This Data Processing Agreement ("DPA") forms part of the Merchant Agreement between Platehaus Sdn. Bhd. (Registration No. 1646457-T), which operates the platform under the name and brand "native.cards" ("Platehaus"), and the Merchant, and governs the processing of Member Data by Platehaus on the Merchant's behalf. It is entered into in order to satisfy the requirements of the Personal Data Protection Act 2010 (Act 709), as amended, including section 9, in respect of the engagement of a data processor.
1. Definitions and interpretation
1.1 Capitalised terms not defined in this DPA have the meanings given in the Merchant Agreement. In this DPA:
"Commissioner" means the Personal Data Protection Commissioner appointed under the PDPA.
"Controller Data" means Personal Data in respect of which Platehaus is a data controller, as described in clause 3.3.
"Data Subject" means an individual who is the subject of Member Data, including a Member, a person invited to a Program, a holder of a Wallet Card, and any other individual whose Personal Data is processed through the Services for the Merchant's Programs.
"Data Subject Request" means a request by a Data Subject to exercise a right under the PDPA, including a data access request, a data correction request, a withdrawal of consent, a request to limit processing, a request to cease processing for direct marketing, a request to cease processing likely to cause damage or distress, and a data portability request.
"Independent Recipient" means a third party to which Member Data is disclosed on the Merchant's instructions and which processes it as a data controller in its own right, including the Wallet Providers and the providers of Third-Party Services connected through an Integration.
"Instructions" has the meaning given in clause 4.1.
"Personal Data Breach" means any breach of Member Data, loss of Member Data, misuse of Member Data or unauthorised access to Member Data, while it is in the possession or under the control of Platehaus or its Sub-processors.
"Security Measures" means the technical and organisational measures described in Annex 2.
"Sensitive Personal Data" has the meaning given to "sensitive personal data" in the PDPA.
"Sub-processor" means any third party engaged by Platehaus to process Member Data on behalf of the Merchant.
"Sub-processor List" means the list of Sub-processors published in the Legal Centre.
1.2 The terms "data controller", "data processor", "personal data", "processing" and "commercial transactions" have the meanings given in the PDPA.
1.3 In the event of any conflict between this DPA and the remainder of the Agreement in respect of the processing of Member Data, this DPA prevails.
2. Scope and duration
2.1 This DPA applies to all processing of Member Data by Platehaus on behalf of the Merchant in the course of providing the Services. The subject matter, nature, purpose and duration of the processing, the types of Member Data and the categories of Data Subjects are set out in Annex 1.
2.2 This DPA takes effect on the Effective Date of the Merchant Agreement and continues for so long as Platehaus processes Member Data on the Merchant's behalf, including during any period after termination in which Member Data is retained under clause 13.
3. Roles of the parties
3.1 Merchant as data controller. The Merchant is the data controller of Member Data. The Merchant alone determines the purposes for which Member Data is processed, including which Programs it operates, which Personal Data it requests from Data Subjects, which Program features it enables, to whom it sends Notifications, and which Integrations it connects.
3.2 Platehaus as data processor. Platehaus is a data processor of Member Data and shall process it solely on behalf of the Merchant and in accordance with this DPA.
3.3 Platehaus as data controller. The Merchant acknowledges that Platehaus is a data controller, and not the Merchant's data processor, in respect of Personal Data that Platehaus processes for its own purposes, namely:
(a) the sign-in identity, profile and account-level choices of each individual who holds a native.cards account, including an individual who is also a Member, together with any telephone number that the individual has verified on that account and the records of signing in with WhatsApp;
(b) features that belong to an individual's native.cards account and not to any one Merchant, including the individual's consolidated view of his or her memberships and the composition of a Family Account;
(c) Personal Data of the Merchant's representatives and Authorised Users;
(d) Personal Data processed in order to secure the Platform, to detect, prevent and investigate fraud, abuse and security incidents, to conduct review and enforcement, and to establish, exercise or defend legal claims;
(e) Personal Data processed in order to comply with Applicable Law; and
(f) Platform Data and aggregated or de-identified data, as permitted by the Merchant Agreement.
Platehaus shall process Controller Data in accordance with the PDPA and its Privacy Notice. Nothing in this DPA restricts such processing.
3.4 No joint control. The parties do not intend to act as joint data controllers. Each party is separately responsible for its own compliance with the PDPA.
