StampEzee Data Processing Addendum

Operator: Elyon Techno Labs Inc. operating as StampEzee

Contact: hello@stampezee.com

Address: Tiffany Court, Mississauga, Ontario, Canada

This Data Processing Addendum forms part of the agreement governing a Customer’s access to and use of the StampEzee services. It applies when StampEzee processes Customer Personal Data on behalf of the Customer. By accepting the Agreement or using the Services, the Customer enters into this Addendum on behalf of itself and any authorized affiliate that uses the Services.

If this Addendum conflicts with the Agreement, this Addendum controls for the processing of Customer Personal Data. The Standard Contractual Clauses or another mandatory transfer instrument controls to the extent of an irreconcilable conflict concerning an international transfer.

1. Parties and definitions

“StampEzee” means Elyon Techno Labs Inc., operating as StampEzee, of Tiffany Court, Mississauga, Ontario, Canada. “Customer” means the retailer, merchant or other business entity that accepted the Agreement.

“Applicable Data Protection Law” means each privacy, data protection, breach-notification and consumer-privacy law applicable to the Processing, including, where applicable, PIPEDA and substantially similar Canadian provincial laws; the EU GDPR; the UK GDPR and Data Protection Act 2018; the Swiss Federal Act on Data Protection; and applicable US state comprehensive privacy laws.

“Controller,” “Processor,” “Data Subject,” “Personal Data,” “Process,” “Processing,” “Supervisory Authority” and “Personal Data Breach” have the meanings given by Applicable Data Protection Law. “Customer Personal Data” means Personal Data processed by StampEzee on behalf of Customer through the Services. “Subprocessor” means a third party engaged by StampEzee to Process Customer Personal Data. “Services” means the StampEzee loyalty, rewards, communications, applications, dashboards, integrations and related services governed by the Agreement.

2. Scope and roles

Customer is the Controller or business and StampEzee is the Processor or service provider for Customer Personal Data described in Schedule 1. Customer determines the purposes and essential means of its loyalty programs, reward rules, campaigns, customer communications, staff access and connected commerce data.

StampEzee acts independently as a Controller for its own merchant-account administration, contracting, billing, platform security, fraud and abuse prevention, legal compliance, service-level analytics based on data StampEzee is permitted to use for those purposes, and direct relationships with individuals where StampEzee determines the purpose and means. Such activity is governed by the StampEzee Privacy Policy and is outside this Addendum to the extent StampEzee does not Process the data on Customer’s behalf.

The parties are independent Controllers for Personal Data each independently determines to Process. They are not joint controllers unless they expressly agree otherwise in writing.

3. Customer instructions

StampEzee will Process Customer Personal Data only on documented instructions from Customer, including the Agreement, this Addendum, Customer’s configuration and authorized use of the Services, support requests and other written instructions accepted by StampEzee. StampEzee may Process data as required by law, in which case it will inform Customer before Processing unless legally prohibited.

If StampEzee reasonably believes an instruction infringes Applicable Data Protection Law, it will inform Customer and may suspend the affected Processing until the parties resolve the concern. StampEzee is not required to perform an instruction that is technically infeasible, would reduce security for other customers, conflicts with law, or falls outside the Services unless the parties agree on scope, fees and safeguards.

4. Customer obligations

Customer represents and warrants that:

• it has provided all legally required notices and has a valid legal basis for collecting, using, disclosing and instructing StampEzee to Process Customer Personal Data;
• its instructions, loyalty rules, promotions, rewards, consent practices, marketing content and communications comply with law;
• it will collect only data reasonably necessary for its stated purposes and will not use the Services for unlawful discrimination, surveillance or profiling;
• it will not submit special-category, biometric, protected-health, payment-card, government-identifier or similarly sensitive data unless the Services expressly support it and the parties have agreed appropriate safeguards in writing;
• it will maintain accurate administrator and staff permissions, protect credentials and devices, promptly remove departed users and review Loyalty Executive and retailer-admin activity;
• it will respond to Data Subjects and regulators and notify StampEzee promptly when assistance is required;
• it will configure retention, consent, leaderboards, campaigns, referral/share features and notifications lawfully; and
• it will not combine or export Customer Personal Data in a way that defeats a Data Subject’s choice or StampEzee’s security controls.

5. StampEzee obligations

StampEzee will:

• Process Customer Personal Data only as permitted by Section 3;
• ensure persons authorized to Process Customer Personal Data are subject to confidentiality obligations;
• implement and maintain the technical and organizational measures in Schedule 2;
• provide reasonable assistance for Data Subject requests, impact assessments, consultations, security and breach duties, taking into account the nature of Processing and information available to StampEzee;
• maintain records and information reasonably necessary to demonstrate compliance with its obligations as Processor;
• not sell Customer Personal Data, share it for cross-context behavioural advertising, or use it for targeted advertising;
• not retain, use or disclose Customer Personal Data outside the direct business relationship or purposes specified in the Agreement and this Addendum, except as permitted by Applicable Data Protection Law; and
• notify Customer if StampEzee determines it can no longer meet an applicable processor or service-provider obligation.

