Data processing agreement

1. Scope, roles and precedence

This data processing agreement (the “DPA”) is made between Gemifier d.o.o., of {registered address} (“Gemifier”), and the Customer. It forms part of the terms of service, takes effect on {effective date}, and applies wherever Gemifier processes personal data on the Customer's behalf in providing the Service.

• Gemifier is a processor of End User personal data, and processes it only on the Customer's documented instructions.
• The Customer is the controller and determines the purposes and means. Where the Customer is itself a processor for another controller, it warrants that it has authority to give the instructions in this DPA.
• Gemifier is a controller for Authorised User account data, billing contact data and website visitor data. That processing is described in the privacy policy and sits outside this DPA.

Terms defined in the terms of service carry the same meaning here. “Personal data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach” carry the meaning given by the applicable data protection law, and “sub-processor” means a third party engaged by Gemifier to process personal data on the Customer's behalf. On any question about the processing of personal data this DPA prevails over the terms of service and over the Order, and nothing here overrides mandatory law.

2. Instructions

Gemifier processes personal data only on the Customer's documented instructions. Those instructions are the terms of service, this DPA, the Order, the acceptable use policy, the configuration the Customer creates in the Service, and the requests the Customer's systems and Authorised Users make through the APIs and the dashboard. There is no separate instruction channel in the product. A request the Customer makes is the instruction.

If Gemifier considers that an instruction infringes applicable data protection law, it will tell the Customer and may suspend performance of that instruction. Gemifier will process outside the Customer's instructions only where required by a law binding on it, and will inform the Customer first unless that law prohibits it.

Instructions requiring work beyond the functionality of the Service may be charged at Gemifier's then-current rates, notified before the work starts.

3. Subject matter and purpose

The subject matter, duration, nature and purpose of the processing, and the categories of data subject and of personal data, are set out in Annex I.

4. Confidentiality of personnel

Every person Gemifier authorises to process personal data under this DPA is bound by a written obligation of confidentiality that survives the end of their engagement, is informed of the confidential nature of the data, and is given access only to what their role requires. Administrative access to production systems is controlled operationally. No product feature exposes Customer Data to Gemifier.

5. Security measures

Gemifier implements and maintains the technical and organizational measures set out in Annex II, having regard to the state of the art, the cost of implementation, and the nature, scope, context and purposes of the processing. Annex II is an obligation to implement those measures, not a warranty that the Service cannot be compromised. Gemifier may change them provided the change does not materially reduce the overall level of protection.

6. Data subject rights

Gemifier has no relationship with End Users and does not communicate with End Users by any channel. A request from a data subject relating to personal data processed for a Customer will not be answered substantively: Gemifier will forward it to that Customer within five business days of identifying which Customer it concerns, and will then act only on that Customer's instruction.

What Gemifier can identify. Gemifier holds the identifier the Customer chose for an End User and the records associated with it. Whether that identifier is pseudonymous is the Customer's decision. Gemifier holds nothing else by which to identify a data subject, and cannot connect a request to a record without the identifier, so a request under this section must name the Environment and the identifier. Where Gemifier is not in a position to identify a data subject, Article 11 of the GDPR applies.

Access and portability. The Customer can retrieve the records associated with an identifier through the read APIs and the dashboard, and is best placed to answer an access request itself. There is no bulk export, download or report generation feature, so where the Customer cannot obtain what it needs, Gemifier will provide reasonable assistance with a one-off extract on request.

Rectification and restriction. The Customer can amend attribute values and configuration through the Service. The points ledger, the event history and the purchase record are append-only: a correction is written as a new entry and the original is never edited or removed.

Erasure. There is no self-service deletion of an End User in the Service. On the Customer's written instruction to business@gemifier.io identifying an Environment and an identifier, Gemifier will delete the records associated with that identifier within {platform data deletion window}. This is an operational commitment carried out by Gemifier's personnel, not an automated process, and it is subject to the backup position in section 12 and to records Gemifier must keep by law. Two limits apply:

• The per-day activity record. The Service records, for each day, which identifiers were active. It is kept on the separate basis of billing and dispute resolution for {billing record retention}, and erasing an End User's substantive records does not remove it.
• Deactivation is not deletion. Configuration objects such as missions, streaks and catalog items are deactivated rather than deleted, so historical records keep a valid reference. That applies to configuration only, never to an erasure instruction.