3.5 Merchant acting for others. Where the Merchant operates a Program for or with another person (for example an Affiliate, a franchisee or a client), the Merchant warrants that it is authorised to give Instructions on that person's behalf and shall be responsible for that person's compliance with this DPA as if it were the Merchant.
3.6 Verified telephone numbers. A telephone number that an individual verifies on his or her native.cards account is Controller Data. Platehaus does not disclose it to the Merchant, or tell the Merchant whether the individual has one, unless the Merchant's plan includes Verified Members and the individual chooses through the Platform to share it with the Merchant, at joining or later. Where the Merchant's Program requires a verified telephone number in order to join, the joining page tells the individual so, and sharing it is part of joining. Once shared, the copy held for the Merchant is Member Data processed under this DPA and is marked as verified, with the date of sharing; the mark is removed if the number is changed by anyone other than the individual. The Merchant instructs Platehaus to delete the shared copy when the individual stops sharing it with the Merchant or removes it from his or her account. A number that the Merchant has itself entered or changed is the Merchant's own record and is not affected.
4. Processing on Instructions
4.1 Platehaus shall process Member Data only on the documented instructions of the Merchant ("Instructions"), which comprise:
(a) the Agreement, including this DPA;
(b) the Merchant's configuration and use of the Services, including the Programs it creates, the fields it defines, the features and Integrations it enables, the Notifications it submits, and the actions of its Authorised Users in the Account and at the Counter;
(c) the choices and actions of Data Subjects made through the Platform in relation to the Merchant's Programs; and
(d) any further written instruction given by the Merchant and acknowledged by Platehaus as consistent with the Agreement.
4.2 The Merchant instructs Platehaus to process Member Data for the following purposes: (a) to provide, maintain, secure and support the Services; (b) to issue, deliver, update, expire and revoke Wallet Cards, including by disclosing Member Data to the Wallet Providers; (c) to deliver Notifications; (d) to exchange Member Data with the Third-Party Services connected by the Merchant; (e) to give effect to Data Subjects' choices and requests; (f) to prevent and address security incidents, fraud and technical faults; (g) to comply with Applicable Law; and (h) to measure the Merchant's use of the Services, including the number of Active Members, for the calculation of Fees under the Merchant Agreement, using only counts and not disclosing Member Data for that purpose.
4.3 Platehaus shall inform the Merchant if, in its opinion, an Instruction contravenes the PDPA or other Applicable Law, and may suspend the performance of that Instruction until the Merchant confirms or amends it. Platehaus is not obliged to undertake legal analysis of the Merchant's Instructions, and the absence of any such notice is not a representation that an Instruction is lawful.
4.4 Where Platehaus is required by Applicable Law, or by an order of a court or Regulator, to process or disclose Member Data otherwise than on the Merchant's Instructions, Platehaus shall, unless prohibited by law, notify the Merchant before doing so and shall process or disclose only what is required.
4.5 Platehaus shall not: (a) sell Member Data; (b) process Member Data for its own direct marketing or for the direct marketing of any other merchant; or (c) combine the Member Data of the Merchant with the Member Data of another merchant in order to build a profile of a Data Subject for Platehaus's own commercial purposes. This clause does not restrict the processing described in clause 3.3.
5. Obligations of the Merchant
5.1 The Merchant represents, warrants and undertakes that:
(a) it has complied, and shall comply, with the PDPA in respect of Member Data, including the General, Notice and Choice, Disclosure, Security, Retention, Data Integrity and Access Principles;
(b) it has given each Data Subject written notice, in the national and English languages, that satisfies section 7 of the PDPA and that describes the processing contemplated by the Agreement, including the engagement of Platehaus, the disclosure of Member Data to the Wallet Providers and to any Third-Party Service the Merchant connects, and the transfer of Member Data outside Malaysia;
(c) it has obtained, and shall maintain a record of, every consent required by the PDPA for the processing contemplated by the Agreement, including: explicit consent for any Sensitive Personal Data; consent of a parent, guardian or person with parental responsibility in respect of any Data Subject under the age of eighteen (18) years; consent to direct marketing where required; and consent to cross-border transfer where the Merchant relies on consent for that purpose;
(d) where it enters, uploads or imports Personal Data about an individual who has not personally provided it through the Platform (including an invitee, an employee, a student, a dependant or a child), it has the lawful authority to do so and has given that individual the notice the PDPA requires;
(e) its Instructions are lawful, and the processing of Member Data by Platehaus in accordance with them will not cause Platehaus to contravene the PDPA or other Applicable Law;
(f) the Personal Data it collects through the Services is adequate, relevant and not excessive in relation to the purposes of its Programs; and
(g) it shall keep Member Data accurate and up to date, and shall not retain it for longer than is necessary.
