Data Processing Addendum

At a glance

This summary is here to help you find your way around. It is not part of the DPA. If they differ, the DPA text below applies.

• Roles: the merchant is the controller (or a processor for another controller). Anafore is the processor (or sub-processor). Under Singapore’s PDPA, Anafore is a data intermediary. See clause 4.
• Laws covered: Singapore PDPA, GDPR, UK GDPR, Swiss data protection law, and any other privacy law that applies. See clause 3.
• Instructions: we process Customer Personal Data only on the merchant’s documented instructions. See clause 6.
• Deletion: after a subscription ends, we delete data from our live systems. Copies may remain in backups for up to 30 days, until those backups are deleted. See clause 9.
• Incidents: we notify the merchant without undue delay. See clause 14.
• Audits: available for GDPR Activities, on reasonable notice. See clause 12.
• International transfers: data is stored mainly in Singapore. The EU Standard Contractual Clauses (Module Two, or Module Three where the merchant is a processor) and the UK Addendum apply. See clause 17, Schedule 1 and the UK Transfer Addendum.
• Sub-processors: general authorisation, with at least 30 days’ notice of new ones. Merchants can object. See clause 18 and our subprocessor list.

How the DPA applies

• You don’t need to sign anything. The DPA forms part of our Terms of Service. It takes effect on the first day of your subscription.
• If you need a signed copy for your records, email compliance@referralcandy.com. Tell us your company’s legal name and your store URL. We will send you a copy to sign.
• To keep a copy, use “Print or save as PDF” at the top of this page.

ReferralCandy Data Processing Addendum

This Data Processing Addendum (“DPA”) is entered into between:

the customer agreeing to this DPA (the “Customer”); and

ANAFORE PTE. LTD. (UEN 200903073C), a company incorporated and registered in Singapore (“Anafore”), operating under the brand ReferralCandy,

each a “Party”, and together the “Parties”.

Background

A. The Customer and Anafore have entered into an agreement which permits the Customer to use the ReferralCandy service (the “Service”).

B. The Service is provided on the terms and subject to the conditions of the Anafore ReferralCandy Terms of Service, as amended from time to time, which can be found on the ReferralCandy website at https://www.referralcandy.com/terms (the “Terms of Service”).

C. This DPA sets out the terms on which Anafore processes Customer Personal Data on behalf of the Customer in connection with the Service.

The Parties agree as follows.

1. Effect of the data processing addendum

1.1 This DPA is an addendum to and forms part of the Terms of Service.

1.2 This DPA applies to Anafore’s processing of personal data provided to Anafore by or on behalf of the Customer, or otherwise processed by Anafore on behalf of the Customer, in connection with the Service (“Customer Personal Data”).

1.3 This DPA does not apply to Anafore’s processing of personal data about the Customer, the Customer’s personnel, or the Customer’s authorised users where Anafore processes such personal data for its own business purposes, including account management, billing, security, analytics, or service administration. Such processing is governed by Anafore’s Privacy Policy.

1.4 Save as expressly set out in this DPA, the Terms of Service remain unchanged.

1.5 In the event of any conflict between the Terms of Service, the Privacy Policy, and this DPA, the terms of this DPA will prevail to the extent of the conflict in relation to the processing of Customer Personal Data.

1.6 In the event of any conflict between this DPA and any applicable Standard Contractual Clauses, UK Addendum, UK International Data Transfer Agreement, or other mandatory transfer mechanism, the applicable transfer mechanism will prevail in respect of the relevant international transfer.

2. Term and termination

2.1 This DPA will take effect on the earlier of:

1. the date on which the Parties sign or otherwise agree to this DPA; or
2. the first day of the Customer’s subscription to the Service,

the “Effective Date”.

2.2 This DPA will continue for as long as Anafore processes Customer Personal Data on behalf of the Customer.

2.3 This DPA will survive the expiry or termination of the Customer’s subscription to the Service and will terminate only when Anafore has deleted, anonymised, or returned all Customer Personal Data in accordance with this DPA and applicable law.

3. Applicability of data protection legislation

3.1 The Singapore Personal Data Protection Act 2012 (“PDPA”) applies to Anafore’s processing of Customer Personal Data to the extent applicable.

3.2 The European Union Regulation (EU) 2016/679, the General Data Protection Regulation (“GDPR”), applies to Anafore’s processing of Customer Personal Data to the extent such processing relates to:

1. an establishment of the Customer in the European Union (“EU”), European Economic Area (“EEA”), Switzerland, or the United Kingdom;
2. the offering of goods or services to data subjects in the EU, EEA, Switzerland, or the United Kingdom; and/or
3. the monitoring of the behaviour of data subjects in the EU, EEA, Switzerland, or the United Kingdom, where that behaviour takes place in those jurisdictions,

together, the “GDPR Activities”.

3.3 To the extent the United Kingdom General Data Protection Regulation (“UK GDPR”) or the United Kingdom Data Protection Act 2018 applies to the processing of Customer Personal Data, references in this DPA to the GDPR will be interpreted to include the UK GDPR where appropriate.

3.4 To the extent the Swiss Federal Act on Data Protection or other Swiss data protection law applies to the processing of Customer Personal Data, this DPA will be interpreted to give effect to those requirements where appropriate.

3.5 If any other data protection or privacy law applies to the processing of Customer Personal Data, each Party will comply with its obligations under such law.

4. Roles of the parties

4.1 For the purposes of the PDPA, Anafore acts as a data intermediary in respect of Customer Personal Data processed on behalf of the Customer.

4.2 For the purposes of GDPR Activities, Anafore acts as a processor of Customer Personal Data.

4.3 The Customer may act as either:

1. a controller of Customer Personal Data; or
2. a processor acting on behalf of another controller.