7. Security and assessments

Taking into account the nature of the processing and the information available to Gemifier, Gemifier will give the Customer reasonable assistance with its obligations to secure the processing, to notify personal data breaches, to carry out data protection impact assessments, and to consult a supervisory authority in advance where required.

As Annex II records, the Service keeps no record of who read a particular record, so which individual records were seen during an incident cannot be reconstructed from the Service.

8. Personal data breach

Gemifier will notify the Customer without undue delay, and in any event within {breach notification window} of becoming aware of a personal data breach affecting personal data processed for that Customer. Notice goes by email to the contact the Customer names in the Order.

The notice will describe, so far as known, the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, the measures taken or proposed, and a contact point, being business@gemifier.io or {security contact}.

Where the full picture is not available at first, Gemifier will provide further information in stages and will cooperate reasonably with the Customer's own notifications to a supervisory authority and to data subjects, which remain the Customer's to make. Gemifier's ability to determine which records were accessed is limited by the logging described in Annex II, and a notice under this section is not an admission of fault or of liability.

9. Sub-processors

The Customer gives Gemifier a general written authorisation to appoint sub-processors. The current list, with the purpose and location of each, is the sub-processor list, and the list as it stands on the date of the Order is authorised on that date. Gemifier imposes on each sub-processor, by written contract, obligations no less protective than those in this DPA, and remains fully liable for each of them.

Gemifier will give at least {sub-processor notice period} notice before adding or replacing a sub-processor, by updating the published list and by written notice to the contact the Customer names in the Order. That notice is sent by a person: the Service sends no product notification. The Customer may object on reasonable data protection grounds within the notice period, and the parties will discuss it in good faith. If it cannot be resolved, the Customer may terminate the affected part of the Service without penalty, with a refund of pre-paid unused fees.

An endpoint the Customer registers for outbound delivery is not a sub-processor. The destination is chosen and controlled by the Customer, and a delivery to it is a transfer the Customer directs to a system it is responsible for. Gemifier refuses destinations that resolve to a private, loopback, link-local or reserved address. The acceptable use policy requires the Customer to register an encrypted destination; the Service will accept one that is not encrypted, so this is a Customer obligation rather than a control Gemifier enforces.

10. International transfers

Gemifier is established at {registered address}. Personal data processed under this DPA is hosted in {hosting region} with {hosting provider}, and is processed by the sub-processors on the published list in the locations it states. Where no adequacy decision covers Gemifier's place of establishment, the hosting region or a sub-processor's location, the safeguards in this section apply and are load-bearing rather than a formality.

Where a transfer is subject to a transfer restriction under the applicable data protection law, {transfer mechanism, e.g. Standard Contractual Clauses} applies as follows.

• European Union and EEA. The standard contractual clauses approved by Commission Implementing Decision (EU) 2021/914 are incorporated by reference to the official text published by the European Commission. Module Two applies where the Customer is a controller and Module Three where the Customer is itself a processor. The Customer is the data exporter and Gemifier is the data importer. The docking clause applies, the optional dispute resolution clause is not selected, and sub-processors are handled under section 9. Governing law and forum for the clauses are as stated in the Order, within a Member State as the clauses require. The competent supervisory authority is {supervisory authority}.
• United Kingdom. The International Data Transfer Addendum issued by the Information Commissioner under section 119A of the Data Protection Act 2018 applies to those clauses for transfers subject to the UK GDPR, with its tables completed by reference to this DPA and its annexes.
• Switzerland. Where Swiss law applies, the clauses apply with the amendments recognised by the Federal Data Protection and Information Commissioner.
• Annexes. Annex I of this DPA completes Annex I of the clauses, Annex II completes Annex II, and the sub-processor list is the authorised list.

