Data processing agreement

This agreement is concluded between the business that uses Fidelia (the “controller”, “you”) and Metadia Ltd, a company registered in England and Wales under company number 14573833, with its registered office at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom (the “processor”, “Fidelia”). It forms part of our terms and conditions and applies automatically as long as you use Fidelia. If this agreement and the terms conflict on the protection of personal data, this agreement prevails.

Words such as personal data, processing, controller, processor, sub-processor, data subject and personal data breach have the meaning given to them by the GDPR.

Fidelia processes personal data to run your digital loyalty programme: let customers join, create and update their cards in Apple Wallet, Google Wallet or on the web, record stamps, points, balances and rewards, send the messages you schedule, and give you the dashboard, statistics and export. The processing lasts as long as you use Fidelia, plus the period needed to delete the data after the end (see “End of the agreement”).

Fidelia does not process this data for its own purposes and does not sell, rent or use it for advertising.

Data subjects: your customers who join your loyalty programme (“card holders”), and your staff, to the extent their actions are recorded in your history of stamps.

• Identification: first name, and email address if the card holder gives it.
• Preferences and consents: language, date the terms were accepted, consent to receive news.
• Card data: random card number, type of wallet, technical identifiers of Apple devices that installed the card, status of the card.
• Loyalty history: stamps, points, balances, rewards, visits and VIP levels, with date, time, location and staff member of each action, and the notes you add when correcting a card.
• Messages: the content of the messages you send and to which cards they were delivered.
• Security: a salted hash of the IP address used to join, kept for one day.

No special categories of data (such as health data) are needed for the service. You must not enter such data in Fidelia, for example in names or correction notes.

• You determine the purposes of the processing and make sure it has a valid legal basis.
• You inform your customers about the processing, for example with a notice at the counter or on your website and by referring to our privacy policy.
• You only send news to customers who opted in, and keep the information you enter accurate.
• You give your instructions through the settings of the dashboard or in writing to hello@fidelia.se. Your use of Fidelia in line with the terms is your documented instruction.

Fidelia undertakes to:

• process personal data only on your documented instructions, including for transfers outside the EEA, unless the law requires otherwise; in that case we will inform you first, unless the law forbids it;
• tell you without delay if we believe an instruction infringes data protection law;
• ensure that everyone at Fidelia who has access to the data is bound by confidentiality and only accesses it when needed;
• apply the security measures described in this agreement;
• help you, taking into account the nature of the processing, to answer requests from data subjects and to meet your obligations on security, breach notification, impact assessments and prior consultation;
• make available the information needed to demonstrate compliance with Article 28 GDPR, and allow audits as described below.

• Hosting in the European Union (database in Frankfurt, Germany; websites in France).
• Encryption of data in transit (HTTPS/TLS) and at rest.
• Strict separation between businesses in the database itself (row-level security), so one business can never read another’s data.
• Role-based access: staff see only first names and the card they scan; only owners and managers see email addresses, history and export.
• Random card numbers of 128 bits; the barcode contains only that number.
• An append-only history: stamps and rewards cannot be edited or deleted, only reversed by a new recorded action.
• Passwords and PINs stored as hashes; secrets and signing keys kept outside the source code.
• Rate limits and cooldowns against abuse, regular backups, and access by our team limited to support and maintenance, with an individual account.

We may update these measures, provided the overall level of protection does not decrease.

You give Fidelia general authorisation to use sub-processors. Each one is bound by a written agreement with data protection obligations at least equivalent to this agreement, and Fidelia remains responsible towards you for their work. The current sub-processors are:

• Supabase, Inc.: database, authentication, file storage and server functions; data hosted in the EU (Frankfurt, Germany).
• o2switch SAS, France: hosting of the websites and of the app, and email server.
• Google Ireland Limited: cards in Google Wallet, for card holders who use it.
• Apple Inc. and Apple Distribution International Ltd.: update notifications for cards in Apple Wallet (technical push token only), for card holders who use it.
• Cloudflare, Inc.: domain name service and network protection.

Stripe processes payment data of the merchant only, not of card holders. We will inform you by email at least 30 days before adding or replacing a sub-processor. You can object on reasonable grounds within that period; if we cannot find a solution together, you can end the agreement before the change applies.

The data is hosted in the European Union. Where a sub-processor may access it from a country outside the European Economic Area, Fidelia ensures the transfer is protected by an adequacy decision, such as the EU–US Data Privacy Framework for certified companies, or by the standard contractual clauses of the European Commission, with additional measures where needed.

Fidelia is operated by Metadia Ltd, which is established in the United Kingdom. Access to the data by our team from the United Kingdom is covered by the European Commission’s adequacy decision for the United Kingdom.

Your dashboard lets you view a customer’s data and history, correct a card and delete a customer. Deleting removes the first name and email address at once, deactivates every card of that customer and keeps only an anonymous history.

If a data subject contacts Fidelia directly, we will forward the request to you without delay and will not answer it ourselves unless you ask us to. If you need more help, for example for an export, we will assist you within a reasonable time.

Fidelia notifies you without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting your data. The notification describes, as far as known, the nature of the breach, the data and number of people concerned, the likely consequences and the measures taken or proposed. We then keep you informed and help you notify the Swedish Authority for Privacy Protection (IMY) and the data subjects where required.

On request, we provide the information you need to check that we comply with this agreement, such as a description of our measures and of our sub-processors’ certifications. If that is not enough, you may have an audit carried out, at most once a year, with at least 30 days’ notice, by an independent auditor bound by confidentiality, during working hours and without disrupting the service. You bear its costs, unless it reveals a significant breach on our part. Audits by a supervisory authority are always possible.

When you close your account or the agreement ends, you can ask us to return your customers’ data in a common format (CSV). We then delete it within 30 days, unless the law requires us to keep it. Backups are overwritten within the following 30 days. On request, we confirm the deletion in writing.

The cards in your customers’ wallets are deactivated when the data is deleted.

The liability rules of our terms and conditions apply to this agreement, without limiting the rights of data subjects under the GDPR. This agreement is governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction. If the language versions of this agreement differ, the English version prevails.