Data Processing Agreement (draft)

The proposed agreement covers personal information SmartTap processes on the subscriber's documented instructions to host and operate configured client/card journeys and support reseller management. The subscriber may be a controller or a processor acting for a local-business controller. Where it acts as processor, it must have authority to appoint SmartTap as a subprocessor and pass on lawful instructions. Roles depend on the actual arrangement.

SmartTap separately acts as controller for its own account authentication, billing, fraud prevention, security, support and legal records, as described in the Privacy Policy. External review, email, WhatsApp and SMS services have their own arrangements; they are not automatically SmartTap subprocessors. Feedback message bodies are prepared in the visitor's browser and are not intentionally stored in the Portal database.

The completed service contract, configured settings and authorised written support requests document instructions. The controller determines the purposes, lawful basis, privacy notices, accuracy, publication authority and retention instructions. The subscriber must obtain the local business's authority for any processing or public content it configures.

SmartTap will process instructed data only on documented lawful instructions, including for international transfers, unless required by applicable law. Where permitted, it will inform the controller of that legal requirement before processing. It will promptly notify the controller if an instruction appears to infringe applicable data-protection law.

Enabled public content is available to anyone with the Smart URL. Feedback destinations are public; an empty Feedback Email uses the general contact email where feedback is enabled. Publish only approved guest Wi-Fi credentials, never staff or router-admin credentials. Disabling publication cannot erase external copies; rotate exposed credentials where needed.

SmartTap will ensure authorised personnel are bound by confidentiality obligations and limit access to what is necessary. It will implement appropriate technical and organisational security measures taking account of risk and the nature of processing, and assist the controller with applicable security obligations.

The security schedule must describe the actual access controls, tenant isolation, protected credentials, publication controls, transport protection, incident response and backup/recovery arrangements. Current product controls include authenticated Portal access, ownership restrictions and limited public configuration payloads. This draft does not certify every operational control or promise a particular infrastructure plan.

SmartTap will appoint subprocessors only with the controller's prior specific or general written authorisation and under contracts imposing the applicable equivalent data-protection obligations. SmartTap remains responsible to the controller for its appointed subprocessors' performance of those obligations.

Under general authorisation, SmartTap will give prior notice of intended additions or replacements and an opportunity to object on reasonable data-protection grounds. The completed schedule must specify the notice period and contact procedure. Unresolved objections must be addressed through an appropriate alternative or orderly termination and return/deletion arrangements under the completed contract.

Current hosting/storage dependencies include Supabase and Vercel. Before adoption, the schedule must identify each appointed legal entity, service, processing/access locations and applicable international-transfer mechanism. Naming a provider is not proof that its contract or transfer safeguards have been verified. Restricted transfers will occur only on lawful documented instructions and with applicable safeguards.

Taking account of the nature of processing and available information, SmartTap will assist the controller with data-subject requests, security and personal-data breach obligations, data-protection impact assessments and regulator consultations. It will promptly forward requests concerning instructed data and will not disclose another reseller's information or decide the controller's response without authority.

SmartTap will notify the controller without undue delay after becoming aware of a personal-data breach affecting instructed data. It will provide available details of the incident, affected data, likely consequences, mitigation and contact arrangements, supplementing those details as more information becomes available.

SmartTap will make information necessary to demonstrate compliance available and allow and contribute to legally required audits, including inspections by the controller or its mandated auditor. Coordination of security, confidentiality, scope and reasonable notice must not defeat statutory audit rights or urgent justified assessment.

At the controller's choice, SmartTap will return or delete instructed personal data when those processing services end, and delete copies unless applicable law requires storage. Subscription expiry alone is distinct from an instruction to end all processing, where lawful read-only storage for export or renewal continues.

Ownership and authority must be verified. Eligible account/client data, assets and public configuration must be addressed together, with provider and backup copies handled under the completed operational schedule. Any legally required retained records will be identified, restricted and processed only for the justified purpose. Immediate removal from every CDN, backup, clipboard or external downloaded file is not promised.

The available Portal CSV is a settings export, not an importable backup or a complete personal-data access response. Return arrangements must explain available formats and limitations. SmartTap domains and redirect infrastructure are not transferred through a CSV export.

Once incorporated, the completed agreement will take precedence over conflicting general contract terms for instructed processing to the extent required by data-protection law. Mandatory data-subject and regulator rights remain unaffected.

This draft does not alter an existing subscription, record acceptance, authorise a new provider or establish a liability cap. The completed operator/provider/security/retention schedule and its interaction with the Terms must be reviewed before contractual adoption.