated: 2026-06-02

This Data Processing Agreement (“DPA”) supplements the Terms of Service between Pokesuta (“Data Processor”) and the Merchant (“Data Controller”).

1. Roles of the Parties

In the context of the End-Consumer data processed by our platform, the Merchant is the Data Controller (who determines the purpose and means of processing) and Pokesuta is the Data Processor (who processes the data on behalf of the Controller).

2. Details of Processing

• Subject Matter: Processing data to issue, manage, and track Apple Wallet and Google Wallet digital passes.
• Duration: For the duration of the Merchant’s active subscription or until data deletion is requested.
• Nature and Purpose: To deliver loyalty and marketing features (stamps, coupons, push notifications) as configured by the Merchant.
• Categories of Data: Names, email addresses, pass UUIDs, scan history, and redemption metrics.
• Data Subjects: End-Consumers (customers of the Merchant).

3. Obligations of the Processor (Pokesuta)

• We will only process personal data on documented instructions from the Merchant, unless required by law.
• We ensure that persons authorized to process the data have committed themselves to confidentiality.
• We will take all required technical and organizational security measures (e.g., encryption at rest and in transit) to protect the data.
• We will assist the Merchant in responding to End-Consumer requests exercising their privacy rights (e.g., Right to Access, Right to be Forgotten).
• Upon termination of the service, we will delete or return all personal data to the Merchant, unless legally required to retain it.

4. Sub-processors

The Merchant grants general authorization for Pokesuta to engage sub-processors (e.g., Google Cloud Platform, PostHog, Resend). We will ensure sub-processors are bound by similar data protection obligations.

5. Security Incidents

In the event of a personal data breach affecting End-Consumer data, Pokesuta will notify the Merchant without undue delay so the Merchant can fulfill its legal reporting obligations.