Data Processing Agreement

Subject matter, parties and order of precedence

This agreement governs how we process personal data that we process on your behalf (Art. 28 GDPR). That data — the data described in Annex 1, in particular your guests’ and your staff’s data — is referred to in this agreement as “Processed Data”. It does not include the data listed in the last paragraph of this section.

You are the controller: the business that issues the stamp card to its guests. We are the processor: Printproof UG (haftungsbeschränkt), Beim Schlump 15, 20144 Hamburg, Germany, registered in the commercial register of the local court of Hamburg under HRB 199187, represented by its managing director Dennis Achtziger. Contact for anything arising from this agreement: support@treubar.de. Treubar was previously called “Treuly”; the renaming changes neither the parties nor the content of this agreement, and instructions or notifications sent to the previous address support@treuly.de continue to reach us.

Under § 10 of the Terms of Service, this agreement becomes part of the contract for the use of Treubar when that contract is concluded. The version we had published when the contract was concluded applies (currently at https://www.treubar.de/en/dpa, in German at https://www.treubar.de/avv), together with any amendments that have taken effect under § 14; on request to support@treubar.de we provide it and earlier versions to you in text form. The contract language is the language determined under § 4 paragraph 4 of the Terms of Service; the version of this agreement in the contract language prevails.

If this agreement and the Terms of Service conflict, this agreement prevails for the processing of personal data.

Not covered by this agreement is the data for which we are the controller ourselves: your account, contract and billing data; any order for an NFC display stand; the connection data in our server logs, which we process for the secure operation of our service (§ 2 of the privacy policy); usage data from our applications for businesses (product analysis, § 6 of the privacy policy); the push tokens of our iOS app for businesses (§ 2 of the privacy policy); and your staff’s personal Treubar logins (§ 1a of the privacy policy). Our privacy policy at https://www.treubar.de/en/privacy applies to that.

Duration

This agreement starts with the contract for the use of Treubar and ends with it. No separate termination is needed, and none is possible.

The obligations of confidentiality (§ 6) and of erasure or return (§ 12) survive the end of the contract.

Nature and purpose of the processing, types of data, categories of data subjects

The nature and purpose of the processing, the types of personal data processed and the categories of data subjects are set out in Annex 1.

We process this data solely in order to run Treubar for you — not for our own purposes. We do not build advertising profiles of our own from the Processed Data, we do not pass it to third parties other than the sub-processors listed in Annex 3 and the services named there that they in turn engage, and we do not sell it.

Your rights and obligations as controller

You decide on the purposes and means of the processing and are responsible for its lawfulness. You may request information about the processing and issue instructions (§ 5) at any time; you may verify compliance with this agreement in accordance with § 13.

In particular, it is for you to: inform your guests and your staff under Art. 13 and 14 GDPR; obtain and evidence any necessary consents — including for push messages and campaigns under § 7 UWG (German Act against Unfair Competition); define the participation terms of your loyalty programme (§ 9 of the Terms of Service); answer requests from your guests and your staff (§ 10); and maintain your own record of processing activities under Art. 30 (1) GDPR.

You alone decide what data you enter into Treubar. That applies in particular to free-text fields such as a guest’s display name, which appears instead of their name in Treubar and on the guest’s card — on the back of the Apple Wallet pass and in the Google Wallet object (§ 9): whatever is written there, we process without reviewing it. Special categories of personal data under Art. 9 GDPR — health data, for example — do not belong in Treubar; the application is neither intended nor set up for them.

Give us a point of contact for matters arising from this agreement. Unless you name one separately, these are the email addresses of your business’s admin accounts. Keep them current — a notification under § 11 goes to the named contact and to all admin accounts.

Processing on documented instructions

We process the Processed Data only on your documented instructions. This also applies to any transfer to a third country (§ 9). It is otherwise only the case where we are required to process by Union or German law; in that event we inform you of the legal requirement before processing, unless the law prohibits that.

Your first instruction is the feature set of the plan you booked, together with the settings you make in Treubar: the design of the card, the reward, your locations, your team’s access, the campaigns and automations you trigger, and the use of an NFC display stand. What you set there, you thereby instruct.

