Data Processing Addendum (DPA)

This DPA applies where Loyvora processes personal data on behalf of business customers.

1. Roles

Customer is Controller; Loyvora is Processor for Customer Personal Data processed under the main services agreement.

2. Processing Details

• Purpose: subscription operations, rewards, anti-fraud, support.
• Data subjects: customer end users, administrators, support contacts.
• Data categories: identifiers, transaction metadata, device logs.

3. Confidentiality and Security

Loyvora applies technical and organizational measures, least-privilege access, and incident response procedures.

4. Subprocessors

Loyvora may use subprocessors for hosting, communications, analytics, and security; updated subprocessor lists are available on request.

5. Data Subject Requests

Loyvora provides reasonable assistance to help Customer respond to verified rights requests.

6. Incident Notification

Loyvora will notify Customer without undue delay upon becoming aware of a confirmed personal data breach affecting Customer data.

7. Return or Deletion

Upon termination, Loyvora will delete or return personal data subject to legal retention obligations.