4.4 Where the Customer acts as a processor, the Customer warrants that it has all necessary rights, authorisations, and instructions from the relevant controller to appoint Anafore as a sub-processor and to instruct Anafore to process Customer Personal Data in accordance with this DPA.

5. Customer obligations

5.1 The Customer is responsible for ensuring that it has a valid legal basis and all necessary rights, permissions, notices, and consents required to provide Customer Personal Data to Anafore and to instruct Anafore to process Customer Personal Data in accordance with this DPA.

5.2 Where the Customer acts as a controller, the Customer is responsible for complying with its obligations as controller under applicable data protection law.

5.3 Where the Customer acts as a processor on behalf of another controller, the Customer is responsible for ensuring that its instructions to Anafore are consistent with the instructions and authorisations of the relevant controller.

5.4 The Customer is responsible for ensuring that its use of the Service, including any configuration, integration, referral campaign, email content, reward structure, uploaded data, or instruction given through the Service, complies with applicable data protection law.

5.5 The Customer acknowledges that Anafore processes Customer Personal Data on behalf of the Customer and in accordance with the Customer’s instructions, except where Anafore is required to process Customer Personal Data by applicable law.

6. Customer’s instructions

6.1 Anafore will process Customer Personal Data only on documented instructions from the Customer, unless required by applicable law to process Customer Personal Data without such instructions.

6.2 The Customer instructs Anafore to process Customer Personal Data as follows:

1. to provide, maintain, secure, support, and improve the Service;
2. as further instructed by the Customer through its use of the Service, including instructions given through the ReferralCandy dashboard, integrations, APIs, support requests, or other Service functionality;
3. as set out in the Terms of Service, Privacy Policy, and this DPA; and
4. as otherwise instructed in writing by the Customer and acknowledged by Anafore as an instruction for the purposes of this DPA.

6.3 If Anafore believes that an instruction from the Customer infringes applicable data protection law, Anafore will inform the Customer without undue delay, unless prohibited from doing so by applicable law.

7. Processing details

7.1 Anafore will process Customer Personal Data in accordance with the following processing details.

Subject matter

Providing the Service to the Customer pursuant to the Terms of Service, and as further instructed by the Customer through its use of the Service.

Duration

The duration of the Customer’s subscription to the Service and, following expiry or termination, for such further period as is necessary to delete, anonymise, or return Customer Personal Data in accordance with this DPA and applicable law.

Nature and purpose

Processing as necessary to provide, maintain, secure, support, and improve the Service, including referral campaign management, customer and advocate tracking, email delivery, reward processing, analytics, fraud prevention, support, troubleshooting, security monitoring, and related service administration.

Types of Customer Personal Data

The Customer may submit Customer Personal Data to the Service, the extent of which is determined and controlled by the Customer in its sole discretion. Customer Personal Data may include:

1. contact details, including name, email address, postal address, and telephone number;
2. log data, including IP address, browser details, time zone, geolocation information, login details, operating system, and device information;
3. store and transaction data, including store details, orders, purchases, referral activity, and order tracking data;
4. referral campaign data, including referral links, coupon codes, rewards, referral status, and campaign interaction data;
5. interaction data, including clicks, pages visited, actions taken, errors encountered, and usage information relating to interactions with ReferralCandy; and
6. any other personal data submitted to the Service by or on behalf of the Customer.

Categories of data subjects

Customer Personal Data may relate to the following categories of data subjects:

1. the Customer’s end users, customers, advocates, referred friends, suppliers, and business partners;
2. employees and points of contact of the Customer’s end users, customers, suppliers, and business partners;
3. the Customer’s employees, agents, advisors, and contractors; and
4. the Customer’s authorised users of the Service.

7.2 All processing of Customer Personal Data will be carried out by trusted employees, staff, agents, contractors, service providers, and sub-processors who are subject to appropriate confidentiality obligations.

8. Confidentiality

8.1 Anafore will ensure that persons authorised to process Customer Personal Data are subject to an appropriate duty of confidentiality.

8.2 Anafore will take reasonable steps to ensure that access to Customer Personal Data is limited to personnel who require such access for the purposes of providing, maintaining, securing, supporting, or improving the Service.

9. Data retention and deletion

Deletion by the Customer

9.1 The Customer may delete Customer Personal Data in a manner consistent with the functionality of the Service during the term of the Service.

9.2 If the Customer uses the Service to delete Customer Personal Data in a manner that prevents the Customer from recovering such Customer Personal Data, this will constitute an instruction to Anafore to delete the relevant Customer Personal Data from Anafore’s systems in accordance with applicable law.

9.3 Anafore will comply with such deletion instructions as soon as reasonably practicable, unless retention is required by applicable law.

9.4 If the Customer wishes to delete Customer Personal Data that cannot be deleted via the Service, the Customer may contact Anafore at compliance@referralcandy.com. Anafore will respond to such requests as soon as reasonably practicable.

Deletion on termination

9.5 If the Customer ceases to subscribe to and use the Service, the Customer will be deemed to have instructed Anafore to delete all Customer Personal Data, including existing copies, from Anafore’s systems in accordance with applicable law.

9.6 Anafore may retain Customer Personal Data for a recovery period of up to 30 days following the expiry or termination of the Customer’s subscription, after which Anafore will delete or anonymise Customer Personal Data as soon as reasonably practicable, unless retention is required by applicable law.

9.7 Anafore may retain limited records where required for legal, tax, accounting, security, fraud prevention, dispute resolution, or compliance purposes, provided such retained data is protected in accordance with this DPA and applicable law.