5.2 Sensitive Personal Data. The Merchant shall not use the Services to process Sensitive Personal Data unless: (a) the nature of the Program genuinely requires it; (b) the Merchant has satisfied clause 5.1(c) or established another condition permitted by section 40 of the PDPA; (c) the Merchant has configured the visibility of each such field so that it is displayed only to those who need to see it; and (d) the Merchant does not place Sensitive Personal Data in any Notification or on the face of any Wallet Card where it may be seen by others. The Merchant acknowledges that warning text displayed in a Template is guidance only, and that the decision to collect Sensitive Personal Data, and responsibility for it, are the Merchant's alone.
5.3 Photographs. Where the Merchant uploads photographs of individuals, it warrants that it has each individual's consent, or other lawful basis, to do so and to display the photograph to the audience the Merchant selects.
5.4 The Merchant's own security. The Merchant is responsible for the security of its own systems and devices, for the confidentiality of its Authorised Users' credentials, for the roles and access it grants, and for Member Data once it has been exported, downloaded, printed or transmitted to a Third-Party Service or to a destination nominated by the Merchant.
6. Personnel and confidentiality
6.1 Platehaus shall ensure that access to Member Data is limited to those of its personnel and Sub-processors who need it in order to provide the Services, and that all such personnel are bound by obligations of confidentiality, whether contractual or statutory, that survive the end of their engagement.
6.2 Platehaus shall ensure that its personnel who have access to Member Data are made aware of their obligations in respect of it.
7. Security
7.1 Platehaus shall implement and maintain the Security Measures, which are designed to protect Member Data from loss, misuse, modification, unauthorised or accidental access or disclosure, alteration or destruction, having regard to the nature of the Member Data, the harm that would result from such an event, the place where the Member Data is stored, and the security measures incorporated into the equipment in which it is stored, and in compliance with section 9 of the PDPA and the security standard issued under it.
7.2 Platehaus may update the Security Measures from time to time to reflect developments in technology and practice, provided that it does not materially reduce the overall level of protection of Member Data.
7.3 The Merchant acknowledges that it has reviewed the Security Measures and is satisfied that they provide a level of security appropriate to the risks presented by the processing of Member Data for its Programs.
8. Sub-processors
8.1 General authorisation. The Merchant gives Platehaus a general written authorisation to engage Sub-processors. The Sub-processors engaged at the date of this DPA are those in the Sub-processor List, to each of which the Merchant consents.
8.2 Requirements. Platehaus shall: (a) enter into a written agreement with each Sub-processor that imposes data protection obligations which, in substance, are no less protective of Member Data than those in this DPA, to the extent applicable to the services the Sub-processor provides; and (b) remain responsible to the Merchant for the acts and omissions of each Sub-processor in relation to Member Data as if they were its own.
8.3 Changes. Platehaus shall give notice of any intended addition or replacement of a Sub-processor by updating the Sub-processor List not less than fourteen (14) days before the new Sub-processor begins to process Member Data, and shall notify the Merchant by email or through the Account where the Merchant has subscribed to such notices. Where a Sub-processor must be replaced urgently for reasons of security, continuity of service or legal compliance, Platehaus may give shorter notice.
8.4 Objection. The Merchant may object to a new Sub-processor on reasonable grounds relating to the protection of Member Data, by written notice to admin@native.cards given within fourteen (14) days of Platehaus's notice. The parties shall discuss the objection in good faith. If Platehaus is unable to offer a reasonable alternative within thirty (30) days, the Merchant may, as its sole and exclusive remedy, terminate the affected Service by written notice and receive a refund of any Fees prepaid for that Service in respect of the period after termination.
8.5 Independent Recipients are not Sub-processors. The Wallet Providers and the providers of Third-Party Services that the Merchant connects are Independent Recipients and not Sub-processors. Member Data is disclosed to them on the Merchant's Instructions under clause 10.