Further or differing instructions are given in text form to support@treubar.de. We document them. Where an instruction goes beyond the scope of service owed under the contract, we may charge the reasonable additional effort; we tell you before that effort arises.

If we consider an instruction to infringe data protection law, we inform you without undue delay. We may suspend execution until you confirm the instruction.

Confidentiality of the persons involved

Access to the Processed Data is granted only to those who need it for their task.

Every person who works with that data on our behalf is placed under a written obligation of confidentiality before starting work, unless they are already subject to a statutory duty of secrecy (Art. 28 (3) (b) GDPR). That obligation survives the end of their work for us.

We instruct those persons in the data protection obligations that apply to them.

Security of processing (Art. 32 GDPR)

We take all technical and organisational measures required under Art. 32 GDPR, and at least those described in Annex 2. Annex 2 describes the state as at the version date given above.

Technology ages, so we are allowed to develop these measures further. The level of protection must not fall below that of Annex 2. Any material change is recorded in a new version of this agreement.

Sub-processors

You give us general authorisation to engage the sub-processors listed in Annex 3 (Art. 28 (2) sentence 2 GDPR).

If we intend to add a further sub-processor or replace an existing one, we announce it at least 30 days in advance in text form to the contact named under § 4. You may object to the change on data protection grounds within 14 days of receiving the announcement. If you object and the service cannot reasonably be provided without the sub-processor concerned, either party may terminate the contract with effect from the date the change takes effect; fees paid in advance are refunded pro rata for the period not provided.

We bind every sub-processor by contract to data protection obligations substantially equivalent to those in this agreement (Art. 28 (4) GDPR). Where a sub-processor fails to meet its obligations, we remain liable to you for its conduct as for our own.

Ancillary services that have no connection to the Processed Data — telecommunications, postal services or the cleaning of business premises, for example — are not sub-processing within the meaning of this section.

Processing outside the EU

The database holding the Processed Data is located in the European Union. Data does, however, also reach third countries where a sub-processor processes it there or accesses it from there.

In particular: if a guest picks Google Wallet on the enrolment page, we immediately create a wallet object at Google — even if the guest then does not save the card in Google Wallet. It contains the name Treubar displays at that time (first and last name, or a display name your team has set), the full serial number of the pass in the QR code and its first eight characters as the account number, the stamp balance, the card design, the coordinates of your locations, where applicable the guest’s personal stamping link (“Jetzt stempeln”), and later the text of the messages sent to the pass in your name; we keep transmitting changes to the stamp balance. § 10 applies to deletion. If the card is in Apple Wallet, we send Apple’s push service only the device’s push token and a contentless notification so that the device fetches the pass from us again; we do not transmit the name or the stamp balance in the process. Every connection to our API — including the details from the card’s enrolment form — passes through the network of Cloudflare, Inc. (USA), which our hosting provider Render places in front of its service; Cloudflare accepts the encrypted connection and forwards it to our server in Frankfurt am Main. Your team signs in through our authentication provider, Clerk, Inc. (USA); on your behalf, Clerk processes which business and which role an account is assigned to.

For recipients established in the USA we base the transfer on the adequacy decision for the EU–US Data Privacy Framework where the recipient is certified under it, and otherwise on Standard Contractual Clauses under Art. 46 (2) (c) GDPR. On request to support@treubar.de we tell you, for each recipient, what the transfer is based on and send you a copy of the Standard Contractual Clauses agreed.

Assistance with requests from data subjects

You fulfil your guests’ and your staff’s rights under Art. 15 to 22 GDPR; we assist you with appropriate technical and organisational measures (Art. 28 (3) (e) GDPR).

On the Start, Pro and Max plans you can do the following inside Treubar without involving us: view a guest’s name (or the display name that replaces it), birthday, cards and most recent stamping and redemption events (access); set, change or remove a display name for them and correct the stamp balance of their cards (admins and managers); and delete a guest (admins) — with their cards, their stamping and redemption history, the registered wallet devices and the link to their browser. Log entries of the NFC display stands remain afterwards without any link to the deleted guest. Admins can also export the guest list with first and last name, display name and date of birth, and your business’s 5,000 most recent stamping events, as a table (CSV). The view and the export do not contain everything we store — among other things no email address collected in the past — and the export contains no redemptions.

