This page lists the third parties that process personal data in connection with native.cards, the platform operated by Platehaus Sdn. Bhd. under that name and brand ("Platehaus", "we"). It forms part of the Data Processing Agreement and is referred to in the Privacy Notice. Capitalised terms have the meanings given in the Merchant Agreement and the Data Processing Agreement.
We will update this page not less than fourteen (14) days before a new Sub-processor begins to process Member Data, save where a shorter period is permitted by the Data Processing Agreement. Merchants may ask to be notified of changes by writing to admin@native.cards.
1. Sub-processors
These providers process personal data on behalf of Platehaus, under written terms, in order to deliver the Services.
| Sub-processor | Service | Personal data processed | Place of processing |
|---|---|---|---|
| Supabase, Inc. | Managed database, authentication and private file storage | All personal data held on the Platform, including account, membership, card, photograph and audit data | Singapore (Amazon Web Services, Asia Pacific (Singapore) region) |
| Vercel Inc. | Application hosting, serverless functions, content delivery and scheduled jobs | All data in transit to and from the Platform; server logs, including IP addresses | Singapore (application functions); content delivery and logging on Vercel's global network, including the United States |
| Cloudflare, Inc. | Domain name services; automated protection of forms against non-human traffic (Turnstile) | Domain name queries; for protected forms, the visitor's IP address and browser and device signals | Global network, including the United States |
| Twilio Inc. (SendGrid) | Delivery of email | Recipient email address, message content (including the name of the Merchant and Program and access links) and delivery status | United States |
| Microsoft Corporation (Microsoft 365) | Business email for support, privacy and legal correspondence | The content of correspondence sent to our mailboxes | Asia Pacific and the United States |
| Anthropic, PBC | Automated reading of content submitted by Merchants for review, where enabled | Wording written by the Merchant (for example a notification, a reward, an outlet's details or a question asked at joining). No Member records are submitted. Personal data is included only if the Merchant has typed it into its own content | United States |
| Google LLC (Google Cloud) | Custody of signing credentials, where used | Credentials and access metadata. No Member Data | United States and Asia Pacific |
| Meta Platforms, Inc. and its affiliates (WhatsApp Business Platform, Cloud API) | Messages with individuals who choose to sign in to, or verify a telephone number on, their native.cards account using WhatsApp | The individual's telephone number and WhatsApp account identifier; the message they send (fixed wording with a sign-in code); and our replies: a request to confirm, which names native.cards or, where the sign-in or verification started on a Merchant's page, that Merchant's trading name, and carries a single confirmation button (with native.cards' header picture, for a sign-in), followed by a short message stating the outcome, and a read receipt. The replies do not describe the individual's browser or device or say when the sign-in started. Account data for which Platehaus is the data controller; no Member Data held for a Merchant is sent, so this is not a Sub-processor of Member Data under clause 8 of the Data Processing Agreement | Outside Malaysia, on Meta's infrastructure |
2. Service providers for Platehaus's own records
These providers process personal data for Platehaus's own purposes, for which Platehaus is the data controller. No Member Data is sent to them, so they are not Sub-processors of Member Data under clause 8 of the Data Processing Agreement (see clause 8.6).
| Provider | Service | Personal data processed | Place of processing |
|---|---|---|---|
| Stripe (the Stripe entity with which Platehaus holds its account, and its affiliates) | Payment of Merchants' Fees: a payment page hosted by Stripe, a portal hosted by Stripe for changing the payment card and viewing invoices, invoices and payment collection, and signed notices of payment events | The Merchant's billing details: company name, company registration number, SST registration number, billing email address and postal address (until billing details are saved, the Merchant's legal or trading name and the sign-in email address of the owner or administrator who opens the payment page); Platehaus's internal reference for the Merchant; the Plan, billing period and number of Outlets; for Usage Fees, the month and the number of Active Members; the terms of any discount or credit applied; and the card details that the Merchant's representative enters on Stripe's own page, which do not pass through the Platform. No Member Data. Stripe also processes payment data for its own purposes as a payment provider, such as preventing fraud and meeting its legal obligations, as a controller under its own privacy policy | United States, and other countries in which Stripe and its affiliates operate |
3. Independent Recipients
These parties receive personal data in order to provide their own services to the individual or to the Merchant. Each acts as a data controller in its own right, under its own terms and privacy policy. They are not Sub-processors.
3.1 Wallet and sign-in providers (at the individual's choice)
| Recipient | When | Personal data |
|---|---|---|
| Apple Inc. and its affiliates (Apple Wallet; Apple Push Notification service; Sign in with Apple) | When an individual saves a Wallet Card to Apple Wallet, or signs in with Apple | The content of the card as delivered to the device; a device push token and card identifier, used to signal that an update is available (the signal itself carries no content); sign-in identity |
| Google LLC and its affiliates (Google Wallet; Google Sign-In) | When an individual saves a Wallet Card to Google Wallet, or signs in with Google | The content of the card (which may include name, member number, balance, barcode and text shown on the card); messages shown on the card; sign-in identity |
3.2 Services connected by a Merchant (on the Merchant's instruction)
| Recipient | When | Personal data |
|---|---|---|
| Meta Platforms, Inc. and its affiliates: advertising (Conversions API; custom audiences) | Only where the Merchant has enabled it and the Member has given separate consent | Hashed email address; hashed reference; advertisement click identifier; IP address and browser details at joining; event type, time and, for purchases, value. Hashed email addresses for audience matching |
| Meta Platforms, Inc. and its affiliates: Instagram and Facebook automatic replies | Where the Merchant has connected its account and a person's comment or message triggers a reply | Received: platform user identifier, username, excerpt of the comment or message. Sent: the reply |
| Google LLC: Google Business Profile | Where the Merchant has connected its listing | Received: reviewer's displayed name, profile picture link, rating and comment. Sent: the Merchant's reply |
| Loyverse, Shopify Inc., Wix.com Ltd., and the Merchant's own WooCommerce store | Where the Merchant has connected its point-of-sale or online store | Received: order and receipt records, which may include a customer reference and contact details |
| Canva Pty Ltd | Where the Merchant sends a print design to, or imports one from, Canva | The design file. No Member Data |
| A destination nominated by the Merchant (for example its own server or an automation service) | Where the Merchant has set one | Event notices carrying an internal member reference, Program, outlet, time, amount and acquisition labels, without name or contact details |
4. Third-party content loaded in the browser
| Party | Where | What it receives |
|---|---|---|
| Cloudflare, Inc. (Turnstile) | Protected forms | See section 1 |
| SecurityScorecard, Inc. | A security rating badge displayed on certain public pages of native.cards | The visitor's IP address and browser details, and the address of the site on which the badge is displayed |
No advertising or analytics script, pixel or tracker is loaded in the browser.
5. Transfers outside Malaysia
Personal data is transferred to the places stated above in accordance with section 129 of the Personal Data Protection Act 2010. See section 9 of the Privacy Notice and clause 9 of the Data Processing Agreement.
Questions about this document: support@native.cards. All legal documents