6. Confidentiality

StampEzee will limit access to Customer Personal Data to personnel and contractors who require access for the Services, support, security or compliance and who are bound by confidentiality obligations. Confidentiality duties survive termination for as long as the information remains confidential or protected by law.

7. Security

StampEzee will maintain measures appropriate to the nature, scope, context and purposes of Processing and the risks to individuals. Schedule 2 describes the baseline measures. StampEzee may update them to reflect technological and operational developments, provided the overall level of protection is not materially reduced.

Customer is responsible for security within its control, including lawful configuration, endpoint security, staff training, identity and access management, secure API credentials, POS and Shopify permissions, and prompt reporting of suspected compromise.

8. Personal Data Breaches

StampEzee will notify Customer without undue delay after becoming aware of a confirmed Personal Data Breach involving Customer Personal Data. Notification will be sent to Customer’s designated security or account contact and will include available information reasonably required for Customer’s legal obligations, including the nature of the breach, affected categories, likely consequences, containment or remediation, and a StampEzee contact. Information may be provided in phases as the investigation develops.

StampEzee’s notice or cooperation is not an admission of fault or liability. Customer is responsible for regulatory and individual notifications unless law directly assigns that duty to StampEzee. Neither party will issue a public statement naming the other without advance consultation unless required by law.

9. Data Subject requests and Shopify privacy events

If StampEzee receives a request concerning Customer Personal Data, StampEzee may direct the requester to Customer and will not respond substantively unless Customer authorizes it or law requires it. StampEzee will provide reasonable self-service tools or assistance to access, correct, export, restrict or delete relevant data.

For a Shopify-connected Customer, StampEzee will support the mandatory privacy events made available by Shopify, including customer data requests, customer redaction and shop redaction. Customer remains responsible for initiating or responding to the request through Shopify and for data held outside StampEzee. StampEzee may retain data where law requires retention, while restricting further Processing to the legally permitted purpose.

10. Impact assessments and regulator consultation

On reasonable request, StampEzee will provide information available to it that Customer reasonably needs for a data protection or privacy impact assessment or prior consultation relating to Customer’s use of the Services. Bespoke work, repeated questionnaires or consultation outside standard documentation may be subject to reasonable fees agreed in advance, unless Applicable Data Protection Law requires assistance without additional charge.

11. Subprocessors

Customer grants general written authorization for StampEzee to use Subprocessors. StampEzee will maintain a current list at https://stampezee.com/legal/subprocessors before production launch and will provide a subscription or other reasonable method for notice of a new Subprocessor that materially Processes Customer Personal Data.

StampEzee will impose written data-protection obligations on each Subprocessor that are no less protective in substance than the obligations applicable to StampEzee under this Addendum for the relevant Processing. StampEzee remains responsible for the Subprocessor’s performance to the extent required by Applicable Data Protection Law.

Where law requires an opportunity to object, Customer may object on reasonable data-protection grounds within 15 days after notice. The parties will work in good faith on a commercially reasonable alternative. If none is available, StampEzee may discontinue the affected feature or Customer may terminate the affected Services without penalty for the unused prepaid period. An objection does not relieve Customer of amounts accrued before termination.

12. International transfers

Customer authorizes StampEzee and its Subprocessors to Process Customer Personal Data in the countries identified in the current Subprocessor list, subject to this Section. StampEzee will use a legally recognized transfer mechanism where required and will provide information reasonably necessary for Customer’s transfer assessment.

For restricted transfers from the European Economic Area, the European Commission Standard Contractual Clauses adopted by Implementing Decision (EU) 2021/914 are incorporated by reference. Module Two applies to controller-to-processor transfers; Module Three applies where Customer is a processor and StampEzee is its subprocessor. Clause 7 applies; Option 2 in Clause 9 applies with the 15-day notice period in Section 11; the optional language in Clause 11 does not apply; and the exporter’s EU member state governs Clauses 17 and 18, with Irish law and Irish courts applying if no member state nexus exists. Schedules 1 through 3 of this Addendum complete the relevant annexes.

For restricted transfers from the United Kingdom, the then-current UK International Data Transfer Addendum to the EU SCCs is incorporated and completed using this Addendum. For Swiss transfers, references in the SCCs are adapted to the Swiss Federal Act on Data Protection, the competent Swiss authority and Switzerland as required. If a transfer mechanism is invalidated or replaced, the parties will cooperate to implement a valid successor mechanism.

StampEzee will, where legally permitted, notify Customer of a binding government demand for Customer Personal Data and will assess and challenge demands that are unlawful, overbroad or inconsistent with applicable safeguards when there are reasonable grounds to do so.

13. Canada service provider commitments

When StampEzee Processes Customer Personal Data as a service provider under Canadian privacy law, it will use the data only to provide the Services and for compatible security, legal-compliance and internal operational purposes permitted by law. Customer remains accountable for identifying the purposes of collection, obtaining meaningful consent where required, providing access and correction, and ensuring comparable protection when data is transferred to StampEzee or its Subprocessors.

