Data protection agreement

This agreement sets out the terms on which we process personal data on behalf of a shop using the service. It forms part of the agreement between us and applies for as long as we process personal data on your behalf.

1. Who this is between

Valence Dynamics Ltd, company number 17479617, of 20 Beverley Gardens, Stanmore, England, HA7 2AD, which provides Valence Easy Loyalty ("Valence Dynamics", "we", "us", the processor), and the shop or business that has entered into an agreement to use Valence Easy Loyalty ("you", "your", the controller). Together, the parties.

If the main agreement ends, this one continues for as long as we retain or otherwise process personal data on your behalf.

2. Who decides what

2.1 You are the controller

You are the controller of the personal data relating to your customers that you provide to, or cause to be collected through, Valence Easy Loyalty. You decide why it is processed, what is collected, how the programme operates, what rewards, offers and earn rates are provided, which customers are enrolled, and which of your people have access to your console.

2.2 We are the processor

We process that data only to provide and operate the service, in accordance with your documented instructions and this agreement. We will not use it for our own independent purposes, including advertising or selling it to third parties.

2.3 Your instructions

Your documented instructions are this agreement, the main agreement between us, the configuration and settings you select within Valence Easy Loyalty, and other written instructions you give us from time to time. For ordinary use of the product, configuration through your console is your instruction and needs no separate written one.

If we believe an instruction would require us to breach applicable data protection law, we will tell you and may decline to carry it out until the position is resolved.

2.4 Our own processing

We may act as an independent controller where we process personal data for purposes we determine ourselves, including to comply with our own legal obligations, maintain the security and integrity of the service, manage our own business records and our contractual relationship with you, or establish, exercise or defend legal claims.

That processing is limited to what those purposes require. It does not extend to using your customers' data to market anything, to profile anybody, or to build any dataset outside your programme. This agreement covers our processing of your customer data as your processor.

3. What we process

4. What we will do

4.1 Process only on your instructions

Including instructions about transfers outside the United Kingdom, unless applicable law requires otherwise. Where it does, we will tell you before processing unless the law prohibits us from saying so.

4.2 Confidentiality

People authorised to process your customer data are subject to appropriate confidentiality obligations and have access only to the data and systems their role needs.

4.3 Security

We will implement appropriate technical and organisational measures designed to protect your customer data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. The principal measures currently implemented are in Annex 1.

4.4 Helping you answer your customers

We will provide reasonable assistance with requests from your customers exercising their rights. The product does most of this itself: a member can see what is held about them and close their account from their own app, and you can correct a member record from your console. Where a request cannot reasonably be completed through the product, we will help, taking into account the nature of the processing and the information available to us.

4.5 Helping you meet your own obligations

Taking into account the nature of the processing and the information available to us, we will provide reasonable assistance with security of processing, notification and management of personal data breaches, data protection impact assessments, and consultation with the Information Commissioner's Office where required.

You remain responsible for determining your lawful basis, deciding whether an impact assessment is required, and meeting your obligations as controller.

4.6 Personal data breaches

We will notify you without undue delay and, where reasonably practicable, within 24 hours of becoming aware of a personal data breach affecting your customer data. The notification will include, so far as known at the time:

• the nature of the breach;
• the categories of personal data affected;
• the categories and approximate number of individuals affected, where known;
• the likely consequences;
• the measures taken or proposed; and
• a contact point for further information.

We will provide further information as it becomes available.

4.7 Deletion or return

We will delete or return your customer data at the end of the service in accordance with clause 10, unless applicable law requires us to retain particular information.

4.8 Demonstrating compliance

We will make available the information reasonably necessary to demonstrate our compliance with this agreement, and allow audits in accordance with clause 9.

5. What you agree to

• That you have identified and documented an appropriate lawful basis for the processing carried out through your programme.
• That you have provided, or will provide, appropriate privacy information to your customers.
• That where you instruct us to send communications, you are responsible for having the necessary lawful basis and, where applicable, consent.
• To keep console access to people who need it, and to remove access promptly when somebody no longer needs it.
• Not to enter special category data into free text fields.
• To comply with any applicable requirements relating to children where your programme is likely to be accessed by them.

