iVendNext Data Processing Addendum

This iVendNext Data Processing Addendum (the DPA) is part of the iVendNext Cloud Terms of Service (the Terms) between the customer (you) and the CitiXsys company that is party to the Terms (CitiXsys, we, us). Words defined in the Terms have the same meaning here.

1. Definitions

• Data Protection Law: every law on personal data that applies to the processing under the Terms, including the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, India’s Digital Personal Data Protection Act 2023, US state privacy laws, Singapore’s Personal Data Protection Act 2012, South Africa’s Protection of Personal Information Act 2013, Kenya’s Data Protection Act 2019 and the data protection laws of the United Arab Emirates.
• Customer Personal Data: personal data in Your Data that we process for you under the Terms.
• Subprocessor: a third party, including a CitiXsys group company, that we engage to process Customer Personal Data.
• Security Incident: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
• SCCs: the standard contractual clauses for transfers to third countries approved by the European Commission in Decision (EU) 2021/914.
• Controller, processor, data subject, processing and personal data have the meaning Data Protection Law gives them, and include the equivalent terms of each law (for example data fiduciary and data processor in India, responsible party and operator in South Africa, organisation and data intermediary in Singapore).

2. Roles

2.1 You decide; we process for you. For Customer Personal Data, you are the controller (or, where you act for your group companies, a processor for them) and we are your processor.

2.2 Your partner. An iVendNext partner that administers or implements your site does so for you, under your agreement with it. It is your processor, not ours.

2.3 Our own data. For the personal data of your account holders that we use to run our relationship with you (contacts, billing, support tickets), we are a controller under our Privacy Policy.

2.4 Apps we host for their makers. Where the iVendNext Developer Terms apply this DPA to an app we host for its maker under an App Hosting order, the maker is you in this DPA, the maker’s own customers are the controllers, and the maker is their processor.

3. How we process Customer Personal Data

3.1 On your instructions. We process Customer Personal Data only on your documented instructions: the Terms, your Orders, your and your users’ use of iVendNext, and other written instructions we agree. If the law requires other processing, we tell you first, unless the law forbids it.

3.2 If an instruction breaks the law. We tell you if we think an instruction infringes Data Protection Law.

3.3 Never for ourselves. We do not sell or share Customer Personal Data, and we do not use it for our own purposes, for advertising, or to train models for other customers. Statistics about how iVendNext is used that identify no one are not Customer Personal Data.

3.4 Our people. Everyone we allow to process Customer Personal Data is bound to keep it confidential.

4. Security

We keep the technical and organisational measures in Annex 2, appropriate to the risk. We may improve them; we will not reduce the overall protection they give.

5. Subprocessors

5.1 Authorisation. You authorise us to use the Subprocessors listed on the iVendNext Subprocessors page at legal.ivend.com (Annex 3).

5.2 A new Subprocessor. We give at least 30 days’ notice before a new Subprocessor starts processing Customer Personal Data, by updating that page and by e-mailing everyone who has asked us, at the address on that page, to be told of changes.

5.3 Your objection. You may object on reasonable data-protection grounds within those 30 days. We will try to find a solution with you. If we cannot, you may end the affected subscription by notice, and we refund the fees you prepaid for the time after the end.

5.4 Same duties, our responsibility. Each Subprocessor is bound by a written contract with data-protection duties no less protective than this DPA, and, where it is in a country without an adequacy decision, by the SCCs (Module 3) or another transfer safeguard Data Protection Law accepts. We remain responsible to you for its performance.

6. Security Incidents

6.1 Notice. We tell you without undue delay, and within 48 hours of confirming a Security Incident.

6.2 What we tell you. What happened, the data and data subjects likely affected, the likely consequences, what we have done and will do, and a contact. Where we do not yet know everything, we tell you what we know and follow up.

6.3 What we do. We take reasonable steps to contain the incident and limit its effects, and we help you meet your own notification duties. Our notice is not an admission of fault.

7. Helping you

Taking into account what we can see and do, we help you: answer requests from data subjects to exercise their rights (most can be met with iVendNext’s own tools); carry out data protection impact assessments and prior consultations; and respond to a supervisory authority. Help beyond what the product’s tools and ordinary support give may be charged at our usual rates.

