Data Processing Agreement
Effective date: 2026-09-21 · Forms part of the Stamposa Terms of Service · Governed by the laws of India.
Draft — requires legal review.
This document is a template written by the engineering team, not reviewed by counsel. Do not rely on it as the operative policy until a licensed attorney has signed off, replaced the placeholders (marked [LEGAL REVIEW]), and dated it below.
1. Roles
You (the merchant) are the data fiduciary (controller) for the personal data of your customers. Stamposa is the data processor acting on your documented instructions. Instructions from you include the choices you make in the merchant dashboard (creating campaigns, sending broadcasts, configuring wallet passes, exporting data).
2. Subject matter and scope
- Subject matter: operation of a digital loyalty platform on your behalf.
- Nature and purpose: enrol customers, record stamps and redemptions, deliver campaign messages, provide analytics.
- Categories of personal data: phone number, optional name and email, marketing consent flag, loyalty history (stamps, rewards), and any tags or notes you record.
- Categories of data principals: your customers, and your staff members that you invite to the platform.
- Duration: as long as your account is active with us.
3. Our obligations as processor
Stamposa will:
- Process personal data only on your documented instructions.
- Keep the data confidential and ensure personnel with access are bound by confidentiality.
- Apply the security measures described in Annex 1.
- Assist you (at your reasonable request) in responding to requests from data principals to access, correct, port or erase their data.
- Assist you in demonstrating compliance with the DPDP Act, including responding to queries from the Data Protection Board of India.
- Notify you without undue delay (and in any case within [LEGAL REVIEW — typical 72 hours]) after becoming aware of a personal-data breach affecting your data.
- At your choice, delete or return all personal data at the end of the service and delete existing copies unless retention is legally required (see the Privacy Policy retention section).
4. Your obligations as controller
You warrant that (a) you have a valid basis under the DPDP Act to collect and share each customer’s data with us, (b) you have obtained the consents required to send them marketing messages, and (c) you will respond to their DPDP rights requests within the statutory time limits.
5. Sub-processors
You authorise us to engage the sub-processors listed in Annex 2 to help deliver the service. When we add a new sub-processor we will update the list and give you at least [LEGAL REVIEW — typical 30 days] notice by email. If you reasonably object, you may terminate the affected service with a pro-rated refund of prepaid fees.
We remain liable to you for our sub-processors’ acts and omissions as if they were our own.
6. Cross-border transfers
Where a sub-processor processes personal data outside India, we rely on the transfer rules under the DPDP Act and impose written contractual terms on the recipient that provide equivalent protection.
7. Audits
On at most one occasion per year, with reasonable notice, you may request an independent audit of our processing activities relevant to this DPA at your cost. We may satisfy this obligation by providing an up-to-date third-party attestation (e.g. SOC 2 or ISO 27001) once we have one.
8. Liability and precedence
The liability caps in the Terms of Service apply to this DPA. In case of conflict between this DPA and the Terms, this DPA prevails on data-protection matters.
Annex 1 — Security measures
- Argon2 password hashing for all account passwords.
- TLS in transit; unique bind on 127.0.0.1 for internal services.
- Per-tenant data isolation enforced by the application layer.
- JWT access tokens (15 minutes) + rotating refresh tokens (30 days).
- Redis-backed rate limiting on authentication, OTP and mutating endpoints; idempotency-key middleware for repeated writes.
- Two-factor authentication required for platform administrators; audit log of every admin action, including impersonation sessions.
- Encrypted daily off-box database backups with 7-daily / 4-weekly / 12-monthly rotation; documented restore drill.
- Application error monitoring via Sentry, without personal identifiers.
- Environment separation: development, staging (kept ephemeral) and production; distinct JWT secrets per environment.
Annex 2 — Sub-processors
- Dodo Payments — merchant billing (merchant of record).
- MSG91 — SMS delivery (India DLT).
- Apple Wallet + APNs — iOS pass rendering and push updates.
- Google Wallet — Android pass rendering.
- Sentry — application error monitoring.
- Cloudflare R2 — encrypted off-box backup storage.
- [LEGAL REVIEW — SMTP provider, e.g. Gmail / Postmark] — transactional email delivery.
- [LEGAL REVIEW — hosting provider, e.g. CloudStick] — production infrastructure (VPS hosting Postgres, Redis and application containers).
Annex 3 — Contact
Data protection contact: [LEGAL REVIEW — DPO / grievance officer name, email, phone].