These functions are not available on the Free plan. There, and on every plan for anything you cannot do yourself (such as correcting a guest’s first and last name or date of birth, or access to details that the view and the export do not contain), we do it for you: on your request to support@treubar.de we provide all details stored about a guest in a structured, commonly used and machine-readable format, correct them or delete the guest as you instruct — free of charge and without undue delay. For assistance going beyond that we may charge the reasonable additional effort; we tell you beforehand.

You handle requests from your staff in team management: view accounts, change role and location, disable or remove an account. When an account is removed, its name, email address and role remain stored so that it stays traceable who issued stamps. On request to support@treubar.de we correct the name or email address or erase the details of a removed account; its stamps and redemptions then remain without attribution.

If a guest or a member of your team contacts us directly, we do not answer the request on the merits; we refer them to you and inform you without undue delay. Where the request concerns data for which we are the controller ourselves (§ 1), we answer it ourselves.

There is one limitation you need to know about: a wallet object created at Google (§ 9) cannot be deleted — Google issues immutable object IDs and provides no delete operation. When you delete a guest, we automatically set their Google Wallet object to “inactive”; when you delete your account, this happens for the objects of all passes of your business. When we delete a guest on your request, we also set their object to “inactive”. Google then shows a card saved there in the guest’s wallet under expired passes, with the details last transmitted, including the name, until the guest removes it. If the inactivation fails, we carry it out on request to support@treubar.de without undue delay, at the latest within 30 days. An Apple Wallet pass already issued stays on the guest’s device until they remove it there; after the deletion we no longer update it.

Assistance with security, data breaches and impact assessments

We assist you in meeting the obligations under Art. 32 to 36 GDPR — within the scope of the information available to us and taking into account the nature of the processing (Art. 28 (3) (f) GDPR).

If we become aware of a personal data breach affecting the Processed Data, we report it to you without undue delay, and at the latest within 48 hours of becoming aware, in text form to the contact named under § 4 and to the email addresses of all admin accounts of your business. The report contains, as far as known to us: the time or period of the breach and the time we became aware of it, the nature of the breach, the systems concerned and any sub-processor involved, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures we have taken or propose to take, whether the police or other authorities are involved, and a contact person for follow-up questions. Anything we do not know at first, we supply as soon as we do.

Notifying the supervisory authority under Art. 33 GDPR and communicating with the data subjects under Art. 34 GDPR are for you to do. The 72-hour period runs for you from your own awareness; that is why we report early, and also where we have not yet fully established what happened.

If you need details of our processing for a data protection impact assessment (Art. 35 GDPR) or a prior consultation with the supervisory authority (Art. 36 GDPR), we provide them on request.

Erasure or return after the end of the contract

The end of the contract within the meaning of this section is the end of the entire contract for the use of Treubar, not merely the end of a paid plan. If you cancel only a paid plan, your account continues on the Free plan (§ 6 paragraph 4 of the Terms of Service); we then continue to process the Processed Data under this agreement until you delete it or the contract as a whole ends — for example because you delete your account, terminate the contract, or we terminate the Free plan under § 6 paragraph 2 of the Terms of Service.

After the end of the contract we either erase the Processed Data or return it to you — your choice. If you tell us nothing else by the end of the export window, we erase it.

How it runs: after the end of the contract we provide your data to you on request in text form in a common machine-readable format for 30 days (the export window; § 7 paragraph 1 of the Terms of Service). After that we erase it from the production systems within a further 30 days. If you delete your account yourself, we erase within 30 days of that deletion. If you cannot delete your account yourself because an order for an NFC display stand belongs to your business, a message to support@treubar.de is enough; if the order is still being processed, write to us once it has been delivered or refunded. We then erase the Processed Data and keep the order records only as required by statutory retention obligations (see below).

Data held in backups is overwritten as part of the ordinary backup cycle. Until then we block it from any further processing; it is restored only in an emergency, and never in order to bring erased data back.

