Data Processing Agreement (DPA)

1. Purpose and parties

This Data Processing Agreement (« DPA ») is an annex to the Terms and Conditions of Sale; it details Article 13 of those Terms (personal data and processing). It applies from the creation of an account and for as long as the Platform is used.

• The Merchant: any natural or legal person holding a Goodly account, acting as controller of its end customers' data.
• Goodly: Ermal Ibraj, trading under the business name « Goodly », domiciled in Belgium, reachable at contact@goodly.be, acting as processor within the meaning of Article 28 GDPR.

2. Data processed and data subjects

The Merchant's end customers

• First and last name
• Email address
• History of stamps, points and rewards
• Wallet card identifier (Apple Wallet or Google Wallet)
• The other data described in section 2 of the privacy policy where used (optional phone number, language, communication preferences, customer ID of the connected point of sale).

Store buyers, through the Shopify app (if the Merchant installs it)

• Buyer's name and email address, used to find their loyalty card
• Amount and date of paid orders, together with the Shopify order and customer identifiers

The Merchant's staff (point-of-sale access)

Access code, action log, timestamp, IP address, device and, if the proximity check is enabled, approximate location — as provided in Article 13.1 of the Terms.

3. Single purpose

Goodly processes this data for one purpose only: running the Merchant's loyalty programme (cards, stamps, points, rewards, Wallet notifications, the Merchant's campaigns and statistics, matching sales from the connected point of sale or store when the Merchant has enabled it).

Goodly does not sell, rent or reuse this data for its own purposes. It is processed only on the Merchant's documented instructions; use of the Platform and its settings constitutes such instructions.

4. Confidentiality

Access to production data is reserved for authorised Goodly personnel bound by confidentiality, and limited to what is necessary to provide the service, deliver the support requested by the Merchant or handle an incident.

5. Security

Goodly implements the following technical and organisational measures, detailed on the Security and incident response page:

• Encryption of data in transit (HTTPS/TLS)
• Encryption at rest (AES-256) of the database, provided by Supabase
• Daily encrypted database backups, kept for 7 days
• Data isolation per merchant (Row Level Security)
• Access to production data restricted to authorised personnel
• Logging of access to personal data
• Hashed passwords, never stored in plain text
• Signature (HMAC) verified on every webhook received from Shopify

6. Sub-processors

The Merchant gives general authorisation for the following sub-processors. Point-of-sale integrations only receive data if the Merchant enables the connection themselves.

This list matches the one in the privacy policy. Goodly informs the Merchant of any addition or replacement of a sub-processor, allowing the Merchant to raise reasonable objections. Goodly imposes on each sub-processor data protection obligations equivalent to those of this agreement.

7. Data subject rights

Goodly assists the Merchant in responding to requests from its customers (access, rectification, erasure, portability, objection):

• Tools built into the dashboard: CSV export and deletion of a customer
• Assistance by email at contact@goodly.be
• Shopify — customers/data_request: on receipt of this webhook, Goodly sends the Merchant the extract of sales linked to that customer, so the Merchant can answer them
• Shopify — customers/redact: on receipt of this webhook, Goodly deletes that customer's Shopify sales and the link between their Shopify account and their card; the loyalty card itself belongs to the Merchant and remains in place

When a person contacts Goodly directly, Goodly informs the Merchant or handles the request on its instructions.

8. Personal data breach

Goodly notifies the Merchant concerned within 72 hours of discovering a personal data breach affecting it, providing the information available: nature of the breach, categories and approximate number of data subjects and records concerned, likely consequences and measures taken or proposed. This information is supplemented as the investigation progresses.

The procedure followed is described on the Security and incident response page.

9. End of contract and data deletion

• Account deletion: at the Merchant's request (from its settings or by email), the account and all data of its customers and staff (cards, history, campaigns, logs) are deleted from the database immediately. Copies held in backups disappear with their automatic 7-day rotation.
• End of subscription without deletion: Goodly does not automatically delete an inactive or suspended account; the data is kept until the Merchant requests deletion (Article 10 of the Terms).
• Data from Shopify: deleted on receipt of the shop/redact webhook, which Shopify sends 48 hours after the app is uninstalled (Shopify sales, customer ↔ store links, store references). The Goodly account, its cards and its customers remain unless deletion is requested.
• The Merchant's billing data: kept for 10 years under Belgian accounting and tax obligations (Goodly then acts as controller).

Other periods are detailed in the data retention policy.

10. Information and audit

Goodly makes available to the Merchant the information necessary to demonstrate compliance with this agreement and answers its written questions within a reasonable time.

11. Contact

For any question about this agreement: contact@goodly.be