Return of data on termination

9.8 If the Customer wishes to have Customer Personal Data returned on termination, the Customer must communicate this request to Anafore at least 30 days before the expiry of the Customer’s subscription period by emailing compliance@referralcandy.com.

9.9 If no return request is received and acknowledged by Anafore within the period described in clause 9.8, the Customer will be deemed to have instructed Anafore to delete Customer Personal Data on termination in accordance with this DPA.

9.10 Anafore may provide export functionality as part of the Service. Where such functionality is available, the Customer is responsible for exporting Customer Personal Data before the expiry or termination of its subscription.

10. Data security

10.1 Anafore will implement appropriate technical and organisational measures designed to protect Customer Personal Data against unauthorised or unlawful processing and against accidental loss, destruction, damage, alteration, or disclosure.

10.2 Anafore will take reasonable steps to ensure that Customer Personal Data is treated securely and to prevent unauthorised access, collection, use, disclosure, copying, modification, disposal, or similar risks.

10.3 In respect of GDPR Activities, Anafore will implement measures intended to meet the requirements of Article 32 of the GDPR, taking into account the state of the art, the costs of implementation, the nature, scope, context, and purposes of processing, and the risk to the rights and freedoms of natural persons.

10.4 Anafore cannot guarantee that unauthorised parties will never gain access to Customer Personal Data. To the extent permitted by applicable law, Anafore excludes liability arising from unauthorised access to Customer Personal Data except to the extent caused by Anafore’s breach of this DPA, negligence, wilful misconduct, fraud, or breach of applicable law.

11. Technical and organisational measures

11.1 Anafore has implemented technical and organisational measures designed to safeguard Customer Personal Data processed in connection with the Service.

11.2 These measures include, where appropriate:

Data encryption

Customer Personal Data is encrypted during transmission and at rest using industry-standard encryption protocols.

Access controls

Access controls and least privilege principles are used to limit access to Customer Personal Data to authorised personnel.

Data minimisation

Anafore collects and processes Customer Personal Data only as necessary for the intended purposes of the Service and as instructed by the Customer.

Anonymisation and pseudonymisation

Anafore applies anonymisation and pseudonymisation techniques where appropriate to reduce the identifiability of Customer Personal Data.

Audit trails and logging

Anafore maintains logs of relevant access, processing activities, modifications, and deletions where appropriate for security, operational, and compliance purposes.

Backup and recovery

Anafore maintains backup and recovery procedures designed to support the availability and integrity of Customer Personal Data.

Retention and deletion

Anafore deletes or anonymises Customer Personal Data when it is no longer required for the provision of the Service, subject to applicable legal, security, fraud prevention, dispute resolution, and compliance requirements.

Patch management

Software and systems are regularly updated with security patches and updates.

Incident response

Anafore maintains an incident response process designed to address data breaches and security incidents, including notification procedures where required by applicable law.

Security assessments

Anafore conducts security assessments and testing as appropriate to identify and address vulnerabilities.

Monitoring and alerts

Anafore uses monitoring and alerting systems designed to detect and respond to unusual activity relating to Customer Personal Data.

Employee training and awareness

Anafore provides data protection and security training to employees and reminds personnel of their data protection and security obligations.

11.3 Anafore will continue to review and improve its technical and organisational measures as appropriate.

12. Security documentation, audits, and assessments

12.1 In respect of GDPR Activities, Anafore will provide the Customer with available information about its security processes as reasonably necessary to demonstrate compliance with this DPA and Article 28 of the GDPR.

12.2 In respect of GDPR Activities, Anafore will permit the Customer, or an independent auditor appointed by the Customer and approved by Anafore, to conduct reasonable audits and inspections to verify Anafore’s compliance with this DPA and Article 28 of the GDPR.

12.3 Any audit or inspection must be subject to reasonable advance notice, reasonable scope, confidentiality obligations, and measures designed to protect Anafore’s systems, customers, confidential information, and security.

12.4 The Customer must submit any audit or inspection request by emailing compliance@referralcandy.com.

12.5 On receipt of an audit or inspection request, Anafore and the Customer will discuss and agree in advance on:

1. the identities of the auditors or inspectors;
2. a reasonable date and time for the audit or inspection;
3. the scope and duration of the audit or inspection;
4. confidentiality obligations;
5. security and access requirements; and
6. any reasonable fees or charges to be borne by the Customer to cover Anafore’s costs.

12.6 The Customer is responsible for all of its own costs relating to any audit or inspection, including the costs of any third-party auditor appointed by the Customer.

12.7 Anafore may object to the appointment of any auditor if the auditor is, in Anafore’s reasonable opinion, not suitably qualified or independent, is a competitor of Anafore, or is otherwise unsuitable.

12.8 The Customer agrees to first use information made available by Anafore, including security summaries, certifications, policies, sub-processor information, and technical and organisational measures, before requesting an audit or inspection.

13. Data protection impact assessments

13.1 In respect of GDPR Activities, Anafore will provide reasonable assistance to the Customer with data protection impact assessments and prior consultations with supervisory authorities, where required by applicable data protection law.

13.2 Anafore’s assistance may include making available this DPA, information about its technical and organisational measures, sub-processor information, security documentation, and other information reasonably available to Anafore.

13.3 The Customer remains responsible for determining whether a data protection impact assessment or prior consultation is required for its use of the Service.

14. Incidents and notification

14.1 Anafore will inform the Customer as soon as reasonably practicable if Anafore is asked to engage in any processing activity that may infringe the PDPA, GDPR, UK GDPR, or other applicable data protection law, unless prohibited from doing so by applicable law.

14.2 If Anafore becomes aware of a data breach or security incident affecting Customer Personal Data, Anafore will notify the Customer without undue delay.

