Data Processing Agreement

Last updated: Oct 4, 2026

This Data Processing Agreement ("DPA") forms part of the SeeYou Terms of Service ("Agreement") between Numiya Ltd, trading as SeeYou (also referred to as SeeYou Loyalty), a company registered in England and Wales with company number 17442191, whose registered office is at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ ("Processor", "SeeYou", "we", "us"), and the business that has accepted the Agreement ("Controller", "you").

By accepting the Agreement, the Controller accepts this DPA.

1. Definitions

In this DPA:

• "Data Protection Laws" means the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003, each as amended from time to time (including by the Data (Use and Access) Act 2025), and the EU GDPR where applicable.
• "UK GDPR" has the meaning given in section 3(10) of the Data Protection Act 2018.
• "Personal Data", "Processing", "Data Subject", "Controller", "Processor" and "Personal Data Breach" have the meanings given in the UK GDPR.
• "Customer Data" has the meaning given in the Agreement.
• "Controller Personal Data" means Personal Data within Customer Data that SeeYou processes on behalf of the Controller.
• "Special Category Data" means special category data under Article 9 of the UK GDPR, and criminal offence data under Article 10, including data concerning health.
• "Services" means the SeeYou digital loyalty platform provided under the Agreement.
• "Sub-Processor" means any third party appointed by SeeYou to process Controller Personal Data.

2. Scope and instructions

2.1 SeeYou shall process Controller Personal Data only to provide, maintain and secure the Services, as described in Schedule 1.

2.2 SeeYou shall process Controller Personal Data only on the Controller's documented instructions, including with regard to transfers outside the United Kingdom, unless required to do so by law. In that case, SeeYou shall inform the Controller before processing, unless the law prohibits this on important grounds of public interest. The Agreement, this DPA and the Controller's use and configuration of the Services are the Controller's documented instructions.

2.3 SeeYou shall immediately inform the Controller if, in its opinion, an instruction infringes Data Protection Laws.

2.4 SeeYou shall not sell Controller Personal Data, use it for its own purposes or combine it with other customers' data, except to create aggregated, anonymised statistics that do not identify any individual.

3. Controller obligations

3.1 The Controller shall:

• (a) have a lawful basis for all Controller Personal Data it collects or enters into the Services;
• (b) provide its customers with a privacy notice at the point of sign-up, using the privacy notice link provided in the Services;
• (c) ensure that its instructions comply with Data Protection Laws;
• (d) be solely responsible for any communications it sends to its customers, including compliance with direct marketing law. SeeYou does not provide marketing functionality and does not collect marketing consent.

3.2 The Services are not designed to store Special Category Data. The Controller shall not enter, upload or record Special Category Data in any part of the Services, including free-text notes. This includes information about health, medical conditions, pregnancy and treatment contraindications.

3.3 If the Controller enters Special Category Data in breach of clause 3.2, it does so at its own risk and remains solely responsible for having a lawful basis and appropriate safeguards for that data. SeeYou shall have no liability for any claim, loss or regulatory action arising from Special Category Data entered in breach of clause 3.2, and may delete such data where it becomes aware of it.

4. Obligations of the Processor

SeeYou shall:

• (a) ensure that all personnel authorised to process Controller Personal Data are bound by confidentiality obligations, and that access is limited to authorised SeeYou personnel for support, security, maintenance, legal compliance or at the Controller's request;
• (b) implement the security measures set out in clause 6;
• (c) comply with the conditions for engaging Sub-Processors in clause 5;
• (d) taking into account the nature of the processing, assist the Controller by appropriate technical and organisational measures in responding to requests from Data Subjects;
• (e) assist the Controller in complying with Articles 32 to 36 of the UK GDPR (security, breach notification, data protection impact assessments and prior consultation), taking into account the nature of the processing and the information available to SeeYou;
• (f) at the Controller's choice, delete or return Controller Personal Data at the end of the Services in accordance with clause 11, and delete existing copies unless the law requires retention;
• (g) make available to the Controller all information reasonably necessary to demonstrate compliance with Article 28 of the UK GDPR, and allow audits in accordance with clause 10.

5. Sub-Processors

5.1 The Controller gives general written authorisation for SeeYou to engage Sub-Processors. Current Sub-Processors are listed in Schedule 2.

5.2 SeeYou shall inform the Controller of any intended addition or replacement of a Sub-Processor at least 14 days before the change takes effect, by email or by updating Schedule 2 on its website, giving the Controller the opportunity to object.

5.3 If the Controller objects on reasonable data protection grounds, the parties shall discuss the concern in good faith. If it is not resolved within 30 days, the Controller may terminate the affected Services without penalty and receive a pro-rata refund of any prepaid fees for the remaining period.

5.4 SeeYou shall impose on each Sub-Processor, by written contract, the same data protection obligations as set out in this DPA, in particular sufficient guarantees of appropriate technical and organisational measures.

