Data processing agreement

This agreement is part of our terms of service between your business ("you") and Bentorno, run by the provider named in our Impressum ("we"). It applies whenever we process personal data on your behalf, and meets the requirements of Article 28 of the GDPR. You accept it with the terms of service.

For your cards and your team, you are the controller and we are your processor. For the accounts we run ourselves, such as your customers' Bentorno accounts and your owner account, we are the controller, as our privacy policy explains; this agreement doesn't cover them. Words such as "personal data", "processing" and "controller" have the meaning the GDPR gives them.

We process the data only on your documented instructions: these terms and this agreement, and what you do in the dashboard. Your standing instructions include:

• when a customer deletes their Bentorno account, to unlink your cards from them, keeping the cards' history without anything that links it to them, and to delete the record of which updates they opened;
• when you ask us, to delete a removed team member's account, which removing them in the dashboard keeps.

We don't process the data for any other purpose, unless the law requires it; then we tell you first, unless the law forbids that. We tell you at once if we think an instruction breaks data protection law. We never sell the data, use it for advertising or for our own purposes, or combine it with data from elsewhere, except to make anonymous statistics that identify no one.

You are responsible for the lawfulness of the processing: you need a legal basis for it, and you tell your customers and your team how their data is used. You can use this text, adjusted to your business:

We run our loyalty card with Bentorno. When you join our card, we see your name, a shortened form of your email, your Bentorno code and your visits, stamps and rewards with us, to run the card and see how our customers come back. Bentorno processes this data for us. More in Bentorno's privacy policy: bentorno.com/legal/privacy.

Don't enter special categories of data (such as health data), identity or payment card numbers, or data about any customer under 18 into Bentorno, including in free text such as updates and reward names. Keep your team's accounts and devices secure. Check that the measures in this agreement meet your needs, and tell us if they don't.

We protect the data with technical and organisational measures that fit the risk, taking into account the state of the art and the cost (Article 32 of the GDPR); the current measures are listed in Our security measures. We may update them, as long as the protection doesn't get weaker. Everyone who has access to the data on our side is bound to keep it confidential.

• Encryption: every connection to Bentorno is encrypted (HTTPS).
• Passwords and sign-in: passwords are stored only as argon2id hashes; one-time codes, emailed links and session keys only as hashes. Sign-in attempts are limited, and sessions end after a set time without use.
• Cookies: sign-in cookies can't be read by scripts, are sent only over encrypted connections, and are not sent along by other sites in the background.
• Access: each business sees only its own data; team members see only what their role allows; on our side, access is limited to what each person needs for their work.
• Requests from other sites: signed-in writes are accepted only from our own apps, and our pages can't be shown inside other sites.
• Data minimisation: businesses see customers' emails only shortened; birthdays are stored without the year; our logs shorten IPv6 addresses and never record codes, passwords or searches.
• Hosting: in the EU, at Railway, with backups kept apart from the live data.
• Incidents: we keep logs to find errors and misuse, and handle incidents as described in Help with requests and breaches.

You allow us to use subprocessors. We use:

We give each subprocessor the same data protection obligations as this agreement, and we are responsible for them as for ourselves. We tell you by email at least 30 days before we add or replace a subprocessor. You can object for a reason related to data protection; if we can't solve it together, you can end the agreement before the change applies, and get back what you paid for the time after it.

We transfer personal data outside the EU only as Chapter V of the GDPR allows. Transfers to Railway, Resend and Cloudflare in the US rely on the EU-US Data Privacy Framework, under which all three are certified, and on the EU's standard contractual clauses; transfers to another country without an adequacy decision, where Cloudflare's network may handle a request, rely on those clauses. If your business is outside the EU, the EEA or a country with an adequacy decision, we agree the standard contractual clauses for processor-to-controller transfers with you on request. You can ask us for a copy of the safeguards we use. If a transfer mechanism stops being valid, we switch to one that is, and tell you.

• Requests from people: if someone asks us to use a right about data we process for you, we pass it on to you without delay and don't answer it ourselves. The dashboard lets you see, correct and delete the data, and we help with what it can't do.
• Breaches: we tell you without undue delay, and at the latest within 48 hours, after we become aware of a breach of the security of your data, with what we know: what happened, the data and people concerned, the likely consequences and what we are doing about it. We add more as we learn it, in time for you to meet your own deadlines. A notice is not an admission of fault.
• Other duties: we help you with security, impact assessments and consultations with authorities, as far as our part of the processing allows.
• Authorities: we tell you about any request from an authority for your data, unless the law forbids it.

Help that goes beyond what the service does, and isn't caused by our own breach, we may charge at reasonable cost, agreed with you first.

We don't use the data to train or improve AI models. The service makes no decisions with legal or similarly significant effects on people automatically; the customer groups in the dashboard only show you how your customers come back.

The data stays in your account until you delete it, also after your subscription ends. You can ask us at any time for an export in a common, machine-readable format. You can delete all of your business's data in the dashboard's settings, which removes it from our database at once, or ask us to delete it at [email protected], also after your agreement has ended; until you do, keeping the data is your instruction. Copies in backups are deleted as the backups expire. We keep data after that only where the law requires us to, and then only for that purpose. We confirm the deletion on request.

We give you the information you need to show that this agreement is kept. You, or an independent auditor bound to confidentiality, can also inspect our compliance, with reasonable notice, during business hours and without disrupting our operations, usually once a year unless there is a reason to do so more often. Each side bears its own costs of an audit.

Liability under this agreement follows our terms of service; the rights of the people concerned under the GDPR are not limited. If this agreement and the terms of service differ on personal data, this agreement wins. We may change it where the law or our subprocessors require it, without lowering the protection, and tell you by email at least 30 days before; you can object and end the agreement before the change applies, and get back what you paid for the time after it. Notices go to the email address of your account; you can reach us at [email protected].

This agreement applies as long as your agreement with us runs, and afterwards for as long as we still process personal data for you.