8.6 Providers used only for Controller Data. A provider that Platehaus uses only for Controller Data is not a Sub-processor under this DPA. In particular, Meta Platforms provides the WhatsApp Business Platform through which individuals sign in to, and verify a telephone number on, their native.cards accounts. Meta processes those messages, which may name the Merchant whose page the individual started from, as Platehaus's processor for Platehaus's own purposes. No Member Data held for the Merchant is sent to it.
9. Transfers outside Malaysia
9.1 The Merchant acknowledges that the Services are hosted in Singapore and that Platehaus and its Sub-processors may process Member Data in the places stated in the Sub-processor List.
9.2 The Merchant authorises and instructs Platehaus to transfer Member Data to those places, and to any place in which an Independent Recipient processes it, for the purposes of the Agreement.
9.3 Platehaus shall transfer Member Data outside Malaysia only in compliance with section 129 of the PDPA and the guidelines issued by the Commissioner on cross-border transfers, and shall, in respect of each Sub-processor to which Member Data is transferred outside Malaysia: (a) take reasonable precautions and exercise due diligence to ensure that Member Data will not be processed in a manner that would contravene the PDPA; (b) bind the Sub-processor to contractual clauses that require security measures and a standard of protection equivalent to the PDPA; (c) maintain a record of the transfer, of the basis on which it is made and of any transfer impact assessment carried out, and review that assessment at least once every three (3) years and on any material change in the law of the receiving place or in the Sub-processor's practices; and (d) on becoming aware that a Sub-processor is in material breach of those clauses, suspend the transfer of Member Data to it until the breach is remedied.
9.4 The Merchant is responsible for informing Data Subjects of the transfers described in this clause 9 in its Merchant Privacy Notice, and for obtaining any consent on which it relies. Platehaus shall give the Merchant, on request, such information as the Merchant reasonably requires for any transfer impact assessment that it conducts.
10. Disclosure to Independent Recipients
10.1 Wallet Providers. The Merchant instructs Platehaus to disclose to the Wallet Providers the Member Data that appears on or is associated with a Wallet Card, and the identifiers and signals needed to deliver and update it, each time a Data Subject chooses to save a Wallet Card. The Merchant acknowledges that each Wallet Provider processes such data as a data controller under its own terms and privacy policy.
10.2 Integrations. By enabling an Integration, the Merchant instructs Platehaus to disclose to, and to receive from, the relevant Third-Party Service the Member Data that the Integration requires, as described in the Documentation and in Annex 1.
10.3 Advertising platforms. Where the Merchant enables the sharing of Member Data with an advertising platform, Platehaus shall disclose Member Data to that platform only in respect of Data Subjects whose consent to such sharing is recorded on the Platform as current, and shall cease to do so, and shall request removal from the Merchant's audiences on that platform, when that consent is recorded as withdrawn. The Merchant remains responsible for the lawfulness of the sharing and for compliance with the platform's terms.
10.4 Merchant-nominated destinations. Where the Merchant nominates a destination to receive notifications of events, the Merchant is responsible for the security and lawfulness of that destination.
10.5 Platehaus is not responsible for the processing of Member Data by an Independent Recipient or a Merchant-nominated destination after disclosure in accordance with the Merchant's Instructions.
11. Data Subject Requests
11.1 Self-service. The Platform enables Data Subjects to exercise certain rights directly, including to view their memberships and history, to correct certain details, to change their marketing, notification and advertising choices, and to close a membership. The Merchant instructs Platehaus to give effect to such choices and actions without further reference to the Merchant.
11.2 Requests received by Platehaus. If Platehaus receives a Data Subject Request that relates to Member Data and that cannot be fulfilled through the Platform's self-service functions, Platehaus shall, to the extent it is able to identify the Merchant concerned, forward the request to the Merchant without undue delay and in any event within five (5) Business Days, and shall inform the Data Subject that it has done so. Platehaus shall not respond to the substance of the request save on the Merchant's Instructions or as required by Applicable Law.
11.3 Assistance. Taking into account the nature of the processing, Platehaus shall provide reasonable assistance to enable the Merchant to respond to a Data Subject Request within the time allowed by the PDPA, including by making available the functions of the Account and, where those functions are insufficient, by extracting, correcting or deleting Member Data on the Merchant's written Instruction.
11.4 Requests concerning Controller Data. Where a request concerns Controller Data, Platehaus shall respond to it as data controller.
