Data Processing Addendum

This Data Processing Addendum (Addendum) forms part of the Service Agreement between RewardCo and the Client. It applies under section 10.5 of the Service Agreement, for as long as RewardCo processes Client Personal Data.

It applies only to Client Personal Data that a Data Protection Law covers. For other personal information in the Client Data, section 10.4 of the Service Agreement applies. Section 10.4 continues to apply alongside this Addendum.

The Client accepts this Addendum by signing an Order Form. A Client that wants a signed copy can ask legal@rewardco.com, and RewardCo will send this text with the Client's details completed.

Terms defined in the Service Agreement have the same meaning here.

Roles. For Client Personal Data, the Client is the Controller and RewardCo is the Processor. Where the Client is itself a Processor for another Controller, for example an Agency acting for an Agency Client under section 11.2(a) of the Service Agreement, RewardCo is the Client's Sub-processor. In that case the Client confirms that its Controller has authorised the Client's instructions and RewardCo's appointment.

Instructions. RewardCo processes Client Personal Data only on the Client's documented instructions. These are the Service Agreement, the Order Form, the settings the Client's Administrators choose on the platform, and any other written instruction the Client gives that is consistent with them. RewardCo may also process Client Personal Data where the law requires it. In that case RewardCo will tell the Client first, unless the law forbids it.

Unlawful instructions. RewardCo will tell the Client promptly if, in its opinion, an instruction breaches a Data Protection Law. RewardCo need not follow that instruction until the Client confirms or changes it.

The Client's duties. The Client is responsible for having a lawful basis for the Processing, for giving Participants the notices the law requires, and for the accuracy of the Client Personal Data it provides. The Client must not put special category data (such as health, religion or trade union membership) into the platform unless a Program needs it and the Client has told RewardCo in writing.

The Processing is as follows. Each Order Form can add details for a Program.

RewardCo makes sure that everyone it authorises to process Client Personal Data, including its staff and contractors, is bound by a duty of confidentiality, in their contract or by law.

RewardCo gives access to Client Personal Data only to staff and contractors who need it to provide the Services.

RewardCo takes appropriate technical and organisational measures to protect Client Personal Data, as Article 32 of the GDPR requires. The measures in place on the date of this Addendum are:

RewardCo may change these measures over time, as long as the overall level of protection does not fall.

Authorisation. The Client gives RewardCo general written authorisation to engage Sub-processors. The Sub-processors at the date the Client signs its Order Form are listed on RewardCo's Sub-processors page (/legal/sub-processors/), and the Client authorises each of them.

Notice of changes. RewardCo will give the Client at least 30 days' notice before it adds or replaces a Sub-processor, by updating the Sub-processors page and emailing the notice address in the Order Form. The notice will name the Sub-processor, what it will do and where it will process Client Personal Data.

Objection. Within those 30 days, the Client may object to the change in writing, on reasonable grounds relating to data protection. The parties will then discuss it in good faith. If they cannot agree a solution within 30 days of the objection, the Client may end the affected Services by written notice, and RewardCo will refund any prepaid Fees for the unused period of those Services.

Urgent changes. If RewardCo must replace a Sub-processor urgently, for example because it has stopped providing its service or has had a security failure, RewardCo will give notice as soon as it can, and the Client's right to object under section 7.3 still applies.

Flow-down. RewardCo will have a written contract with each Sub-processor that gives Client Personal Data at least the same protection as this Addendum, including sufficient guarantees of appropriate security measures.

Responsibility. RewardCo remains responsible to the Client for each Sub-processor's performance of its data protection obligations.

The Client's own providers. A provider the Client engages directly is not RewardCo's Sub-processor. This includes the Client's own Airwallex account where Payouts are paid from it (Service Agreement section 7.5), the Client's Microsoft Entra ID tenant, and any supplier of physical items.

The platform lets Participants see and update their own profile details, and lets the Client's Administrators view, correct and export Participant records.

If RewardCo receives a request from a Data Subject about Client Personal Data, RewardCo will pass it to the Client promptly and will not respond to it, except to tell the Data Subject to contact the Client.

Taking into account the nature of the Processing, RewardCo will give the Client reasonable help, by appropriate technical and organisational measures, so the Client can answer requests to exercise Data Subjects' rights, such as access, correction, deletion, restriction, objection and portability.

RewardCo will tell the Client of a Personal Data Breach affecting Client Personal Data without undue delay after becoming aware of it, as section 12 of the Service Level Agreement sets out.

As far as RewardCo knows them at the time, the notice will describe the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, the steps taken or proposed to deal with it, and a contact who can give more information. RewardCo will give further details as it learns them.

RewardCo will take reasonable steps to contain the breach and reduce its effects, and will help the Client meet its duties to notify a Supervisory Authority and Data Subjects. Telling the Client of a breach is not an admission of fault.