14. United States state privacy terms

To the extent an applicable US state privacy law characterizes Customer as a business or controller and StampEzee as a service provider, contractor or processor, Customer discloses Customer Personal Data to StampEzee only for the limited and specified purposes in the Agreement, this Addendum and Schedule 1. StampEzee will not:

• sell Customer Personal Data or share it for cross-context behavioural advertising;
• retain, use or disclose it outside the direct business relationship or specified business purposes, except as permitted by law;
• combine it with Personal Data received from another person or collected through StampEzee’s own interaction with an individual, except as permitted to provide the Services or by law; or
• attempt to re-identify data that Customer or StampEzee has validly deidentified, except to test whether deidentification complies with law.

Customer may take reasonable and appropriate steps to help ensure StampEzee uses Customer Personal Data consistently with these obligations and may require StampEzee to stop and remediate unauthorized use. StampEzee will provide the same level of privacy protection required of Customer for the relevant data, as applicable to StampEzee’s role.

15. Return deletion and retention

During the term, Customer may use available controls to export or delete data. After termination, StampEzee will delete or return Customer Personal Data on Customer’s written request and will begin deletion from active production systems within 30 days, unless the Agreement specifies another period. Customer must request a return before deletion is completed.

Encrypted backups may retain residual copies for up to 90 days under ordinary rotation, after which they will be overwritten, unless a longer period is required by law or a documented incident hold. Retained data remains protected, is isolated from ordinary use and is Processed only for backup restoration, security, legal compliance or dispute preservation. StampEzee may retain deidentified information that cannot reasonably be linked to an individual or Customer.

16. Demonstration of compliance and audits

On reasonable written request, StampEzee will provide information reasonably necessary to demonstrate compliance, which may include relevant policies, questionnaires, summaries or independent assurance reports if available. Customer may request an audit no more than once in any 12-month period, unless required by a Supervisory Authority or reasonably necessary following a confirmed Personal Data Breach or material non-compliance.

An audit must be scoped in advance, conducted during normal business hours, protect other customers and confidential systems, avoid vulnerability exploitation or production disruption, and use an independent auditor bound by confidentiality. Customer bears its audit costs and reimburses StampEzee’s reasonable costs for bespoke assistance, unless the audit identifies material non-compliance by StampEzee.

17. Liability and indemnity

Liability arising from this Addendum is subject to the limitations, exclusions and allocation of risk in the Agreement, except to the extent Applicable Data Protection Law prohibits that limitation. Nothing in this Addendum expands either party’s liability beyond the Agreement or limits a Data Subject’s rights against a party where those rights cannot lawfully be limited.

18. Term changes and precedence

This Addendum continues for as long as StampEzee Processes Customer Personal Data. StampEzee may update it to reflect changes in law, regulators, transfer mechanisms or the Services. A change will not materially reduce Customer’s data-protection rights during a current paid term without notice and, where required, an opportunity to terminate the affected Services. Order of precedence is: applicable mandatory transfer instrument; a signed negotiated DPA; this Addendum; then the Agreement.

19. Contact

Data-protection notices under this Addendum must be sent to hello@stampezee.com. Notices to Customer will be sent to the account, privacy or security contact maintained in the Services. Each party will keep its contact information current.

Schedule 1 Processing details

Schedule 2 Technical and organizational measures

Schedule 3 International transfer particulars

Schedule 4 Subprocessor publication requirements

Before launch, StampEzee must publish and maintain a Subprocessor register that identifies, at minimum, the legal provider name, service, processing purpose, categories of Customer Personal Data, processing location or region, and applicable transfer safeguard. The register should cover, where enabled:

• cloud hosting, databases, storage, networking, security monitoring and backups;
• Shopify platform services and mandatory privacy webhooks;
• POS and commerce integrations, including Lightspeed where enabled;
• Twilio or another provider for Verify, SMS and WhatsApp;
• transactional email delivery;
• Apple and Google services for mobile push and Wallet passes;
• payment and subscription processing, including Stripe where enabled;
• customer support, diagnostics and operational tooling that can access Customer Personal Data; and
• professional services or support vendors with potential production access.

A provider that receives only merchant billing data directly from StampEzee for StampEzee’s own purposes may be disclosed in the Privacy Policy rather than this processor list, depending on the parties’ legal roles.

Launch completion checklist

• Insert Elyon Techno Labs Inc.’s complete civic address and postal code.
• Publish the live Subprocessor register and subscribe-to-updates method before relying on Section 11.
• Confirm actual hosting and processing regions, backup rotation and deletion capabilities.
• Confirm the 30-day production and 90-day backup deletion periods with engineering.
• Implement and test Shopify customer data request, customer redaction and shop redaction events.
• Confirm signed-webhook verification, access controls, incident contacts and audit-log coverage.
• Have Canadian counsel and, before EU/UK launch, qualified European privacy counsel review the final Agreement, DPA and transfer setup.