14.3 Anafore will take reasonable steps to investigate, contain, and mitigate the consequences of any data breach or security incident affecting Customer Personal Data.

14.4 Anafore’s notification may include, where available and appropriate:

1. a description of the nature of the incident;
2. the categories and approximate number of affected data subjects;
3. the categories and approximate number of affected records;
4. the likely consequences of the incident;
5. measures taken or proposed to address the incident; and
6. information reasonably required by the Customer to comply with its own notification obligations.

14.5 Notice of a data breach or security incident under this clause does not constitute an admission of fault or liability by Anafore.

15. Rights of data subjects

15.1 Anafore will, to the extent legally permitted, promptly notify the Customer if Anafore receives a request from a data subject to exercise rights in relation to Customer Personal Data.

15.2 The Customer is responsible for responding to data subject requests, including requests from the Customer’s end users, customers, advocates, referred friends, employees, or authorised users.

15.3 Taking into account the nature of the processing, Anafore will provide reasonable assistance to the Customer in responding to data subject requests by making appropriate functionality available through the Service where possible, including functionality to access, amend, export, or delete Customer Personal Data.

15.4 The Customer agrees to use available Service functionality before requesting manual assistance from Anafore.

15.5 If the Customer requires assistance with a data subject request that cannot reasonably be completed through the Service, the Customer may contact Anafore at compliance@referralcandy.com.

15.6 Anafore will also provide reasonable assistance to the Customer in responding to requests to restrict processing under Article 18 GDPR and requests to object to processing under Article 21 GDPR, where applicable and to the extent technically feasible.

16. Automated decision-making and profiling

16.1 Anafore does not engage in automated decision-making in relation to Customer Personal Data that produces legal effects concerning a data subject or similarly significantly affects a data subject.

16.2 Where profiling or automated analysis is conducted, including for fraud detection, security, analytics, performance optimisation, campaign functionality, or service improvement, it is limited in scope and does not produce legal or similarly significant effects concerning a data subject.

16.3 Any such profiling or automated analysis is conducted to support the functionality, security, reliability, or improvement of the Service and is performed on behalf of, or in support of, the Customer’s use of the Service.

17. International data transfers

17.1 Anafore Pte. Ltd. is incorporated and registered in Singapore. Customer Personal Data is stored primarily in Singapore.

17.2 Certain processing activities may involve transfers to, storage in, or access from other jurisdictions, including the United States of America. For example, email delivery infrastructure, logging, monitoring, support, security, analytics, or other sub-processor services may involve processing in other jurisdictions. Names and email addresses may be temporarily processed or stored in logs in the United States in connection with email delivery or related service operations.

17.3 Some sub-processors may process or store Customer Personal Data in other jurisdictions, depending on the nature of the sub-processor service.

17.4 Where the processing of Customer Personal Data involves a transfer of personal data from the EEA, the United Kingdom, or Switzerland to a country or recipient that is not subject to an applicable adequacy decision or adequacy regulation, Anafore will ensure that the transfer is protected by appropriate safeguards in accordance with applicable data protection law.

17.5 For transfers from the EEA, the Parties agree that the European Commission Standard Contractual Clauses adopted under Commission Implementing Decision (EU) 2021/914, as amended or replaced from time to time, apply to such transfers.

17.6 The completed EU Standard Contractual Clauses, including their applicable modules, selected options and annexes, are attached as Schedule 1 and form an integral part of this DPA. They are binding on the Parties in respect of transfers of Customer Personal Data subject to the GDPR for which the Parties rely on the EU Standard Contractual Clauses to satisfy the requirements of Chapter V GDPR.

1. Module Two: Controller to Processor applies where the Customer acts as controller and Anafore acts as processor.
2. Module Three: Processor to Processor applies where the Customer acts as processor and Anafore acts as sub-processor.

By executing this DPA, each Party agrees to Schedule 1, including its completed annexes, subject to the scope of application stated above. In the event of any conflict between this DPA and the applicable EU Standard Contractual Clauses, the EU Standard Contractual Clauses prevail.

17.7 For transfers from the United Kingdom, the Parties agree that the applicable UK international transfer mechanism will apply, being either:

1. the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses;
2. the UK International Data Transfer Agreement; or
3. such other transfer mechanism approved under UK data protection law as may replace or supersede them.

17.8 For transfers from Switzerland, the Parties agree that the EU Standard Contractual Clauses will apply with any modifications required under Swiss data protection law, including references to the competent Swiss supervisory authority where applicable.

17.9 The Customer authorises Anafore to enter into equivalent transfer safeguards with its sub-processors where required for the provision of the Service.

17.10 Anafore will ensure that sub-processors are subject to written data protection obligations that provide an appropriate level of protection for Customer Personal Data.

17.11 Anafore will take reasonable steps to support the Customer’s assessment of international transfers by making available relevant information about its processing locations, sub-processors, technical and organisational measures, and security practices.

17.12 The Parties acknowledge that, where required by applicable data protection law, a transfer impact assessment or equivalent transfer risk assessment may be necessary before or during the transfer of Customer Personal Data.

17.13 If Anafore determines that it can no longer comply with the applicable transfer safeguards, it will notify the Customer without undue delay and take reasonable and appropriate steps to remediate the non-compliance.

17.14 Where remediation is not possible, Anafore may suspend the affected transfer or processing activity, or terminate the affected Service in accordance with the Terms of Service.

17.15 To the extent of any conflict between this DPA and the applicable Standard Contractual Clauses, UK Addendum, UK International Data Transfer Agreement, or other mandatory transfer mechanism, the applicable transfer mechanism will prevail in respect of the relevant transfer.