Taking into account the nature of the Processing and the information available to it, RewardCo will give the Client reasonable help with its data protection impact assessments and any prior consultation with a Supervisory Authority, as Articles 35 and 36 of the GDPR require.

RewardCo will cooperate with a Supervisory Authority on request.

Where the help the Client asks for under sections 8, 10 or 12 goes beyond what the Services include and takes significant time, RewardCo may charge for it at the rates in the Order Form, after telling the Client the likely cost. RewardCo does not charge for help with a breach caused by RewardCo or its Sub-processors.

During the Term, the Client can export Client Data, and ask RewardCo for a full export, under section 10.3 of the Service Agreement.

When the Services end, the Client may export or ask for a copy of the Client Data within the period in section 19.2 of the Service Agreement. RewardCo will then delete or de-identify the Client Personal Data under section 10.6 of the Service Agreement: within 90 days, with copies in backups deleted as those backups reach the end of their normal retention, within 12 months.

RewardCo may keep Client Personal Data only where the law requires it, such as financial records. RewardCo will keep it confidential, protect it under this Addendum, and use it only for the purpose the law requires.

RewardCo will make available to the Client the information reasonably needed to show that it meets this Addendum and Article 28 of the GDPR.

Once in any 12 months, RewardCo will answer a reasonable written security and privacy questionnaire from the Client.

Where the questionnaire and other information do not reasonably show compliance, or where a Supervisory Authority requires it or a Personal Data Breach has occurred, the Client may audit RewardCo's compliance, itself or through an independent auditor bound by confidentiality. The Client must give at least 30 days' written notice (less for a breach or where a Supervisory Authority requires it), agree the scope and timing with RewardCo, carry out the audit during Business Hours without unreasonably disrupting RewardCo's business, and pay its own costs. An audit does not give access to other clients' data or to RewardCo's confidential information that has nothing to do with the Client.

Audits of a Sub-processor are carried out through the information and audit reports the Sub-processor makes available, unless the Data Protection Law requires otherwise.

Where the data is. The platform is hosted in Finland, and its backups are kept in Germany, both in the European Economic Area. RewardCo is based in Australia, and its staff and contractors in Australia and the Philippines access Client Personal Data to provide the Services. Some Sub-processors process it in other countries, including the United States, as the Sub-processors page shows.

EU transfers. For each Restricted Transfer of Client Personal Data that the EU GDPR covers, from the Client to RewardCo, the EU SCCs are incorporated into this Addendum as follows:

• Module 2 (controller to processor) applies where the Client is a Controller, and Module 3 (processor to processor) applies where the Client is a Processor;
• clause 7 (docking clause) applies;
• in clause 9, option 2 (general written authorisation) applies, with the notice period in section 7.2 of this Addendum;
• the optional wording in clause 11 does not apply;
• in clause 13, the competent Supervisory Authority is the one that clause and Annex I.C point to for the Client;
• in clause 17, option 1 applies, and the EU SCCs are governed by the law of the EU member state where the Client is established, or, if the Client is not established in the EU, the law of Ireland;
• in clause 18, disputes go to the courts of that same member state; and
• Annex I is completed by the Order Form (the parties), RewardCo's details on this page, and section 4 of this Addendum (the transfer); Annex II by section 6; and Annex III by the Sub-processors page.

UK transfers. For each Restricted Transfer of Client Personal Data that the UK GDPR covers, the EU SCCs apply as set out in section 13.2, as amended by the UK Addendum. For the UK Addendum's tables: Table 1, the parties are the Client (exporter) and RewardCo (importer), with the details in the Order Form; Table 2, the modules and options in section 13.2 apply; Table 3, the annexes are as set out in section 13.2; and Table 4, either party may end the UK Addendum as its section 19 allows.

Onward transfers. Where a Sub-processor receives Client Personal Data in a country without an adequacy decision, RewardCo will make sure the transfer is covered by a safeguard the Data Protection Law recognises, such as the EU SCCs and the UK Addendum, or the Sub-processor's certification under the EU-US Data Privacy Framework and its UK Extension.

Changes in the law. If a safeguard used under this section stops being valid, the parties will work together in good faith to put in place another one the law recognises.

Each party's liability under or in connection with this Addendum is subject to the limits and exclusions in section 17 of the Service Agreement. Nothing in this section limits a party's liability to Data Subjects under the EU SCCs, or any liability that cannot be limited by law.

If documents conflict about Client Personal Data, they apply in this order: the EU SCCs and the UK Addendum, then this Addendum, then the rest of the Service Agreement and the Order Form.

RewardCo may update this Addendum to reflect changes in Data Protection Law, or in a regulator's or court's guidance, by giving the Client at least 30 days' notice. An update will not reduce the protection this Addendum gives Client Personal Data.

RewardCo shows the date of the current version at the top of this page.