8. Return and deletion

8.1 At the end. For 30 days after your subscription ends, you can export Customer Personal Data from your site, and on request we give you a full export in a standard format.

8.2 Then deletion. After those 30 days, we delete Customer Personal Data from your site, unless the law requires us to keep it. Copies in backups are deleted as the backups age out, within 90 days.

8.3 Proof. On request, we confirm the deletion in writing.

8.4 On the till. A till or handheld keeps on the device what it needs to sell offline: the catalogue and prices, the sales waiting to be sent, and, unless you switch it off, a list of customers (by default those who have bought at that store) with their names, phone numbers and tax numbers. This data is not encrypted on the device. It is removed the next time the device connects after you revoke it in your site. The devices are yours: keep them secure, and revoke or wipe a device you stop using.

9. Audits

9.1 Information first. On request, once a year, we answer your reasonable written security questionnaire and give you the summaries of any independent audit or test reports we hold, under confidentiality.

9.2 An audit. Where that information is not enough to show we meet this DPA, or a supervisory authority requires it, or after a Security Incident, you (or an independent auditor bound to confidentiality) may audit our compliance, on 30 days’ notice, during business hours, without disrupting our other customers, at your cost, at most once a year.

10. Where data is held, and transfers

10.1 Hosting region. Your site is hosted in the AWS region named in your Order, or, if your Order names none, in the region we tell you when your site is created. If your Order buys hosting in a local region, your site’s data is hosted there.

10.2 Apps that we host. Some apps in the iVendNext App library run as services that CitiXsys hosts on AWS in the United States, whatever your site’s region. When you enable one, it receives the data from your site that it needs to work, as the app’s description says. If your data must stay in your country, check the app’s description, or ask us, before you enable it.

10.3 Access from elsewhere. Our support and engineering staff and our Subprocessors may access Customer Personal Data from the countries listed in Annex 3, only as needed to provide iVendNext and Support.

10.4 The SCCs. Where Customer Personal Data subject to the GDPR is transferred to a country without an adequacy decision, the SCCs apply and are part of this DPA:

• Module 2 (controller to processor) where you are a controller and Module 3 (processor to processor) where you are a processor, when you are the exporter and we are the importer;
• Module 4 (processor to controller) where we are established in the European Economic Area and return or make Customer Personal Data available to you outside it;
• Clause 7 (docking clause) applies;
• Clause 9: option 2 (general authorisation), with the notice period in Section 5.2;
• Clause 11: the optional wording does not apply;
• Clause 13: the supervisory authority is the one that governs the exporter, or where the exporter has no establishment in the European Economic Area, the one of the member state where its representative is, or Ireland’s where it needs none;
• Clauses 17 and 18: the law and courts of Ireland;
• Annexes I and II of the SCCs are Annexes 1 and 2 of this DPA, and Annex III is Annex 3.

10.5 United Kingdom. For transfers subject to UK law, the UK Information Commissioner’s International Data Transfer Addendum to the SCCs applies, with the details in this DPA; either party may end it only as Section 19 of that Addendum allows.

10.6 Switzerland. For transfers subject to Swiss law, the SCCs apply with the Swiss Federal Data Protection and Information Commissioner as the authority, Swiss law where the Swiss law requires it, and “member state” read to include Switzerland.

10.7 Other countries. Where another country’s Data Protection Law restricts transfers, the commitments in this DPA are our commitments for that transfer, and we sign any further transfer terms that law requires and that are no more onerous than the SCCs.

11. Other laws

11.1 United States. For US state privacy laws, we are your service provider or processor. We do not sell or share Customer Personal Data, do not retain, use or disclose it outside our direct business relationship with you or for any purpose other than providing iVendNext, and do not combine it with personal data from others except as those laws allow. We comply with those laws and give Customer Personal Data the protection they require; you may take reasonable steps to stop and remedy any use of it they do not allow. We tell you if we can no longer meet these duties.

11.2 India. Under India’s Digital Personal Data Protection Act 2023, you are the data fiduciary and we are your data processor, and this DPA is the contract between us that the Act requires.

