Data Processing Agreement (annex 1 to the Terms of Service)

1. This agreement is part of the KantaPass Terms of Service. The controller is the Customer using KantaPass. The processor is KantaPass Oy (business ID 3612988-5).
2. This agreement meets the requirements of Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR"). It applies to card holders' personal data that KantaPass processes on the Customer's behalf. The subject matter, duration, nature and purpose of the processing and the types of data and data subjects are described in annex A.
3. Terms have the same meaning as in the GDPR.

1. The Customer is responsible for having a legal basis for the processing, for giving card holders the information required by GDPR Article 13 and for having the necessary consents for marketing.
2. The Customer's documented instructions are this agreement, the Terms of Service and the choices and settings the Customer makes in the service. Further instructions are given in writing and must be consistent with the service's features.

KantaPass:

1. processes personal data only on the Customer's documented instructions, including for transfers outside the EU and EEA, unless EU or Member State law requires otherwise. In that case KantaPass informs the Customer of the requirement before processing, unless the law prohibits this.
2. informs the Customer without delay if it considers that an instruction infringes data protection law.
3. ensures that people processing the data have committed to confidentiality or are under a statutory duty of confidentiality.
4. implements the technical and organisational measures required by GDPR Article 32, described in annex B.
5. complies with section 4 when using sub-processors.
6. assists the Customer in responding to data subjects' requests. In the service, the Customer can itself find, correct, export and delete a card holder's data and stop offers for a card holder. Card holders can delete their own card and withdraw marketing consent on the card page. When a card holder is deleted, their name, email, phone number and birthday are deleted, marketing stops, wallet registrations are deleted and the Google Wallet card is expired. The stamp history is kept for the Customer's statistics without these details. If a card holder sends a request to KantaPass, KantaPass forwards it to the Customer without delay and does not respond to it itself without the Customer's instruction.
7. assists the Customer with its obligations under GDPR Articles 32 to 36, such as impact assessments and prior consultation, taking into account the nature of the processing and the information available to KantaPass.
8. notifies the Customer of a personal data breach without undue delay and no later than 48 hours after becoming aware of it. The notice includes the information listed in GDPR Article 33(3) as far as it is known, and is supplemented as more information becomes available.
9. deletes or returns personal data when the agreement ends under section 6.
10. makes available to the Customer the information needed to demonstrate compliance with this agreement and allows audits under section 5.
11. keeps a record of processing activities as required by GDPR Article 30(2).
12. does not sell personal data or use it for its own purposes.

1. The Customer gives general prior authorisation for the sub-processors listed in annex C.
2. KantaPass notifies the Customer by email at least 30 days before adding or replacing a sub-processor. The Customer may object to the change on reasonable data protection grounds before it takes effect. If the parties cannot find a solution, the Customer may terminate the contract before the change, and any unused prepaid period will be refunded.
3. KantaPass imposes on sub-processors by contract the same data protection obligations as in this agreement. KantaPass remains liable to the Customer for its sub-processors' performance.
4. Personal data is transferred outside the EU and EEA only in accordance with Chapter V of the GDPR. The transfer bases are listed in annex C.

On request, KantaPass provides a written account of its compliance with this agreement and sub-processors' security reports where available. If this is not sufficient, the Customer may have an audit carried out once a year, or more often if required by a supervisory authority or after a personal data breach. Audits are notified 30 days in advance and carried out by an auditor bound by confidentiality who is not a competitor of KantaPass. Each party bears its own costs.

This agreement remains in force for as long as KantaPass processes card holders' data on the Customer's behalf. When the Customer deletes its account, KantaPass deletes the personal data immediately. If the contract ends in another way, the Customer can retrieve its data within 30 calendar days under section 15 of the Terms of Service, after which KantaPass deletes the personal data. Data leaves backups within 37 days at the latest, unless EU or Member State law requires it to be kept. KantaPass confirms the deletion in writing on request.

The parties' liability is determined by GDPR Article 82 and section 12 of the Terms of Service. The limitation of liability does not restrict a data subject's right to compensation under the GDPR.

• Location: database in the EU (Sweden); backend, logs and backups in the EU (Finland).
• Encryption: data is encrypted in transit (TLS). The database, file storage and their backups are encrypted at rest with AES-256 (Supabase). Backend data, logs and backups are encrypted at rest with Google-managed keys (Google Cloud).
• Customer separation: each Customer's card holder data is kept separate in the database, and the Customer's users see only their own business's data.
• Access control: KantaPass staff access card holder data only for customer support, and every view is logged. Admin actions are recorded in an audit log. Access rights are given only to the extent the task requires. Two-factor authentication is enabled on providers' admin and developer accounts and in KantaPass's own admin app.
• Passwords: only a hash of users' passwords is stored.
• Data minimisation: the Apple Wallet card shows only the card holder's first name, never the surname, email or phone number. Apple push notifications are empty, and the card data is fetched directly from KantaPass's backend. No name, email or phone number is sent to Google Wallet. Email open and click tracking is off. Location is not stored. The Scan tool reads the QR code on the device.
• Payment cards: KantaPass does not process card numbers.
• Backups: a full database backup is taken daily, kept for 30 days and recoverable for 7 more days.
• Logs: backend request logs are kept in Finland for 30 days. Supabase login logs are kept for 1 day. Login sessions are deleted at logout and after 15 days unused. Apple Wallet device IDs and push tokens are deleted as soon as the iPhone reports the card was removed or Apple reports the token is no longer valid.
• Staff: people processing the data have committed to confidentiality. Personal data is not shared in instant messaging apps.
• Incidents: personal data breaches are handled under a documented procedure and notified under section 3.

Current list of sub-processors: https://kantapass.com/en/sub-processors