Data processing agreement

Last updated: 31 October 2026

This agreement is part of the terms between you (the controller) and Kuppo (the processor).

What we process

• People: your customers and your staff.
• Data: names, email addresses, stamps, rewards, visit times, sign-up source, offers consent, Wallet device tokens.
• Purpose: running your loyalty card, for as long as you use Kuppo.

What we promise

• We only process this data on your instructions, as given through the product and these terms.
• Everyone with access is bound to confidentiality.
• We use appropriate security, including encrypted connections, hashed passwords and session tokens, access limits and backups.
• We help you answer requests from people about their data; the dashboard has export and anonymise for this.
• We tell you without undue delay if we find a personal data breach that affects your data.
• When you delete your account we delete this data, apart from what the law requires us to keep.
• You may audit our compliance on reasonable notice, normally by reviewing documentation.

Sub-processors

You allow us to use the sub-processors below. We will tell you before adding or replacing one, and you may object.

• Vercel, Frankfurt (Germany)
• Neon, Frankfurt (Germany)
• The email provider configured for service messages
• Apple and Google, for Wallet passes

If data leaves the EEA, we rely on an adequacy decision or standard contractual clauses.

Contact: hello@heykuppo.com