What we are legally required to retain is reserved: where Union or German law obliges us to retain records — in particular § 147 AO (German Fiscal Code) and § 257 HGB (German Commercial Code) — we keep the records concerned for the duration of the period and, until then, use them only to meet our retention obligations. That concerns invoice, accounting and order data from our own contractual relationship with you, not your guests’ stamp cards.

Wallet passes already issued stay on your guests’ devices until they remove them themselves. After the end of the contract we no longer update them and no longer accept stamps.

We confirm the erasure in text form on request to support@treubar.de.

Evidence and audits

We make available to you all information needed to demonstrate compliance with the obligations under Art. 28 GDPR (Art. 28 (3) (h) GDPR) — in particular the current version of Annexes 2 and 3, and information on them in text form.

We maintain a record of the categories of processing activities carried out on behalf of controllers (Art. 30 (2) GDPR) and make it available to you on request.

You may verify that we comply with this agreement — yourself or through an auditor appointed by you, including by an on-site inspection at our business premises. Without specific cause, such an audit may take place once per calendar year; beyond that, at any time where there are indications of non-compliance, after a personal data breach (§ 11), or where a supervisory authority requires you to carry out the audit. We allow for and contribute to the audit, in particular by providing information, making the necessary documents available and — during an on-site inspection — granting insight into the procedures, settings and logs relevant to the processing of your data; we do not disclose other businesses’ data in the process. You announce an on-site inspection at least 14 days in advance, or with reasonably shorter notice where there are indications of non-compliance or after a data breach; it takes place during normal business hours and must not unreasonably disrupt our operations. We may reject a direct competitor of ours as auditor. You treat as confidential whatever you learn about our business and our security measures during the audit, and you bind your auditor to confidentiality as well. We may charge the reasonable effort of an on-site audit where we have told you so beforehand.

Audits that a supervisory authority is empowered to carry out remain unaffected.

Liability, amendments and final provisions

§ 12 of the Terms of Service applies accordingly to liability, unless Art. 82 GDPR mandatorily provides otherwise.

Amendments to this agreement must be made in text form. § 7 applies to Annex 2 and § 8 to Annex 3; otherwise § 14 of the Terms of Service applies.

The law of the Federal Republic of Germany applies. The exclusive place of jurisdiction is Hamburg, provided you are a merchant, a legal entity under public law or a special fund under public law.

Should any provision of this agreement be or become invalid, the validity of the remaining provisions is unaffected.

Annex 1 — Nature and purpose of the processing, types of data, data subjects

Nature and purpose of the processing: running a digital stamp and loyalty card on your behalf. This covers: issuing wallet passes to your guests (Apple Wallet, Google Wallet); counting stamps by QR scan, by NFC display stand or by manual entry from your team; redeeming rewards; recovering a card after a device change; recognising a guest’s browser, so that a tap on the NFC display stand is assigned to their card and a guest who enrols again on the same device with the same details gets their existing card back; sending push messages and campaigns in your name, including selecting recipients by criteria such as birthday, stamp balance, inactivity or location; providing insights in your business dashboard; managing your team’s access to your business; and storing and backing up that data.

Categories of data subjects: • your guests, who receive a stamp card • visitors to your card’s pages (entry via QR code or link, enrolment page, card recovery, NFC display stand), even if they do not create a card — for them in particular the browser identifier, the details their browser transmits to Google when the pages load (Google Fonts, Annex 3), what they enter when recovering a card and, if they tap an NFC display stand, the details of that tap • the staff for whom you create access to Treubar