Gemifier's representative under Article 27 of the GDPR is {EU representative} and its representative under the UK GDPR is {UK representative}. A signed copy of the clauses is available from business@gemifier.io.

Transfer impact. What Gemifier holds is limited to the categories in Annex I, which include no special category data and no payment instrument or card data, though a Number property on an event may be a monetary amount. Gemifier has no arrangement with any public authority for access to personal data. Where one requests access, Gemifier will notify the Customer unless legally prohibited, will challenge the request or the prohibition where there are grounds, and will disclose no more than is legally required.

11. Audit

Gemifier will make available the information necessary to demonstrate compliance with this DPA and with Article 28 of the GDPR, including Annex II and a completed security questionnaire, on reasonable request and not more than once in any twelve-month period.

The Customer, or an independent auditor it appoints who is not a competitor of Gemifier and is bound by confidentiality, may audit that compliance on reasonable written notice, at the Customer's cost, during business hours, limited to the processing carried out for that Customer, and without access to any other customer's data. It may be carried out more often only where a supervisory authority requires it or following a breach affecting the Customer.

Gemifier holds no security certification. There is no SOC 2 report, no ISO 27001 certificate and no equivalent to offer in place of an audit.

12. Return and deletion

On expiry or termination of the Order, and at the Customer's election, Gemifier will return or delete the Customer Data containing personal data.

• Return is effected by the Customer retrieving its data through the read APIs during {export window} after termination. There is no export or download feature, so where that is not enough, Gemifier will provide reasonable assistance with a one-off extract on request.
• Deletion takes place within {platform data deletion window} after the export window closes. As with erasure under section 6, it is manual work by Gemifier's personnel.
• Backups. Any copies held in backups are not deleted individually. They age out within {backup expiry period} and remain subject to this DPA for as long as they exist.
• Retention required by law. Gemifier may keep personal data where a law binding on it requires that, limited to what is required. Billing records are kept for {billing record retention} and operational logs for {operational log retention}.

Gemifier will certify deletion in writing on request.

13. Liability

Liability under this DPA is subject to, and counts towards, the exclusions and limits of liability in the terms of service, including any separate limit stated there for data protection claims. This DPA creates no second liability regime, and nothing in this section limits a data subject's rights under the applicable data protection law or either party's liability to a supervisory authority.

Annex I. The processing

This annex completes Annex I of the clauses referred to in section 10.

The categories of personal data are enumerated below. They define the perimeter of what Gemifier has agreed to receive; anything outside it is sent at the Customer's risk and outside its documented instructions.

• an identifier for an End User, chosen by the Customer, and an optional time zone identifier;
• attribute definitions the Customer creates and the values recorded against them: text, a number, a true or false value, or a date;
• event records: the time the Customer states the event occurred, the time it was received, an optional idempotency key, and the typed properties the Customer declared for it;
• points records: an append-only ledger of movements with a cause, an optional free-text reason typed by the Customer's staff, and a balance;
• reward grants and marketplace purchases, including the price in points, the delivery status, and any reversal and its recorded reason;
• mission progress, streak progress, runs and milestone records;
• leaderboard rank, score and standing, and the display attribute the Customer chooses to send for it; Gemifier stores and returns it exactly as received, and the Customer's own product decides whether and how to display it;
• per-day activity records used for usage measurement, naming an individual identifier for each day it was active;
• media assets the Customer uploads, including the original file name and the uploading user;
• delivery and processing state, including any error text returned by the Customer's own endpoint;
• for Authorised Users: name, work email address, a password hash, organization and role, invitation records, and session credential records held as hashes.

A points adjustment made by hand in the dashboard creates an End User record where none existed, so the dashboard as well as the Customer's systems is a source of records. Free-text fields, including attribute values, adjustment reasons and file names, accept whatever the Customer puts in them, and Gemifier does not inspect their contents.

Annex II. Security measures

This annex completes Annex II of the clauses and is the contractual security statement for the Service.