12. Personal Data Breaches
12.1 Notification. Platehaus shall notify the Merchant without undue delay, and in any event within forty-eight (48) hours, after becoming aware of a Personal Data Breach affecting the Merchant's Member Data. Notification shall be given to the email address of the Account owner and to any security or privacy contact that the Merchant has registered in the Account.
12.2 Content. The notification shall, to the extent known at the time, describe: (a) the nature of the Personal Data Breach; (b) the categories and approximate number of Data Subjects and records concerned; (c) the likely consequences; (d) the measures taken or proposed to contain and remedy it; and (e) a contact point for further information. Where it is not possible to provide all of this information at once, it may be provided in phases without undue further delay.
12.3 Response. Platehaus shall take reasonable steps to contain, investigate and remedy the Personal Data Breach, and shall keep the Merchant informed of material developments.
12.4 Co-operation. Platehaus shall give the Merchant such reasonable co-operation and information as the Merchant requires in order to assess the Personal Data Breach and to fulfil its obligations under section 12B of the PDPA, including its obligation to notify the Commissioner and affected Data Subjects.
12.5 Responsibility for notification. The Merchant, as data controller, is responsible for determining whether a Personal Data Breach must be notified to the Commissioner or to Data Subjects, and for making any such notification in respect of Member Data. Platehaus shall not notify the Commissioner or Data Subjects of a Personal Data Breach affecting Member Data on the Merchant's behalf save on the Merchant's Instruction or as required by Applicable Law, provided that nothing prevents Platehaus from making any notification that it is itself required to make in respect of Controller Data.
12.6 No admission. A notification under this clause 12 is not an admission of fault or liability.
12.7 Breaches on the Merchant's side. The Merchant shall notify Platehaus without undue delay, at admin@native.cards, of any breach of security affecting the Account, its Authorised Users' credentials or Member Data in the Merchant's possession that may affect the Platform.
12.8 Records. Platehaus shall maintain a register of Personal Data Breaches affecting Member Data, and shall retain each entry for not less than two (2) years.
13. Retention, return and deletion
13.1 During the Term. Platehaus shall retain Member Data for as long as the Merchant's Instructions and the Agreement require, and in accordance with the retention periods built into the Services, as described in the Documentation and the Privacy Notice. The Merchant may delete or instruct the deletion of Member Data at any time, subject to clause 13.4.
13.2 Closure by a Data Subject. Where a Data Subject closes his or her membership through the Platform, the Merchant instructs Platehaus to: (a) remove the Data Subject's name and telephone number from the membership record, withdraw his or her marketing and advertising consents, and void his or her Wallet Card, forthwith; (b) retain the remaining record for twelve (12) months, during which the membership may be reopened if the Data Subject rejoins; and (c) thereafter delete or irreversibly de-identify the record, save for transaction history retained in de-identified form as the Merchant's accounting record.
13.3 On termination. On the termination or expiry of the Agreement, Platehaus shall make Member Data available for export in accordance with the Merchant Agreement and, following the Exit Period, shall delete or irreversibly de-identify the Member Data in its possession within ninety (90) days, and within a further ninety (90) days from backups in the ordinary course of their rotation.
13.4 Permitted retention. Platehaus may retain Member Data to the extent and for the period that: (a) retention is required by Applicable Law or by an order of a court or Regulator; (b) the Member Data is also Controller Data; or (c) retention is necessary for the establishment, exercise or defence of legal claims. Platehaus shall continue to protect any Member Data so retained in accordance with this DPA and shall not process it for any other purpose.
13.5 Certification. On written request made within twelve (12) months after termination, Platehaus shall confirm in writing that it has complied with clause 13.3.
14. Assistance, information and audit
14.1 Assistance. Taking into account the nature of the processing and the information available to it, Platehaus shall provide reasonable assistance to the Merchant, at the Merchant's request, in connection with: (a) any data protection impact assessment that the Merchant is required to carry out; (b) any consultation with, or enquiry or investigation by, the Commissioner; and (c) the Merchant's compliance with its security obligations under the PDPA.
14.2 Information. Platehaus shall make available to the Merchant, on written request and subject to obligations of confidentiality, such information as is reasonably necessary to demonstrate Platehaus's compliance with this DPA, which may be provided in the form of written responses to a reasonable security and privacy questionnaire, summaries of policies and procedures, and any third-party audit report or certification that Platehaus then holds.
