Data processing agreement

Concluded electronically at signup, with a timestamp and a hash of this version stored alongside the account.

Parties

The participating shop named at signup as the controller; FOLLOWPASS, operated by the person named in the imprint, as the processor.

1. Subject and duration

FOLLOWPASS handles digital vouchers over Instagram messages for the shop: issuing, abuse protection, redemption and statistics. For as long as the shop account exists.

2. Nature, purpose, categories

Hashed Instagram account ids, voucher and redemption events with location and time, and the follow status in transit only, which is not stored. Data subjects are customers of the shop who scan the code.

3. Instructions

Processing happens only to deliver the service and on the documented instructions of the shop. Configuration inside the product counts as an instruction.

4. Confidentiality

Everyone involved in the processing is bound to confidentiality.

5. Security under Art. 32

TLS throughout, account ids hashed with a secret pepper, access tokens stored encrypted, access only through authenticated accounts, daily backups, servers in the EU.

6. Sub-processors

The hosting provider of the server, inside the EU. Changes are announced in the product and the shop may object. Meta is not a sub-processor but a controller in its own right for Instagram.

7. Data subject rights

FOLLOWPASS supports the shop with the functions in the product: deletion on request from the chat, export, and information about what is stored.

8. Deletion at the end

When the account ends, personal data is deleted within 30 days. Aggregated figures without personal reference may remain.

9. Evidence

On request, FOLLOWPASS provides the information needed to demonstrate compliance with this agreement.