What is implemented

• Segregation. Each customer organization's data is held in an isolated database schema that is pinned on every connection. The organization is taken from the signed access token or the hash of the API key, never from a route, header or body field, and the schema name comes only from an internal organization identifier. A connection with no organization resolved fails rather than falling back. This is logical segregation inside one shared database instance.
• Machine credentials. API keys are 256 bits of randomness and bound to one Environment. API keys are displayed once at creation and stored by Gemifier only as a cryptographic hash; Gemifier cannot recover a key. Revocation is immediate and removes the routing record, so a revoked key resolves to nothing.
• Human credentials. Passwords are stored using a salted, iterated, algorithm-versioned password hash. Access tokens are short-lived and carry identity only, and permissions are read from the database on every request, so a permission change takes effect immediately. Refresh tokens are held only as hashes, rotated on every use, and grouped so that reuse of a rotated token revokes the whole family.
• Authorisation. A permission model is enforced before any handler runs, separating viewing from managing, with roles the Customer defines.
• Cross-tenant surface. The internal administrative API exposes one write operation and no cross-tenant read operation, and Gemifier personnel accounts resolve no customer schema. Gemifier requires no access to the Customer's databases, networks or infrastructure, and will not request it.
• Outbound delivery. Deliveries are signed with a keyed hash over a timestamped payload, carry a delivery identifier for de-duplication, and use a rotating secret with an overlap window. Redirects are not followed. A destination is refused at registration and again at connection time where it resolves to a private, loopback, link-local or reserved address.
• Ingest controls. Event properties must be declared in advance, and an undeclared key or a type mismatch is rejected. A maximum number of events may be sent in one request, and a limit applies to how many requests one organization may have in flight.
• Media. A fixed allow-list of image types with scriptable formats excluded, and per-file and per-organization storage limits. Uploads go directly to storage on a short-lived signed URL.
• Transport. Traffic to the APIs and the dashboard is served over an encrypted connection, terminated at a reverse proxy. Outbound delivery to a destination the Customer registers is not covered by that: see section 9.
• Error reporting. Where it is enabled, personally identifying data is disabled at source, query strings are removed before transmission because they can carry an identifier, and credential headers are stripped. Exception text and structured log data are not scrubbed. Reports are held for {error report retention}.

What is not implemented

• There is no security certification. Gemifier is not certified to SOC 2 or ISO 27001, holds no certification against payment card industry standards, and makes no claim to any security certification.
• There is no multi-factor authentication, no single sign-on and no federated identity for the dashboard. Dashboard sign-in is an email address and a password.
• Account email addresses are not verified, and there is no self-service password recovery. Gemifier cannot restore access to an account.
• There is no audit log, and the Service does not record who read a particular record. Application logging records the operation performed, the acting user identifier, timing and any error, and does not record request bodies or End User identifiers. Logs are kept for {operational log retention}.
• Any encryption at rest is that of {hosting provider} and the storage provider rather than of the application, which performs no field-level encryption. Signing secrets for outbound delivery are stored in a recoverable form because a signature needs the key material, and are shown to the Customer once.
• There is no automatic retention, purge or anonymisation schedule, and no deletion of an End User the Customer can perform for itself. Deletion is the commitment in sections 6 and 12.
• Sandbox holds separate data and separate keys from Live, but shares one database instance and one deployment with it. It is not an isolated system and should not be used with production personal data.
• A media asset marked public at upload is readable by anyone holding its address, with no credential, and is cached for a long time. Visibility is fixed at upload, and deleting an asset does not purge copies already cached. An asset attached to a mission, streak or catalog item cannot be deleted until it is detached.
• Backup arrangements are those of {hosting provider}. Gemifier operates no backup regime of its own and gives no recovery point or recovery time commitment.

Annex III. Sub-processors

The sub-processors authorised under section 9 are those named on the sub-processor list, which states the purpose, the processing carried out and the location of each. It is not reproduced here, and changes to it are governed by section 9.