18. Sub-processors

18.1 The Customer acknowledges and authorises Anafore to engage sub-processors to process Customer Personal Data in connection with the Service.

18.2 The Customer specifically authorises Anafore to engage:

1. Anafore entities, including entities directly or indirectly controlled by, or under common control with, Anafore Pte. Ltd.; and
2. the sub-processors listed on Anafore’s website or Privacy Policy, as updated from time to time.

18.3 Anafore will ensure that each sub-processor is subject to a written agreement requiring the sub-processor to protect Customer Personal Data in a manner consistent with this DPA.

18.4 Anafore will ensure that each sub-processor agreement requires, among other things, that:

1. the sub-processor only processes Customer Personal Data as necessary to perform its obligations to Anafore;
2. the sub-processor processes Customer Personal Data in accordance with Anafore’s instructions;
3. the sub-processor implements appropriate technical and organisational measures to protect Customer Personal Data;
4. the sub-processor is subject to confidentiality obligations;
5. in respect of GDPR Activities, the data protection obligations required by Article 28(3) GDPR are imposed on the sub-processor; and
6. where applicable, the sub-processor complies with the international transfer safeguards described in this DPA.

18.5 Anafore may engage new sub-processors from time to time.

18.6 Anafore will provide notice of new sub-processors at least 30 days before the new sub-processor processes Customer Personal Data, unless earlier engagement is required for security, continuity, legal compliance, emergency, or other urgent operational reasons.

18.7 If the Customer objects to the engagement of a new sub-processor on reasonable data protection grounds, the Customer must notify Anafore in writing before the new sub-processor begins processing Customer Personal Data.

18.8 The Parties will work in good faith to resolve any objection raised under clause 18.7 on reasonable data protection grounds. Anafore may address the objection by avoiding use of the relevant sub-processor for the Customer or providing a commercially reasonable alternative that resolves the objection. If the objection cannot be resolved, the Customer may terminate the affected Service by written notice to Anafore without an early termination charge.

18.9 Where the Customer terminates the affected Service under clause 18.8, the Customer remains responsible for fees accrued up to the effective date of termination. Anafore will refund, within 30 days of termination, any prepaid subscription fees attributable to the period after the effective date of termination for the affected Service, calculated on a pro-rata basis. No further subscription fees will be payable for the terminated Service. This clause applies notwithstanding any contrary no-refund policy in the Terms of Service.

19. Liability

19.1 The aggregate liability of Anafore Pte. Ltd. and all Anafore entities, including entities directly or indirectly controlled by or under common control with Anafore Pte. Ltd., for all claims under this DPA will not exceed an amount equal to the subscription fees received by Anafore from the Customer in the 12 months preceding the event giving rise to the claim.

19.2 Nothing in this DPA excludes or limits liability to the extent such exclusion or limitation is prohibited by applicable law.

19.3 Nothing in this clause excludes or limits Anafore’s liability to the extent a claim arises from dishonesty, fraud, wilful misconduct, or wilful concealment by Anafore, its agents, or advisers.

20. General

20.1 The term “data intermediary” has the meaning given in the PDPA.

20.2 The terms “personal data”, “data subject”, “processing”, “controller”, “processor”, and “sub-processor” have the meanings given in the GDPR, except where the context requires otherwise.

20.3 References to applicable data protection law include, where applicable, the PDPA, GDPR, UK GDPR, UK Data Protection Act 2018, Swiss data protection law, and any other data protection or privacy law applicable to the processing of Customer Personal Data.

20.4 If any provision of this DPA is held to be invalid or unenforceable, the remaining provisions will remain in full force and effect.

20.5 This DPA is governed by the laws of the Republic of Singapore.

20.6 The Parties agree to submit to the exclusive jurisdiction of the courts of the Republic of Singapore.

21. Execution

IN WITNESS WHEREOF, the Customer and Anafore Pte. Ltd.’s authorised signatories have duly executed this Data Processing Addendum.

Schedule 1: EU Standard Contractual Clauses Addendum

Completion sheet and annexes

This EU Standard Contractual Clauses Addendum (“SCC Addendum”) forms part of the ReferralCandy Data Processing Addendum (“DPA”) entered into between:

the customer agreeing to the DPA and this SCC Addendum (the “Customer” or “data exporter”); and

ANAFORE PTE. LTD. (UEN 200903073C), a company incorporated and registered in Singapore, operating under the brand ReferralCandy (“Anafore” or “data importer”).

Together, the Customer and Anafore are the “Parties”.

1. Purpose

This SCC Addendum applies where Anafore processes Customer Personal Data on behalf of the Customer and such processing involves a transfer of personal data from the European Economic Area to Anafore or to Anafore’s sub-processors in a country that is not subject to an applicable adequacy decision.

This SCC Addendum incorporates the European Commission Standard Contractual Clauses adopted under Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (“EU SCCs”).

The EU SCCs apply to the relevant transfer as follows:

1. Module Two: Controller to Processor applies where the Customer acts as controller and Anafore acts as processor; and
2. Module Three: Processor to Processor applies where the Customer acts as processor and Anafore acts as sub-processor.

Unless expressly stated otherwise, Module Two applies as the default module.

2. Relationship with the DPA

This SCC Addendum supplements the DPA.

In the event of any conflict between the DPA and the EU SCCs, the EU SCCs will prevail in respect of the relevant international transfer.

In the event of any conflict between this SCC Addendum and the EU SCCs, the EU SCCs will prevail in respect of the relevant international transfer.

3. Docking Clause

The optional docking clause in Clause 7 of the EU SCCs applies.

