Data processing agreement

The business is the controller of its customers' personal data: it decides to run a loyalty programme and what to ask people who join. Volvia is the processor: it stores and handles that data only to provide the service, on the business's instructions.

First name, email, an optional phone number and birthday without the year, marketing consent, the answers to any extra question the business asks, stamps, rewards and the messages sent to the customer. Nothing else is collected from customers.

Process the data only for the programme and as instructed; keep it confidential and protected with appropriate technical and organisational measures; engage only the sub-processors listed on the sub-processors page and tell businesses of changes; help the business answer customers who exercise their rights; notify the business without undue delay of a personal data breach; and delete or return the data when the service ends, as set out below.

Have a lawful basis for the programme and for any marketing it sends; publish the customer privacy notice Volvia hosts in its name; ask customers only what it needs; and handle requests from its customers.

Data is stored with the providers listed on the sub-processors page, in the United States and the European Union, under standard contractual clauses where required.

A business can export its customers at any time. When a business closes its account the data is kept for seven days so the closure can be undone, then deleted for good, including copies in storage. Backups are rotated within thirty days.

This agreement is part of the terms of service and is accepted with them. Questions about it go to the contact page.