14.3 Audit. Where the information provided under clause 14.2 is not reasonably sufficient to demonstrate compliance, or where an audit is required by the Commissioner or by Applicable Law, the Merchant may, on not less than thirty (30) days' prior written notice and not more than once in any period of twelve (12) months (save following a Personal Data Breach or where required by the Commissioner), conduct an audit of Platehaus's compliance with this DPA, either itself or through an independent auditor who is not a competitor of Platehaus and who is bound by written obligations of confidentiality. Any audit shall: (a) be conducted during normal business hours and so as to minimise disruption; (b) be limited in scope to what is necessary; (c) not extend to the data of any other merchant, to Platehaus's source code or credentials, or to the systems of any Sub-processor save to the extent that Platehaus has the right to permit it; and (d) be at the Merchant's cost, including Platehaus's reasonable costs of assisting, unless the audit reveals a material breach of this DPA by Platehaus.
14.4 Costs of assistance. Platehaus may charge its reasonable costs for assistance under clauses 11.3 and 14.1 that exceeds what the functions of the Services and a reasonable allocation of support time provide, having first informed the Merchant of the likely cost.
14.5 Records. Each party shall maintain such records of its processing of Member Data as the PDPA requires of it. Platehaus shall maintain, and make available to the Merchant on request, a list of the third parties to which Member Data has been disclosed on the Merchant's Instructions.
14.6 Data protection officers. Each party shall appoint a data protection officer where section 12A of the PDPA requires it to do so, and shall give the other, on request, the business contact details of its data protection officer or, where none is required, of the person responsible for data protection.
14.7 The Commissioner. Nothing in this DPA restricts any power of the Commissioner to inspect the personal data systems of either party, and each party shall co-operate with the other in connection with any such inspection that concerns Member Data.
15. Requests from authorities
15.1 If Platehaus receives a request, order or demand from a court, Regulator or law enforcement agency for the disclosure of Member Data, it shall, unless prohibited by law: (a) notify the Merchant promptly; (b) direct the authority to the Merchant where it is reasonable to do so; and (c) disclose no more than is required. Platehaus may disclose Member Data without prior notice where it reasonably believes that disclosure is necessary to prevent imminent harm to any person.
16. Liability
16.1 The liability of each party under or in connection with this DPA is subject to the exclusions and limitations of liability in the Merchant Agreement.
16.2 The Merchant shall indemnify Platehaus in accordance with the Merchant Agreement in respect of any claim, fine, penalty or loss arising from the Merchant's breach of clause 5 or from Platehaus's processing of Member Data in accordance with the Merchant's Instructions.
16.3 Nothing in this DPA limits either party's liability directly to a Data Subject or to the Commissioner under the PDPA.
17. General
17.1 Changes. Platehaus may amend this DPA in accordance with the Merchant Agreement, including where required to comply with a change in the PDPA or in the guidelines of the Commissioner.
17.2 Governing law. This DPA is governed by the laws of Malaysia, and the dispute resolution provisions of the Merchant Agreement apply to it.
17.3 Contact. Notices and enquiries under this DPA, including those concerning security, shall be sent to admin@native.cards.
Annex 1 — Details of processing
| Item | Description |
|---|---|
| Subject matter | The provision of the Services to the Merchant under the Merchant Agreement. |
| Duration | The Term and the retention periods in clause 13. |
| Nature of processing | Collection, recording, organisation, storage, retrieval, use, display, transmission, disclosure to Independent Recipients on Instructions, restriction, de-identification and erasure. |
| Purposes | Those set out in clause 4.2. |
| Categories of Data Subjects | Members and applicants for membership of the Merchant's Programs; holders of identification, tickets, passes and policy cards issued by the Merchant, who may include the Merchant's employees, students, pupils, association members, volunteers, dependants and persons in its care; persons invited to a Program or card; persons referred to a Program; persons who interact with the Merchant's connected social media accounts or review listings; and customers appearing in the order records of the Merchant's connected point-of-sale or online store. |
| Types of Member Data | (a) Identity and contact: name, email address, telephone number (and, where the Data Subject shared a telephone number verified on his or her native.cards account, that it is verified and the date of sharing), member number, language. (b) Membership: status, dates, source of joining, consents and acceptances. (c) Answers to the Merchant's questions: including membership or booking reference, vehicle registration number, postcode, dates and other details the Merchant defines. (d) Program activity: balances, stamps, visits, purchases (amount, date, outlet, reference), rewards, redemptions, corrections, referrals, Family Account links within the Program. (e) Card data: card details defined by the Merchant, photograph, identifiers, validity, history, viewing records, reports and requests. (f) Wallet data: card and object identifiers, device library identifier and push token (Apple Wallet), save and removal signals (Google Wallet), diagnostics. (g) Communications: Notifications and emails sent, and delivery status. (h) Acquisition: QR code, link, campaign labels, referral or social media reply that led to joining. (i) Advertising (with consent): hashed email address, hashed reference, advertisement click identifier, IP address and browser details at joining, event records. (j) Social media and reviews: platform user identifier, username, excerpt of comment or message, reviewer name, profile picture link, rating and comment. (k) Orders: order and receipt records from a connected point-of-sale or online store, which may include a customer reference and contact details. |