Additional data exporters may accede to the EU SCCs where required for the use of the Service, provided that the acceding party is bound by the DPA, this SCC Addendum, or another written agreement incorporating the EU SCCs.

4. Sub-Processor Authorisation

For Clause 9 of the EU SCCs, the Parties select general written authorisation.

The Customer authorises Anafore to engage sub-processors in accordance with the DPA.

Anafore will provide notice of new sub-processors at least 30 days before the new sub-processor processes Customer Personal Data, unless earlier engagement is required for security, continuity, legal compliance, emergency, or other urgent operational reasons.

The Customer may object to a new sub-processor on reasonable data protection grounds in accordance with the DPA.

5. Complaint Handling

For Clause 11 of the EU SCCs, the optional language relating to an independent dispute resolution body is not selected, unless otherwise agreed by the Parties in writing.

Data subjects may submit complaints to the Customer, Anafore, or the competent supervisory authority in accordance with the EU SCCs and applicable data protection law.

6. Governing Law for the EU SCCs

For Clause 17 of the EU SCCs, the Parties select the law of Ireland.

This selection applies only to the EU SCCs. The governing law of the DPA remains as stated in the DPA.

7. Jurisdiction for the EU SCCs

For Clause 18 of the EU SCCs, the Parties agree that disputes arising from the EU SCCs will be resolved by the courts of Ireland.

This selection applies only to the EU SCCs. The jurisdiction clause of the DPA remains as stated in the DPA, except to the extent the EU SCCs require otherwise.

Annex I

A. List of parties

Data Exporter

Name: The Customer agreeing to the ReferralCandy DPA and this SCC Addendum.

Address: The address associated with the Customer’s ReferralCandy account, order form, subscription, or other agreement with Anafore.

Contact person’s name, position, and contact details: The Customer’s account owner, administrator, privacy contact, legal contact, or other contact provided to Anafore.

Activities relevant to the data transferred under these Clauses: The Customer uses the ReferralCandy Service to operate referral, advocate, customer acquisition, reward, email, tracking, analytics, and related marketing or ecommerce workflows.

Signature and date: By entering into the DPA, using the Service, signing an order form, or otherwise agreeing to the DPA and this SCC Addendum, the Customer is deemed to have signed this SCC Addendum.

Role: Controller, unless the Customer acts as processor on behalf of another controller.

Data Importer

Name: ANAFORE PTE. LTD. (UEN 200903073C), operating under the brand ReferralCandy.

Address: Singapore.

Contact person’s name, position, and contact details: compliance@referralcandy.com.

Activities relevant to the data transferred under these Clauses: Anafore provides the ReferralCandy Service to the Customer, including referral campaign management, customer and advocate tracking, email delivery, reward processing, analytics, fraud prevention, customer support, troubleshooting, security monitoring, and related service administration.

Signature and date: By entering into the DPA, providing the Service, signing an order form, or otherwise agreeing to the DPA and this SCC Addendum, Anafore is deemed to have signed this SCC Addendum.

Role: Processor, or sub-processor where the Customer acts as processor on behalf of another controller.

B. Description of transfer

Categories of data subjects

The Customer may submit Customer Personal Data to the Service, the extent of which is determined and controlled by the Customer. Customer Personal Data may relate to:

1. the Customer’s end users, customers, advocates, referred friends, suppliers, and business partners;
2. employees and points of contact of the Customer’s end users, customers, suppliers, and business partners;
3. the Customer’s employees, agents, advisors, and contractors; and
4. the Customer’s authorised users of the Service.

Categories of personal data transferred

Customer Personal Data may include:

1. contact details, including name, email address, postal address, and telephone number;
2. log data, including IP address, browser details, time zone, geolocation information, login details, operating system, and device information;
3. store and transaction data, including store details, orders, purchases, referral activity, and order tracking data;
4. referral campaign data, including referral links, coupon codes, rewards, referral status, and campaign interaction data;
5. interaction data, including clicks, pages visited, actions taken, errors encountered, and usage information relating to interactions with ReferralCandy; and
6. any other personal data submitted to the Service by or on behalf of the Customer.

Sensitive data transferred

The Service is not intended for the processing of special categories of personal data under Article 9 GDPR.

The Customer must not submit special categories of personal data to the Service unless it has a lawful basis to do so and has agreed appropriate safeguards with Anafore in writing.

Frequency of the transfer

Transfers occur on a continuous basis for the duration of the Customer’s use of the Service.

Nature of the processing

Anafore processes Customer Personal Data to provide, maintain, secure, support, and improve the Service.

Processing may include collection, recording, organisation, structuring, storage, retrieval, consultation, use, transmission, disclosure to sub-processors, alignment, combination, restriction, deletion, anonymisation, and other processing necessary to provide the Service.

Purpose of the processing

The purpose of the processing is to provide the ReferralCandy Service to the Customer, including:

1. referral campaign management;
2. customer, advocate, and referred friend tracking;
3. referral link and coupon code management;
4. email delivery;
5. reward processing;
6. fraud prevention;
7. analytics and reporting;
8. customer support;
9. troubleshooting;
10. security monitoring; and
11. related service administration.

Duration of processing and retention period

Customer Personal Data is processed for the duration of the Customer’s subscription to the Service.

Following expiry or termination of the Service, Customer Personal Data is deleted, anonymised, or returned in accordance with the DPA and applicable law.

Anafore may retain Customer Personal Data for a recovery period of up to 30 days following expiry or termination of the Customer’s subscription, unless a shorter or longer period is required by applicable law or agreed in writing.

Anafore may retain limited records where required for legal, tax, accounting, security, fraud prevention, dispute resolution, or compliance purposes.

Transfers to sub-processors

Customer Personal Data may be transferred to sub-processors engaged by Anafore to provide the Service.