You remain responsible for the instructions you give us and for ensuring they comply with applicable law.

6. Others who help us

6.1 Authorised sub-processors

You give us general written authorisation to appoint the sub-processors in Annex 3, which is the authoritative schedule. We will notify you at least 30 days before adding or replacing one.

You may object on reasonable data protection grounds. If you do, we will work with you in good faith to address it. If it cannot reasonably be resolved, either party may terminate the affected service or agreement in accordance with the main agreement, with no additional termination charge arising solely from the objection.

6.2 Sub-processor obligations

We will enter into a written agreement with each sub-processor requiring appropriate technical and organisational measures and compliance with data protection obligations appropriate to the processing it performs for us. We remain responsible to you for their performance.

6.3 Your own systems

Square, Shopify and Toast are systems you operate or control. They are not our sub-processors merely because Valence Easy Loyalty receives data from them.

Where we send information to one of them at your instruction, we send only what the action requires. For example, creating a discount code in your Shopify shop at a member's request sends what is needed to create the reward, and does not send the member's personal details unless the integration specifically requires it and you have instructed us to do so.

6.4 Your customers' own browsers

Where a member switches on notifications, the notification is delivered through the push service their own browser has chosen, which for most browsers is operated by Google, Apple or Mozilla and may be outside the United Kingdom. These are not our sub-processors: the member's browser selects them, not us.

The message we send them carries no content. It is an empty, signed request, and the words a member sees are fetched by their own device from us afterwards. No personal data about a member is transmitted to a push service.

7. Where the data is

We store and process customer programme data using the locations and providers identified in Annex 3.

Where processing is carried out within the European Economic Area, transfers from the United Kingdom to the EEA are permitted under the United Kingdom's adequacy regulations.

Some providers may process limited personal data from or in countries outside the United Kingdom or EEA as part of providing their services. Where applicable law requires an approved transfer mechanism, we will put one in place before the relevant transfer takes place.

8. How long it is kept

Retention is applied by the product and its deletion processes, rather than by a policy somebody has to remember. The current principal periods are:

• Points and transaction ledger entries: six years from the relevant sale or transaction date.
• Change history: two years.
• Invitation records: ninety days.
• Other active member account data: for as long as the member remains enrolled, unless a shorter period is required by law.

The six year period is a retention period selected by us for operational, reconciliation and record keeping purposes. It is not represented as a statutory requirement to retain loyalty data for six years.

Retention is currently uniform across all programmes and is not configurable per shop. If you need a different period, tell us and we will discuss it. Periods may be updated to reflect changes to the product, applicable law or our documented retention policy.

9. Audit

You may request the information reasonably necessary to demonstrate our compliance with this agreement. We will respond within 30 days, subject to the complexity and scope of the request.

You may audit our compliance, or appoint an independent auditor, on at least 30 days' written notice, during normal business hours and no more than once in any 12 month period, unless a personal data breach has occurred, a competent regulator requires an audit, or there are reasonable grounds to believe we are materially failing to comply.

An audit must be proportionate to the processing, avoid unnecessary disruption, protect the confidentiality and security of other customers' information, and not give the auditor access to another customer's personal data.

Where reasonably available, we may satisfy a request by providing policies, security information, test results, certifications or independent audit reports rather than direct access to systems. Your console also gives you the operational and change history information directly.

10. Leaving

10.1 Export

You may export your members and their points from your console without our assistance. The customer data is yours as controller.

10.2 Deletion after termination

When your agreement ends we retain your customer data for 30 days, so a programme closed by mistake can be restored. After that we delete it, unless you instruct us to return it instead, applicable law requires retention, or you have asked for immediate deletion.

10.3 Immediate deletion

You may ask for deletion before the end of the 30 days. We will delete within a reasonable period of your request, subject to any legal retention requirement.

10.4 Backups

Deleted customer data held in backups ages out through the normal backup lifecycle and is not restored except where necessary for disaster recovery. Our current backup retention period is seven days.

10.5 Legal retention

Where law requires us to retain particular information after termination, we will retain only what is required, continue to protect it, not process it for any other purpose except as required by law, and delete it when the requirement ends.