11.3 South Africa, Singapore, Kenya and the United Arab Emirates. You are the responsible party and we are your operator (South Africa); you are the organisation and we are your data intermediary (Singapore); you are the data controller and we are your data processor (Kenya and the United Arab Emirates). In each, this DPA is the written contract that law requires between you and us.

11.4 Elsewhere. Where any other Data Protection Law requires a contract between a controller and its processor, this DPA is that contract.

12. Special kinds of data

12.1 Health data. Prescription and dispensing records are processed only where the iVendNext Pharmacy version is licensed or an optical prescription app is used. Where the US Health Insurance Portability and Accountability Act applies, our business associate agreement governs that data and prevails over this DPA for it.

12.2 Biometric data. iVendNext processes no biometric data unless the Documentation says a feature does.

12.3 Payment cards. Cards are read on your payment provider’s terminal. iVendNext keeps only the card brand, last four digits, expiry and the provider’s references.

13. Liability and precedence

13.1 Liability. Each party’s liability under this DPA is subject to the limits in the Terms, except where Data Protection Law or the SCCs do not allow a limit.

13.2 Precedence. If there is a conflict, the SCCs (where they apply) prevail over this DPA, and this DPA prevails over the Terms.

13.3 Term. This DPA lasts as long as we process Customer Personal Data for you.

---

Annex 1: Description of the processing

Item	Description
Data exporter	You, the customer, as named in your Order; contact: your account’s owner
Data importer	CitiXsys, as named in your Order; contact: the privacy address on the iVendNext Subprocessors page
Data subjects	your shoppers and loyalty members; your staff and other users of iVendNext (cashiers, store managers, desk users, handheld operators); contacts at your suppliers and business customers; anyone else whose data you put into iVendNext
Categories of data	identity and contact details (name, phone, e-mail, address, and where you record them, date of birth, gender and other details you choose); loyalty and customer account data (membership, points, gift cards, store credit); purchase, return and payment history (for cards, only the brand, last four digits, expiry and the payment provider’s references); staff data (name, role, sign-in identity, PIN (kept only as a hash), badge code, time on the till, sales performed); supplier and business-customer contacts; notes and other content you enter; technical data from devices (device identifiers, IP addresses, logs)
Sensitive data	prescription and dispensing records, only where the iVendNext Pharmacy version is licensed or an optical prescription app is used (restricted to the pharmacy’s users who need them, logged); no other special category unless the Documentation says a feature supports it
Frequency	continuous, for as long as you use iVendNext
Nature and purpose	hosting, storing, backing up, synchronising with your tills and handhelds, processing transactions and records as you use iVendNext, sending the e-mails you set iVendNext to send, providing support, and keeping iVendNext secure and available
Duration and retention	the Subscription Term, plus the 30 days in Section 8.1, plus the backup retention in Section 8.2
Location	the AWS region in Section 10.1; backups, apps we host and support access as Section 10.2 and Annex 3 say

Annex 2: Security measures

Area	Measure
Separation	each customer has its own site, with its own database
Encryption in transit	connections between tills, handhelds, browsers, connectors and your site are encrypted (TLS)
Access by your users	permissions by role, which your administrators control; an individual sign-in for each user; cashiers’ PINs stored only as hashes; a badge code cleared when the badge is revoked
Access by our staff	only people who need it for their role
Hosting	Amazon Web Services, in the region in Section 10.1
Backups	regular backups of your site, kept for the period in Section 8.2
Continuity at the till	iVendNext POS keeps selling when your site cannot be reached, and posts the sales when it reconnects
Devices	a till or handheld keeps only what offline selling needs (Section 8.4); you can keep your customer list off the devices with the setting Require Encrypted Customer Book At Rest; a revoked device’s offline data is removed when it next connects
People	everyone with access is bound to confidentiality
Incident response	a process for Security Incidents, with the notice in Section 6
Subprocessors	bound by Section 5.4

Annex 3: Subprocessors

Annex 3 is the iVendNext Subprocessors page at legal.ivend.com, as updated under Section 5.