Data Processing Agreement

• Data controller: the business that holds the Stampaz account, with the legal details it provides in Settings.
• Data processor: Miranda Network, S.L., Tax ID B-75866194, registered address at Carretera TF-643, 21, piso 01, puerta 1 B, 38600 Granadilla de Abona, Santa Cruz de Tenerife (España), contact support@mirandanetwork.es.

The processor processes the data solely to provide the loyalty card service: signing up customers, managing stamps, points and rewards, issuing and updating cards in Apple Wallet and Google Wallet, sending the notifications decided by the controller, statistics and handling customers' rights requests.

Operations: collection, recording, storage, consultation, modification, disclosure to Apple and Google to issue the card, export and erasure.

The processing lasts as long as the business has an account on Stampaz.

• Data subjects: the controller's customers who join its loyalty program and members of its team who use the scanner.
• Data: name; email, phone number and birthday if the controller asks for them; history of visits, stamps, points and rewards; offers preference; proof of consent (date, time and version of the text); technical identifiers of the card.
• No special categories of data or location data are processed: the proximity alert is decided by the customer's phone.

The controller gives its instructions through its dashboard settings: what data it requests, what notifications it sends, how long inactive customers are kept (between 6 and 60 months) and what legal information is shown to the customer. When signing up, the customer sees a first layer of information with the controller's details, and Stampaz keeps proof of their consent.

If the processor considers that an instruction infringes the law, it will inform the controller.

• Process the data only on the controller's documented instructions and not use it for its own purposes.
• Ensure the confidentiality of the persons authorized to process the data.
• Apply the security measures of Article 32 GDPR: encryption in transit, isolation of data per business, access control, backups and access logging.
• Assist the controller in responding to data subjects' rights. Customers can correct and download their data, stop receiving offers and delete everything from their card; requests received by the processor will be forwarded to the controller without delay.
• Notify the controller of security breaches without undue delay and, in any case, within a maximum of 48 hours of becoming aware of them, with the information available.
• Assist the controller, where applicable, with impact assessments and consultations with the supervisory authority.
• Make available to the controller the information necessary to demonstrate compliance and allow reasonable audits, with 30 days' prior notice and at the controller's expense.
• Keep the record of processing activities as processor.

The controller gives general authorization to the following sub-processors:

• Supabase: database, authentication and storage (hosted in the EU).
• Vercel: application hosting, running in its Frankfurt region (European Union).
• Apple and Google: issuing and updating cards in their Wallets (card content only: name, stamps or points and code).

We will give at least 15 days' notice of any change of sub-processors so the controller can object; if it objects and there is no alternative, it may cancel. Each sub-processor is bound by equivalent obligations. Transfers outside the EEA are carried out with the safeguards of Chapter V GDPR (adequacy decisions, such as the EU-US Data Privacy Framework, or standard contractual clauses).

• Fill in its legal details in Settings, inform its customers and have a valid legal basis.
• Send offers only to those who accepted them and without overusing notifications.
• Ensure its staff comply with the GDPR and safeguard access to the scanner.

When the subscription ends, the processor automatically erases all data 30 days later. During that period, the controller can export it (JSON). If the controller deletes its account, erasure is immediate. Only data that the law requires to be retained will be kept, in blocked form.