This Data Processing Addendum (“DPA”) forms part of the Reward Wallet Terms & Conditions between The Fempreneurs Club, trading as Reward Wallet (“Reward Wallet” or “Processor”) and the business using Reward Wallet (“Customer” or “Controller”).

This DPA applies where Reward Wallet processes Personal Data on behalf of the Customer.

1. Roles

The Customer acts as Controller and Reward Wallet acts as Processor for Personal Data processed by Reward Wallet on the Customer’s behalf.

The Customer determines the purposes of the processing and is responsible for ensuring that its collection and use of Personal Data complies with applicable data protection law. Reward Wallet will process Personal Data only as necessary to provide the Reward Wallet service, in accordance with the Customer’s documented instructions, these Terms and applicable law. The Customer’s use and configuration of Reward Wallet constitute documented instructions for the processing necessary to provide the service.

2. Processing

Reward Wallet may process Personal Data for the duration of the Customer’s subscription and for any limited period reasonably required afterwards for deletion, backups or legal obligations. Processing may include collecting, storing, organising, retrieving, updating, transmitting, analysing, automating and deleting Personal Data as necessary to provide the Reward Wallet service. Data Subjects may include the Customer’s clients, prospective clients, programme members and authorised users. Personal Data may include names, contact details, identifiers, Wallet Pass information, membership and loyalty information, points, rewards, offers, redemptions, referrals, bookings, communications, interactions and technical or engagement data. Reward Wallet is not intended for storing medical records, diagnoses, detailed clinical treatment information or other special category Personal Data unless expressly agreed otherwise.

3. Confidentiality and Security

Reward Wallet will take appropriate technical and organisational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Persons authorised to process Personal Data will be subject to appropriate confidentiality obligations and will only have access where reasonably necessary.

4. Subprocessors

The Customer gives Reward Wallet general authorisation to use subprocessors where necessary to provide the service.

Subprocessors may provide services such as digital wallet infrastructure, hosting, databases, CRM and automation, communications, artificial intelligence, analytics, security and other technical infrastructure. Reward Wallet will ensure that subprocessors are subject to appropriate data protection obligations as required by applicable law. A current list of relevant subprocessors may be made available to Customers. Where required by applicable data protection law, Reward Wallet will provide appropriate information about material changes to its subprocessors and allow Customers to raise reasonable objections based on legitimate data protection concerns.

5. International Data Transfers

Where Personal Data is transferred outside the European Economic Area (EEA), Reward Wallet will ensure that an appropriate legal transfer mechanism is used where required. This may include an adequacy decision, European Commission Standard Contractual Clauses or another legally recognised safeguard.

6. Data Subject Requests

Taking into account the nature of the processing, Reward Wallet will provide reasonable assistance to the Customer in responding to requests from Data Subjects exercising their rights under applicable data protection law. If Reward Wallet receives such a request directly relating to Personal Data processed on behalf of a Customer, Reward Wallet may refer the individual to that Customer.

7. Personal Data Breaches

If Reward Wallet becomes aware of a Personal Data Breach affecting Personal Data processed on behalf of the Customer, Reward Wallet will notify the Customer without undue delay as required by applicable law. Reward Wallet will provide reasonably available information and assistance to help the Customer meet its applicable legal obligations.

8. Compliance Assistance

Taking into account the nature of the processing and the information available to Reward Wallet, Reward Wallet will provide reasonable assistance with applicable obligations relating to data security, Personal Data Breaches, data protection impact assessments and consultations with supervisory authorities where required by law.

9. Deletion and Return of Data

When the Reward Wallet service ends, Reward Wallet will delete or return Personal Data processed on behalf of the Customer where required and reasonably possible, unless applicable law requires continued retention. Personal Data may remain temporarily in secure backups until deleted through normal backup and retention cycles.

10. Information and Audits

Reward Wallet will make available information reasonably necessary to demonstrate compliance with its applicable obligations as Processor.

Where required by applicable data protection law, the Customer may request a reasonable and proportionate audit. Where appropriate, existing documentation, reports or other compliance information may be used first. Any audit must be conducted in a manner that does not unreasonably disrupt Reward Wallet’s operations or compromise the confidentiality or security of other customers.

11. Liability and Precedence

The liability provisions in the Reward Wallet Terms & Conditions also apply to this DPA, except where applicable law requires otherwise.

If there is a conflict between this DPA and the Terms & Conditions regarding the processing of Personal Data on behalf of the Customer, this DPA takes precedence for that processing.

12. Governing Law

This DPA is governed by the laws of the Netherlands, subject to applicable data protection law.

13. Contact

For questions relating to this DPA or the processing of Personal Data, please contact: [email protected]