| Sensitive Personal Data | None is required by the Services. Where the Merchant so chooses, and subject to clause 5.2, card data may include information as to physical or mental health or condition, a belief or opinion that may be inferred from membership of the body that issues a card, trade union membership, and passport or similar official document numbers. |
| Persons under 18 | Where the Merchant's Program so provides, subject to clause 5.1(c). |
| Disclosures to Independent Recipients on Instructions | Apple and Google (Wallet): card content and the identifiers and signals needed to deliver and update it. Meta (advertising, where enabled and consented): the data at (i). Meta (Instagram and Facebook automatic replies, where enabled): the reply message and the identifiers needed to send it. Google (Business Profile, where enabled): the Merchant's replies to reviews. Point-of-sale and online store providers (where enabled): requests for order and customer records. Merchant-nominated destinations (where set): event notices carrying an internal member reference, Program, outlet, time, amount and acquisition labels, without name or contact details. |
| Frequency of transfer | Continuous, for the duration of the Services. |
Annex 2 — Security Measures
Platehaus maintains the following technical and organisational measures. They describe the Services as operated at the date of this DPA and may be updated in accordance with clause 7.2.
1. Organisation
(a) Responsibility for information security and for data protection is assigned within Platehaus.
(b) Personnel with access to production systems or Member Data are bound by confidentiality obligations and are granted access on the basis of need.
(c) Sub-processors are selected with regard to their security practices and are bound by written data protection terms.
2. Access control: Merchants
(a) Each Merchant's data is logically separated from that of every other Merchant. Separation is enforced within the database by row-level access policies keyed to the Merchant, in addition to application-level checks.
(b) Authorised Users are assigned one of several roles (owner, administrator, outlet manager, staff, analyst), each with defined capabilities, and may be limited to particular Outlets.
(c) Merchant sign-in requires a verified email address and a password meeting defined strength rules; passwords are stored only in salted, hashed form by the authentication service. Two-step verification by authenticator application is available to all Merchant accounts, is required of owners and administrators appointed after 12 October 2026 within fourteen (14) days of taking the role, and is required for specified sensitive functions; once enrolled, sessions without the second factor are refused. A business page left unused for thirty (30) days is signed out on that browser, or after twelve (12) hours where that browser was last used for the scanner or the Counter.
(d) Counter actions that change a Member's record require the acting staff member's personal PIN, which is stored only as a keyed one-way value and is locked after repeated failed attempts.
(e) Lookup of a Member by member number or telephone number at the Counter is available only to authenticated staff with access to the relevant Outlet, returns limited information (including whether the telephone number is one the Member shared as verified), is rate-limited and is logged.
(f) A new Merchant's access remains closed until its business application has been approved.
3. Access control: Members
(a) Members sign in by a one-time code sent to their email address, valid for a short period, through a supported third-party sign-in provider, or with WhatsApp using a telephone number verified on their account.
(b) Sign-in sessions are established separately for native.cards and for each Merchant's Web Address.
(c) Codes embedded in Wallet Cards are opaque, revocable credentials; they are stored in encrypted or hashed form.
(d) WhatsApp sign-in requires the Member to send a single-use code that expires after five (5) minutes; sending it completes the sign-in, and native.cards' reply names the device and lets the Member end that sign-in at once. Messages are accepted only with a valid signature from Meta; codes, browser secrets and WhatsApp account identifiers are stored only as keyed hashes; and message text is not stored. A Member with an email address is asked to sign in another way after a long period without WhatsApp sign-in or where WhatsApp reports a change to the account behind the number; where WhatsApp shows that a different WhatsApp account now holds the number, the number is not used to open the earlier account. Accounts that hold a role in a Merchant's team or a platform operator role, and accounts protected by two-step verification, cannot sign in with WhatsApp. Changing or removing a verified telephone number requires a recent sign-in by emailed code or a third-party sign-in provider or, for an account that has no email address and signs in only with WhatsApp, a fresh confirmation in WhatsApp from the number already on the account; such an account cannot remove its number until it adds an email address. No text message is sent for any of these steps.