5.5 SeeYou remains fully liable to the Controller for the performance of each Sub-Processor's obligations.

6. Security

6.1 SeeYou shall implement and maintain technical and organisational measures appropriate to the risk, in accordance with Article 32 of the UK GDPR, including:

• (a) encryption of Personal Data in transit (TLS 1.2 or higher) and at rest (AES-256);
• (b) logical isolation between customer accounts enforced by row-level security;
• (c) multi-factor authentication, where supported, for administrative access to production systems;
• (d) monitoring, vulnerability management and error logging configured to minimise Personal Data.

6.2 SeeYou may update these measures, provided the overall level of security is not materially reduced.

7. Personal Data Breach

7.1 SeeYou shall notify the Controller without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting Controller Personal Data.

7.2 The notification shall describe, as far as then known:

• (a) the nature of the breach, including the categories and approximate numbers of Data Subjects and records concerned;
• (b) the likely consequences;
• (c) the measures taken or proposed to address the breach and mitigate its effects.

Where information is not available at once, SeeYou shall provide it in phases without undue further delay.

7.3 SeeYou shall reasonably cooperate with the Controller in investigating and containing the breach and in notifying the ICO and affected Data Subjects where required.

8. Data Subject requests

8.1 SeeYou shall forward to the Controller, within 3 business days, any request it receives directly from a Data Subject relating to Controller Personal Data.

8.2 On the Controller's written request, SeeYou shall provide an export of the relevant Controller Personal Data in a commonly used machine-readable format (such as CSV) without undue delay, and in time to allow the Controller to respond to the Data Subject within the applicable statutory deadline.

8.3 SeeYou shall not respond directly to Data Subject requests except on the Controller's documented instructions or where required by law.

9. International transfers

9.1 The database and application servers for the Services are hosted in the United Kingdom (London).

9.2 The Controller authorises transfers of Controller Personal Data outside the United Kingdom to the Sub-Processors listed in Schedule 2, provided each transfer is covered by one of the following safeguards:

• (a) UK adequacy regulations for the destination country;
• (b) the UK Extension to the EU-US Data Privacy Framework, where the recipient is certified;
• (c) the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

10. Audits

10.1 SeeYou shall make available to the Controller information reasonably necessary to demonstrate compliance with this DPA.

10.2 On at least 30 days' written notice, the Controller may request documentation or conduct an audit, or appoint an independent auditor, to verify compliance with this DPA.

10.3 Audits shall take place during normal business hours, no more than once in any 12-month period (unless following a Personal Data Breach), and shall minimise operational disruption. Auditors must sign binding confidentiality agreements before any inspection. The Controller shall bear the cost of any audit, unless it reveals a material breach of this DPA by SeeYou.

11. Term, return and deletion

11.1 This DPA remains in force for as long as SeeYou processes Controller Personal Data.

11.2 On cancellation or termination of the Agreement:

• (a) for 30 days, the Controller may request an export of its Customer Data, which SeeYou shall provide in a commonly used machine-readable format (such as CSV) without undue delay;
• (b) after that 30-day period, SeeYou shall permanently delete or anonymise all Controller Personal Data, except where the law requires retention;
• (c) SeeYou shall stop updating the Controller's wallet passes and, where the wallet platform allows, mark them as expired.

12. Liability and governing law

12.1 Each party's liability under this DPA is subject to the limitations, exclusions and caps in the Agreement.

12.2 This DPA is governed by the laws of England and Wales. The courts of England and Wales have exclusive jurisdiction over any dispute arising from it.

Schedule 1: Details of processing

• Subject matter: provision of a cloud-based customer loyalty platform, including customer sign-up, stamp and reward tracking, prepaid package tracking, and Apple Wallet and Google Wallet pass delivery.
• Nature of processing: collection through the sign-up page, storage, display, updating, wallet pass generation and update notifications, export and deletion.
• Purpose: to enable the Controller to operate its loyalty programmes and track its customers' prepaid packages.
• Duration: for the term of the Agreement, plus 30 days after termination for data export.
• Frequency: continuous.
• Categories of Data Subjects:
  • the Controller's customers (loyalty programme members and package holders);
  • the Controller's staff who use the Services.
• Types of Personal Data:
  • Customer data: name (required); email address (optional, provided by the customer at sign-up or added by the Controller); phone number (optional, added by the Controller); loyalty pass identifier; stamp, reward and package balances; visit, transaction and redemption timestamps; free-text notes entered by the Controller; wallet pass state; device push tokens used to update passes; IP address and browser information when using the sign-up page.
  • Staff data: name, work email address, role, password hash, IP address and login activity.
• Special Category Data: none. The Controller must not enter Special Category Data (clause 3.2).

Schedule 2: Authorised Sub-Processors