Data processing terms

1. Parties and roles

[Cafe legal name] (“Cafe”) decides why and how member data is processed and is the Data Fiduciary. [KaapiPass legal entity: TO BE FILLED] (“KaapiPass”) processes member data only on the Cafe's documented instructions and is the Data Processor.

2. Data and purpose

• Data: member name, mobile number, stamp and reward history, offer consent, notification subscription endpoints.
• Purpose: operating the Cafe's loyalty stamp card and, where the member opted in, sending the Cafe's offers.
• KaapiPass will not use member data for its own marketing, sell it or share it with advertisers.

3. Security

KaapiPass maintains reasonable security safeguards, including encryption of mobile numbers at rest, access control by role, audit logging and hosting in India for production.

4. Sub-processors

Hosting provider: [TO BE FILLED, India region]. Notification delivery uses the member's browser push service or Apple's push service, which receive no name or phone number. If the Cafe's members choose to add an Apple or Google Wallet pass, WalletWallet (Proof of Stake SRL, Romania, EU) creates and updates the pass; it receives the member's first name, member code, stamp count, the card code in the QR and the Cafe's branding and offers, never the phone number, and passes are deleted when the card is erased. If the Cafe asks KaapiPass to design its card from photos of the Cafe, those photos (the Cafe's own images, not member data) are sent once to Anthropic (Claude API, USA) to suggest colours and are then discarded; KaapiPass keeps only the colours. KaapiPass will tell the Cafe before adding a sub-processor.

5. Rights requests and consent

Members can view, export, correct and delete their data themselves. KaapiPass will help the Cafe with any other requests without undue delay.

6. Personal data breach

KaapiPass will tell the Cafe without undue delay, and in any case within [24] hours of becoming aware of a breach, with the information the Cafe needs to inform the Data Protection Board and affected members.

7. Retention and return

Member data is deleted after the Cafe's configured inactivity period. When the agreement ends, the Cafe can export its member list, after which KaapiPass deletes the Cafe's member data within [30] days, except where the law requires it to be kept.

8. Audit

The Cafe can ask for reasonable information showing these terms are being followed.