Your guests’ data: • first name, last name and date of birth — the three mandatory fields of the card’s enrolment form • a display name your team can set for a guest (free text, for example as a note); it replaces the name in Treubar and on the guest’s card (§ 4) • an email address only for cards enrolled before 26 August 2026, while the form still asked for one; it is no longer collected for new cards • pass identifiers: the serial number of the pass, the credential with which the guest’s device identifies itself to the wallet service, and the identifier in the guest’s personal stamping link (“Jetzt stempeln”) • stamping and redemption data: the time of each stamp, the route used (QR scan, NFC display stand, manual), the location, the member of your team who issued it, the current stamp balance, and the time and subject of each redemption • wallet device identifiers: the device identifier assigned by Apple and the push credential of each device holding the pass; for Google Wallet the identifier of the object created there • messages: the text of the messages you send to your guests’ passes through campaigns or automations, and the time they were delivered • browser identifier and NFC: a random, signed identifier of the browser in the treuly_bid cookie, which we set on the first visit to a page of your card and refresh on every further visit (entry via the QR code or a link to the stamp card, enrolment page, card recovery, “Jetzt stempeln” on the card, the page of an NFC display stand), even if you do not use an NFC display stand; lifetime 400 days from the last visit; its link to the guest’s card at your business on our server as soon as the guest creates a card, recovers it or opens “Jetzt stempeln” (the same identifier applies at all businesses); the time and outcome of each tap; when a stamp is parked, a one-time key in the treuly_park cookie (lifetime 5 minutes) and a checksum of the IP address computed with a secret key, which prevent another browser from picking up the parked stamp • when your card’s pages are opened, the IP address and technical details about the browser and operating system that the browser transmits directly to Google when loading the font (Annex 3) • error reports that Apple devices send us through the Wallet pass update service; they may contain pass identifiers

Your staff’s data: name, email address, role in the business (Admin, Manager, Scanner), assigned location, status and first sign-in of their access to your business, for Scanner accounts where applicable a permanent sign-in link (Annex 2), and the link to the stamps and redemptions they issued. The personal Treubar login itself — the account with our sign-in provider, with name, email address and sign-in credentials — we hold as a controller in our own right, because the person can also use it with another business; our privacy policy (§ 1a) applies to it. We likewise keep the change log — who changed or deleted what and when — as a controller in our own right (§ 2 of the privacy policy).

No special categories of personal data under Art. 9 GDPR are processed. Treubar is not intended for them (§ 4).

Duration of the processing: for the term of the contract. After that, § 12 applies.

Annex 2 — Technical and organisational measures (Art. 32 GDPR)

This annex describes the measures actually in place as at the version date. It deliberately also states what we do not promise.

Confidentiality • Sign-in: your team’s access to Treubar runs through our authentication provider (Annex 3). Passwords are stored and checked there; we never see them. Every request to the management functions of our API, that is from the business app and the web application, must carry a valid, time-limited sign-in credential. Reachable without sign-in are the pages and services that your guests and their wallet apps use without an account — such as card enrolment, the NFC display stand and the Wallet pass update service, where registering or fetching a pass requires that pass’s credential — as well as the invitation and sign-in links for your team and technical interfaces, for example for notifications from our payment and authentication providers. • Permanent sign-in link for Scanner accounts: for staff with the Scanner role you can create a permanent sign-in link. It stays valid as long as the account has the Scanner role and is not disabled, until you revoke it or remove the account. Whoever has the link signs in with it as that person and obtains all rights of that Scanner account — on the Start, Pro and Max plans this includes viewing the customer list with your guests’ names and dates of birth. Give it only to the person it is meant for, and revoke it if it may have been passed on. • Roles: each account carries exactly one role with a fixed set of rights (Admin, Manager, Scanner). A Scanner account can stamp, redeem and — on the Start, Pro and Max plans — view the customer list, but can neither manage accounts nor send campaigns. • Separation of businesses: whatever an account of a business retrieves or changes is restricted to that business’s data; an account belonging to another business is refused access to your data. This separation is enforced in the application — the account the application uses to reach the database bypasses the database’s own access rules. Row Level Security is additionally enabled on the tables; it takes effect for access that does not go through our application. Only we ourselves access data across businesses (see “Access by us”). • Access by us: for support and order handling we use an internal administration tool. It shows activity across businesses, including the names of your guests and the names or email addresses of your staff, and allows, among other things, changes to card design and orders. • Pseudonymisation: we show your team only a few characters of the pass identifier, never the pass’s full credential. • Encrypted keys: the cryptographic keys of the NFC display stands are held in the database in encrypted form only (AES-128-GCM).

