Data processing terms

Who these terms cover

These data processing terms form part of the terms of service between you, the merchant, and Monty Digital Limited, company number 14388429, of 11 Worboys Road, Worcester, WR2 4JJ, United Kingdom. For your customers' personal data, you are the controller and we are your processor.

These terms apply under the UK GDPR, the Data Protection Act 2018 and, where applicable, the EU GDPR. They take precedence over the terms of service if there is a conflict about processing this data. Our privacy policy separately covers information we control, such as your account, our billing and business correspondence.

What we process and why

• Subject and purpose. Running your referral programme, including customer verification, attribution, participation rules, reporting, qualifying payments and billing rewards.
• People covered. Your customers who refer, are referred, or take part in programme moments and asks, and people whose details you provide when asking us for programme support.
• Data covered. Stripe customer and connected-account identifiers, email addresses used for referral access, referral links and codes, customer eligibility and participation status, moment and ask records, attribution, qualifying payments, refunds, disputes and rewards. Payment records contain amounts and status, not card numbers.
• Operations. Collecting, recording, storing, checking, linking, retrieving and reporting these records, sending requested access-verification emails, applying your reward rules and deleting or returning data on your instructions.
• Duration. While we provide the service to you and until data is returned or deleted as described below. Do not send special-category data, criminal-offence data or information unrelated to the programme.

Your instructions and responsibilities

We process customer data only on your documented instructions, including for international transfers. These terms, your programme settings and your authorised use of the service are those instructions. Send further instructions to [email protected]. We will tell you if we believe an instruction infringes applicable data protection law.

If the law requires other processing, we will tell you before doing it unless the law prohibits that notice. You are responsible for your lawful basis, privacy notices, data accuracy and the lawfulness of the instructions and programme rules you give us.

Confidentiality and security

We will restrict access to people who need it to provide the service and ensure they are bound by confidentiality obligations. We will maintain technical and organisational measures appropriate to the risks, taking account of the nature of the data and the processing.

Our application measures include encrypted connections, account-scoped database access with row-level security, server-only integration credentials, encrypted Stripe authorisation secrets, signed and time-limited referral-access tokens, and request limits. We will assess these measures regularly and maintain procedures for responding to incidents and restoring access to data when needed.

Service providers

You give general written authorisation for the providers listed in our privacy policy to process data for the purposes described there. This includes Supabase for data and access, Vercel for hosting, Brevo for requested emails, PostHog for limited diagnostics and analytics, and Google Workspace for support correspondence. PostHog events use internal identifiers, not your customers' email addresses or raw Stripe identifiers.

We will bind each subprocessor to data protection obligations no less protective than these terms and remain responsible for its performance of those obligations. Before adding or replacing one, we will give you reasonable advance written notice and an opportunity to object on data protection grounds. If we cannot resolve a reasonable objection, you may end the affected service before the change takes effect.

Your connected Stripe account is provided under your own agreement with Stripe. Stripe's roles under that agreement are separate from our processing on your behalf. Stripe also processes our own subscription billing.

International transfers

We will only transfer customer data outside the UK or EEA where applicable data protection law permits it. Where required, we will use an adequacy decision or appropriate safeguards, such as the European Commission's standard contractual clauses with the UK International Data Transfer Addendum for restricted UK transfers. The provider information describes hosting locations and the providers' transfer terms. You can ask us for information about the safeguards that apply.

Requests, assessments and incidents

• We will help you respond to data-subject requests, taking account of the nature of the processing. If we receive a request about your customer data, we will pass it to you and not respond on your behalf unless instructed by you or required by law.
• Taking account of the processing and information available to us, we will help you meet your obligations relating to security, breach notifications, data protection impact assessments and consultation with regulators.
• We will notify you without undue delay after becoming aware of a personal data breach affecting your customer data. We will provide available information about what happened, the affected data and people, likely consequences and measures taken or proposed, with updates as we learn more.

Returning and deleting data

When our processing service ends, we will, at your choice, return or delete your customers' personal data and delete existing copies, including those held by subprocessors, unless the law requires retention. Our retention policy sets a 30-day deadline after account closure for account and referral records. Cancelling a subscription or disconnecting Stripe is not account closure. Data that must be kept by law will remain protected and will only be used for that legal purpose. Contact [email protected] to give return or deletion instructions.

Information and audits

We will provide information needed to demonstrate compliance with these terms and Article 28 of the GDPR, and allow and contribute to audits and inspections by you or an independent auditor you appoint. We will agree practical arrangements that protect other customers' data and the security of the service, without preventing you from meeting your legal obligations.