4. Access control: Platehaus
(a) Access to administrative functions requires a designated operator role, held separately from any Merchant role, and a session authenticated with a second factor.
(b) Administrative actions are recorded, with the actor, the action, the subject and the reason given.
(c) Specified high-impact actions (such as the suspension, restoration or closure of a Merchant) require the approval of a second administrator, save for emergency suspension.
5. Encryption
(a) Data in transit between users and the Platform, and between the Platform and its Sub-processors, is encrypted using Transport Layer Security. HTTP Strict Transport Security is enforced.
(b) Data at rest is held on the encrypted storage of the hosting provider.
(c) In addition, the following are encrypted at application level using authenticated encryption (AES-256-GCM): Wallet Card scan credentials; device push tokens and Wallet access tokens; access and refresh tokens and secrets for connected Third-Party Services; and raw payloads received from connected point-of-sale and online store systems.
(d) Encryption and signing keys are derived from a master secret held outside the database and outside source control, with versioning to permit rotation.
6. Application and network security
(a) Pages are served under a restrictive content security policy that limits the origins from which code, frames and connections may load, together with standard protective response headers.
(b) State-changing requests are checked for origin; inputs are validated against schemas; request sizes are bounded; redirects are restricted to permitted destinations.
(c) Requests are rate-limited by multiple keys, which are stored only as keyed one-way values, and public forms are protected by an automated challenge against non-human traffic.
(d) Inbound webhooks from third parties are accepted only where their cryptographic signature is verified. Outbound requests to Merchant-nominated destinations are restricted to public HTTPS addresses and are signed.
(e) Files are held in private storage and are served only through access-controlled routes or short-lived signed links.
(f) No advertising or analytics tracker is loaded in users' browsers; this is enforced by an automated test.
7. Development
(a) Changes are subject to automated checks before release, including a scan for committed credentials, a dependency vulnerability audit, linting, static type checking, unit tests, a check that server-side code and settings cannot reach code delivered to browsers, a production build, and database tests run against every migration replayed on a fresh database.
(b) Dependencies are monitored for published vulnerabilities and updated.
(c) Secrets are supplied through the hosting environment and are not stored in source control.
8. Logging and monitoring
(a) Append-only records are kept of administrative actions, Counter actions, scans and rejected scans, membership events, consent events, credential access and message delivery.
(b) Logs avoid recording secrets and, where practicable, record identifiers in hashed form or omit values (for example, a change of telephone number is logged without the number).
9. Data minimisation and retention
(a) The Services apply defined retention periods, enforced by scheduled jobs, to categories of technical and transient data; to a closed membership, which is erased twelve (12) months after closure; to raw payloads received from connected point-of-sale and online store systems, which are cleared thirty (30) days after processing; and to the recipient address and content of emails, which are cleared after twenty-four (24) months.
(b) Information returned to Counter staff on a lookup is limited to what is needed to confirm the Member's identity.
(c) Photographs uploaded for identification are re-encoded and stripped of embedded metadata.
10. Resilience
(a) The production database is hosted on a managed service, and Platehaus maintains backups of it through that service.
(b) Platehaus maintains procedures for the rotation of keys and credentials and for the containment of a compromised Merchant account or Integration.
(c) The repository is scanned for committed credentials as part of the automated checks before release.
11. Incident response
(a) Platehaus maintains a procedure for the identification, containment, assessment, notification and review of security incidents and Personal Data Breaches, and a register of them.
12. Limits
The Merchant acknowledges that Platehaus does not, at the date of this DPA, hold any third-party security certification, and makes no representation that it does. Platehaus shall inform the Merchant, on request, of any certification or independent assessment that it subsequently obtains.
Annex 3 — Sub-processors
The Sub-processors engaged by Platehaus, the services they provide and the places in which they process Member Data are set out in the Sub-processor List published in the Legal Centre, as updated from time to time in accordance with clause 8.
Questions about this document: support@native.cards. All legal documents