Integrity • Transport encryption: all connections between the app, the web application, the pages your guests see and our API run exclusively over HTTPS. • Separate file store: images and logos of your cards are held in a separate store of our database provider and are served through our API. Because they are visible on the Wallet passes anyway, this store is publicly readable: anyone who knows the exact address of a file can also retrieve it directly from the provider. Only our application can write to it. None of your guests’ data is held there. • Input control: changes to master data and security-relevant operations in your team’s applications — including the deletion of a guest — are logged with the time and the person acting. • Abuse protection: a configurable minimum interval between two stamps per card, a lock against accidental double scans, and, for NFC display stands, verification of the chip’s signature and counter, which detects a cloned or replayed tap.

Availability • Operations: the API runs in Frankfurt am Main, the database in the EU (Annex 3). • Backups: database backups are created and kept automatically by our database provider, Supabase; frequency and retention follow the service tier booked there. What we do NOT promise here: a contractually assured recovery time, or a documented, regularly repeated restore test. As long as neither is evidenced, we do not claim it.

Organisation • Every person with access to Processed Data is placed under an obligation of confidentiality before starting work (§ 6). • We engage sub-processors only as set out in Annex 3 and only under contract (§ 8).

What we do not promise • We are not certified to ISO/IEC 27001 or a comparable standard, and we do not have a regular external security audit carried out. • We do not additionally encrypt individual data fields; date of birth and name are held in the database in the clear. What is encrypted is the transport and the storage at the level of our providers. • For our internal administration tool we do not currently promise either an individual sign-in with a second factor or logging of the person acting. • We do not owe a particular availability quota (§ 11 of the Terms of Service).

Annex 3 — Sub-processors

This list reflects the state as at the version date given above. Changes are announced under § 8.

• Supabase, Inc. (established in the USA) — database and file storage. Place of processing: European Union. Scope: all data listed in Annex 1. • Render Services, Inc. (established in the USA) — operation of our API and web application. Place of processing: Frankfurt am Main, Germany. Scope: all data passing through the application, plus technical logs. Render places the network of Cloudflare, Inc. (established in the USA) in front of its service; every connection to our API — including the details from the card’s enrolment form — passes through this network, which accepts the encrypted connection and forwards it (§ 9). • Clerk, Inc. (USA) — sign-in to Treubar. On your behalf Clerk processes only which business and which role an account is assigned to; the accounts themselves we process as a controller in our own right (§§ 1 and 1a of the privacy policy). Clerk does not receive your guests’ data. • Apple Distribution International Ltd. (Ireland) — push service for updating the card in Apple Wallet. Scope: the push token that Apple assigned to the guest’s device, and a contentless notification. We generate and sign the pass itself on our servers at Render (see above); the guest’s device downloads it directly from us. Apple does not receive the name, the stamp balance or any message text in the process. • Google Ireland Limited (Ireland), with Google LLC (USA) for technical operation — Google Wallet. Scope and timing: as described in § 9; the wallet object is created as soon as a guest picks Google Wallet on the enrolment page, even if the guest then does not save the card. • Google Ireland Limited (Ireland), “Google Fonts” service — the enrolment and display-stand pages your guests see load their font directly from a Google server. In doing so, your guest’s browser transmits its IP address and technical details about the browser and operating system to Google. • Plus Five Five, Inc. (“Resend”, USA) — sending emails to you and your team, such as order confirmations and status notifications for the NFC display stand. Resend does not receive your guests’ data.

Not sub-processors within the meaning of this agreement: • Stripe Payments Europe, Ltd. (Ireland) and Stripe, Inc. (USA) — they process our payments, are controllers in their own right for that, and receive none of your guests’ data. • the print and shipping providers for the NFC display stand — they receive your order and delivery data, for which we are the controller ourselves (§ 5 of the privacy policy). • the OpenStreetMap Foundation (United Kingdom) — the address lookup when entering a location or delivery address concerns only the address text you typed.

Third-country transfers: for the above recipients established in the USA we base the transfer on the adequacy decision for the EU–US Data Privacy Framework where the recipient is certified under it, and otherwise on Standard Contractual Clauses under Art. 46 (2) (c) GDPR (§ 9).