Data Processing Agreement

1. Scope

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Saira SAS, operating Rewards ("Rewards", the "Processor"), and the customer using the Services (the "Customer", the "Controller").

It applies whenever Rewards processes personal data on behalf of the Customer in the course of providing the Services, as required by Article 28 of Regulation (EU) 2016/679 ("GDPR"). It does not cover the personal data of the Customer's own account users, which Rewards processes as a controller under its Privacy Policy.

2. Details of the processing

• Subject matter and purpose: running the Customer's loyalty programs: recording points and events, computing leaderboards, badges and automations, preparing and delivering reward campaigns.
• Data subjects: the Customer's end users (members of its community or program).
• Categories of data: public wallet addresses and ENS names, points and event history, badges, reward allocations and claim status, gift-card codes assigned to a wallet, and any other data the Customer chooses to send through the Services.
• Special categories: none. The Customer must not send special categories of personal data.
• Duration: the term of the Customer's use of the Services, then until deletion under section 9.

3. Instructions

Rewards processes personal data only on the documented instructions of the Customer, which are the Terms, this DPA and the Customer's use and configuration of the Services. Rewards will inform the Customer if, in its opinion, an instruction infringes applicable data protection law.

4. Confidentiality and security

Persons authorised to process personal data are bound by confidentiality. Rewards implements appropriate technical and organisational measures, including:

• Encryption in transit (TLS) and at rest, and application-level encryption of gift-card codes once a campaign is published
• Access control by role within each program, hashed API keys and scoped OAuth access
• Rate limiting, audit logs of changes and API access, and error monitoring
• Backups and restricted production access

5. Sub-processors

The Customer authorises Rewards to use the sub-processors listed below. Rewards imposes on them data protection obligations equivalent to this DPA and remains liable for their performance. Rewards will announce any new sub-processor at least 30 days in advance by email; the Customer may object on reasonable grounds and, failing an agreement, terminate the affected Services.

6. International transfers

Where personal data is transferred outside the European Economic Area, Rewards ensures the transfer is covered by an adequacy decision (including the EU-US Data Privacy Framework for certified recipients) or by the Standard Contractual Clauses adopted by the European Commission.

7. Assistance

Taking into account the nature of the processing, Rewards assists the Customer in responding to requests from data subjects (the Services let the Customer find, export and remove a wallet's data), and in its obligations regarding security, impact assessments and prior consultation. Data recorded on public blockchains by the Customer's campaigns cannot be altered or erased by Rewards.

8. Personal data breaches

Rewards notifies the Customer without undue delay, and where feasible within 48 hours, after becoming aware of a personal data breach affecting the Customer's data, with the information available to help the Customer meet its own notification obligations.

9. Deletion and return

When the Customer deletes its account, Rewards deletes the Customer's personal data within 90 days, unless storage is required by law. Before that, the Customer can export its data from the Services or on request.

10. Audits

Rewards makes available the information necessary to demonstrate compliance with this DPA. The Customer may, at its own cost and once a year, request an audit with 30 days' written notice, carried out by an independent auditor bound by confidentiality, during business hours and without disrupting the Services.

11. Contact

For questions about this DPA or to sign a countersigned copy, contact:

hello@rewards.so

Saira SAS
173 rue de Courcelles
75017 Paris
France