11. Liability and precedence

This agreement forms part of the main agreement between us, and the liability provisions and limits in that agreement apply to it unless applicable law requires otherwise.

If this agreement and the main agreement conflict on the processing or protection of personal data, this one takes precedence to the extent of the conflict. Nothing here limits or excludes any liability or obligation that cannot lawfully be limited or excluded.

Annex 1: technical and organisational measures

The principal measures implemented at the date of this agreement. They describe the controls the service uses and are not a complete description of the architecture.

1. Access control

• Named users with defined roles rather than shared passwords. The current roles are owner, manager and staff, with permissions appropriate to each.
• Access to administrative functions is restricted by role.
• Sign in uses one time codes or passkeys rather than reusable account passwords.
• WebAuthn credentials are stored as credential and public key information. We do not hold a user's passkey private key.
• Removing a user revokes their active sessions and registered authentication credentials.
• Member searches are audited, including the user, the time and a protected representation of the search term.
• Search results are not retained as a separate dataset.
• The application provides no operational route that returns an entire tenant's membership.

2. Storage and encryption

• Personal data is encrypted in transit and at rest using the controls provided by the underlying infrastructure and the application.
• Contact information is separately encrypted using AES-256-GCM with tenant specific key material.
• The same customer contact information held by two different merchants produces unrelated protected values.
• Member lookup by contact information uses a keyed fingerprint rather than storing a searchable plaintext value.
• Decryption requires an application defined purpose from an approved set.
• Marketing related processing returns member information only where the member holds the applicable marketing permission.
• Backups are encrypted and retained separately for the configured backup period.
• Production and test environments are separated, and real customer personal data is not intentionally used as test data.

3. Tenant separation

• Customer data is logically separated by merchant tenant.
• Merchant specific credentials and key material are used to maintain that separation.
• Application controls restrict access to records belonging to the authenticated tenant.
• Integration credentials are associated with the relevant merchant or branch and are not intended to provide access to another merchant's data.

4. Data minimisation

• The product provides no general street address field for loyalty members.
• Browser and device information is limited to a short description where required for operational purposes.
• Information received through online orders that the loyalty service does not need, including delivery and billing addresses, IP addresses, order notes and gift messages, is discarded rather than retained.
• We do not retrieve or search a merchant's historical orders. Calls that could do so are refused by an allow list in the application, and an automated check fails the build if such a call is introduced.

Automated tests are used to verify that defined data minimisation controls continue to operate as intended.

5. Logging and change control

• Administrative and configuration changes are recorded with the relevant user and time.
• Relevant member searches and access events are recorded for security and accountability.
• Deployment changes are subject to automated testing, including the security and data protection controls that can be tested automatically.
• A deployment is prevented where a required automated test fails.

6. Availability and recovery

• Production data is backed up regularly.
• Backups are encrypted and maintained separately from the primary production environment.
• Backup retention is currently seven days.
• Recovery procedures are maintained to support restoration of the service following an operational incident.

7. Data protection by design

The service is designed to minimise the personal data collected, limit access to it, separate merchant tenants, restrict unnecessary data flows, and give customers and merchants direct control over their own data. These controls are reviewed as the service develops and may be updated to maintain or improve the protection of personal data.

Annex 2: processing instructions

For the purposes of Article 28 of the UK GDPR, the controller instructs us to process personal data in order to:

1. enrol and maintain loyalty members;
2. identify members when they use the programme;
3. record qualifying sales and calculate points;
4. issue and redeem rewards;
5. maintain loyalty account balances and transaction history;
6. send transactional communications requested through the service;
7. send other communications where the controller has instructed us to and the applicable legal requirements have been met;
8. provide integrations with the controller's configured till, commerce and wallet systems;
9. provide the account, security and administration functionality needed to operate the service; and
10. provide the reporting, export, support and operational functionality made available through Valence Easy Loyalty.

We will not process customer personal data for a purpose materially outside these instructions without a further documented instruction from you, or where required by applicable law.

Annex 3: sub-processor schedule

This is the authoritative list of authorised sub-processors. Changes are notified under clause 6.1.

Version 0.2, 22 September 2026.