Sub-processors may include providers of hosting, infrastructure, email delivery, logging, monitoring, analytics, support, security, payment, communications, and other operational services.

Sub-processors are listed in Anafore’s sub-processor list, as updated from time to time.

C. Competent supervisory authority

For transfers to which the EU Standard Contractual Clauses apply, the competent supervisory authority is identified below in accordance with Clause 13.

To be completed by the Customer and confirmed by the Parties:

Name of supervisory authority

Country

If the EU Standard Contractual Clauses do not apply to any transfers covered by this DPA, enter “Not applicable”.

Annex II: Technical and organisational measures

Anafore implements technical and organisational measures designed to protect Customer Personal Data processed in connection with the Service.

These measures include the following.

1. Data encryption

Customer Personal Data is encrypted during transmission and at rest using industry-standard encryption protocols.

2. Access controls

Access controls and least privilege principles are used to limit access to Customer Personal Data to authorised personnel.

3. Authentication and account protection

Access to systems processing Customer Personal Data is controlled through authentication mechanisms. Access rights are reviewed and managed according to role and operational need.

4. Confidentiality

Personnel authorised to process Customer Personal Data are subject to confidentiality obligations.

5. Data minimisation

Anafore processes Customer Personal Data only as necessary to provide, maintain, secure, support, and improve the Service, or as otherwise instructed by the Customer.

6. Anonymisation and pseudonymisation

Anafore applies anonymisation and pseudonymisation techniques where appropriate to reduce the identifiability of Customer Personal Data.

7. Logging and audit trails

Anafore maintains logs of relevant system activity, access, modifications, and deletions where appropriate for security, operational, and compliance purposes.

8. Backup and recovery

Anafore maintains backup and recovery procedures designed to support the availability and integrity of Customer Personal Data.

9. Retention and deletion

Anafore deletes or anonymises Customer Personal Data when it is no longer required for the provision of the Service, subject to applicable legal, security, fraud prevention, dispute resolution, and compliance requirements.

10. Patch management

Software and systems are regularly updated with security patches and updates.

11. Incident response

Anafore maintains an incident response process designed to address data breaches and security incidents, including notification procedures where required by applicable law.

12. Vulnerability management and security testing

Anafore conducts security assessments and testing as appropriate to identify and address vulnerabilities.

13. Monitoring and alerts

Anafore uses monitoring and alerting systems designed to detect and respond to unusual activity relating to Customer Personal Data.

14. Employee training and awareness

Anafore provides data protection and security training to employees and reminds personnel of their data protection and security obligations.

15. Sub-processor controls

Anafore requires sub-processors to enter into written agreements that impose appropriate data protection, confidentiality, security, and transfer obligations.

16. Business continuity

Anafore maintains operational measures designed to support the continuity, availability, and resilience of the Service.

Annex III: Sub-processors

The Customer authorises Anafore to use sub-processors to process Customer Personal Data for the purposes of providing the Service.

Anafore will maintain a list of sub-processors on its website, Privacy Policy, or other location made available to Customers.

The sub-processor list should include, at a minimum:

1. sub-processor name;
2. purpose of processing;
3. categories of personal data processed;
4. processing location or relevant transfer location; and
5. applicable safeguard, where relevant.

Anafore will provide notice of new sub-processors in accordance with the DPA.

Each sub-processor will be subject to a written agreement requiring the sub-processor to protect Customer Personal Data in a manner consistent with the DPA and this SCC Addendum.

Signature

This SCC Addendum is incorporated into and forms part of the DPA.

The Parties agree that execution of the DPA, acceptance of the Terms of Service, signature of an order form, or continued use or provision of the Service constitutes agreement to this SCC Addendum, unless a separate signed version is required by either Party.

UK International Data Transfer Addendum

Completion sheet

This UK International Data Transfer Addendum Completion Sheet (“UK Addendum Completion Sheet”) forms part of the ReferralCandy data transfer package entered into between:

the customer agreeing to the ReferralCandy Data Processing Addendum (“Customer” or “data exporter”); and

ANAFORE PTE. LTD. (UEN 200903073C), a company incorporated and registered in Singapore, operating under the brand ReferralCandy (“Anafore” or “data importer”).

Together, the Customer and Anafore are the “Parties”.

1. Purpose

This UK Addendum Completion Sheet applies where Anafore processes Customer Personal Data on behalf of the Customer and such processing involves a restricted transfer of personal data from the United Kingdom to Anafore or to Anafore’s sub-processors in a country that is not subject to an applicable UK adequacy regulation.

This UK Addendum Completion Sheet is intended to complete and incorporate the UK Information Commissioner’s Office International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (“UK Addendum”).

The UK Addendum applies together with the European Commission Standard Contractual Clauses adopted under Commission Implementing Decision (EU) 2021/914 (“EU SCCs”).

2. Relationship with other documents

This UK Addendum Completion Sheet supplements:

1. the ReferralCandy Data Processing Addendum (“DPA”);
2. the ReferralCandy EU Standard Contractual Clauses Addendum / Completion Sheet; and
3. the EU SCCs.

In the event of any conflict between this UK Addendum Completion Sheet and the UK Addendum, the UK Addendum will prevail in respect of the relevant UK restricted transfer.

In the event of any conflict between the DPA and the UK Addendum, the UK Addendum will prevail in respect of the relevant UK restricted transfer.

3. Selected transfer mechanism

The Parties select the UK Addendum to the EU SCCs as the applicable UK transfer mechanism.

The standalone UK International Data Transfer Agreement is not selected unless the Parties agree otherwise in writing.

4. Effective date

This UK Addendum Completion Sheet takes effect on the same date as the DPA, unless a different date is agreed by the Parties in writing.

Where the Customer continues to use the Service after the DPA and this UK Addendum Completion Sheet have been made available, such continued use constitutes acceptance of this UK Addendum Completion Sheet to the extent permitted by applicable law and the Terms of Service.

Table 1: Parties

Start date

The start date is the Effective Date of the DPA.

Exporter

Name: The Customer agreeing to the ReferralCandy DPA and this UK Addendum Completion Sheet.

Address: The address associated with the Customer’s ReferralCandy account, order form, subscription, or other agreement with Anafore.

Contact details: The Customer’s account owner, administrator, privacy contact, legal contact, or other contact provided to Anafore.

Key contact: The Customer’s designated account, privacy, legal, or administrative contact.

Role: Controller, unless the Customer acts as processor on behalf of another controller.

Signature: By entering into the DPA, using the Service, signing an order form, or otherwise agreeing to the DPA and this UK Addendum Completion Sheet, the Customer is deemed to have signed this UK Addendum Completion Sheet.

Importer

Name: ANAFORE PTE. LTD. (UEN 200903073C), operating under the brand ReferralCandy.

Address: Singapore.

Contact details: compliance@referralcandy.com.

Key contact: Compliance / Privacy Contact.

Role: Processor, or sub-processor where the Customer acts as processor on behalf of another controller.

Signature: By entering into the DPA, providing the Service, signing an order form, or otherwise agreeing to the DPA and this UK Addendum Completion Sheet, Anafore is deemed to have signed this UK Addendum Completion Sheet.

Table 2: Selected SCCs, modules, and clauses

Approved EU SCCs

The approved EU SCCs are the European Commission Standard Contractual Clauses adopted under Commission Implementing Decision (EU) 2021/914, as amended or replaced from time to time.

Modules

The following modules are selected:

1. Module Two: Controller to Processor, where the Customer acts as controller and Anafore acts as processor; and
2. Module Three: Processor to Processor, where the Customer acts as processor and Anafore acts as sub-processor.

Unless otherwise agreed in writing, Module Two applies by default.

Optional clauses

The Parties make the following selections:

1. Clause 7, Docking Clause: selected.
2. Clause 9, Use of sub-processors: general written authorisation selected.
3. Clause 11, Redress: optional independent dispute resolution language not selected, unless otherwise agreed in writing.
4. Clause 17, Governing law for the EU SCCs: Ireland.
5. Clause 18, Choice of forum and jurisdiction for the EU SCCs: courts of Ireland.

Annexes

The annexes to the EU SCCs are completed by reference to the ReferralCandy EU Standard Contractual Clauses Addendum / Completion Sheet, including:

1. Annex I: List of Parties and Description of Transfer;
2. Annex II: Technical and Organisational Measures; and
3. Annex III: Sub-processors.

Table 3: Appendix information

The Appendix Information required for the UK Addendum is set out in the ReferralCandy EU Standard Contractual Clauses Addendum / Completion Sheet and the DPA.

Annex 1A: List of Parties

Completed by the “List of Parties” section of the ReferralCandy EU Standard Contractual Clauses Addendum / Completion Sheet.

Annex 1B: Description of Transfer

Completed by the “Description of Transfer” section of the ReferralCandy EU Standard Contractual Clauses Addendum / Completion Sheet.

Annex II: Technical and Organisational Measures

Completed by the “Technical and Organisational Measures” section of the ReferralCandy EU Standard Contractual Clauses Addendum / Completion Sheet and the ReferralCandy TOMs / Security Summary.

Annex III: Sub-processors

Completed by the “Sub-processors” section of the ReferralCandy EU Standard Contractual Clauses Addendum / Completion Sheet and the ReferralCandy sub-processor list, as updated from time to time.

Table 4: Ending this addendum when the approved addendum changes

The Parties select the option that neither Party may end this UK Addendum solely because the UK Addendum changes or is replaced, unless the UK Addendum, applicable UK data protection law, or a competent authority requires otherwise.

If the UK Addendum is amended, replaced, or superseded by a new UK-approved transfer mechanism, the Parties agree to cooperate in good faith to implement the updated or replacement transfer mechanism.

Additional UK transfer terms

1. UK restricted transfers

The Parties acknowledge that the UK Addendum applies only to restricted transfers governed by UK data protection law.

Where a transfer is governed by EU data protection law, the EU SCCs apply.

Where a transfer is governed by both EU and UK data protection law, the EU SCCs and UK Addendum apply together to the relevant transfer.

2. Transfer risk assessment

The Parties acknowledge that a transfer risk assessment may be required for restricted transfers under UK data protection law.

Anafore will make available reasonable information to support the Customer’s assessment of the transfer, including information about:

1. processing locations;
2. categories of Customer Personal Data processed;
3. sub-processors;
4. technical and organisational measures;
5. security practices; and
6. relevant transfer safeguards.

The Customer remains responsible for determining whether its use of the Service requires any additional transfer risk assessment, unless otherwise required by applicable law.

3. Sub-processors

The Customer authorises Anafore to engage sub-processors in accordance with the DPA.

Where sub-processors process Customer Personal Data in connection with a UK restricted transfer, Anafore will ensure that appropriate transfer safeguards are used where required by UK data protection law.

4. Updates

If the UK Addendum, UK IDTA, UK GDPR, Data Protection Act 2018, or related UK transfer requirements are amended, replaced, or superseded, Anafore may update this UK Addendum Completion Sheet to reflect the amended or replacement requirements.

Anafore will make the updated version available to Customers where required.

Signature

This UK Addendum Completion Sheet is incorporated into and forms part of the DPA and the ReferralCandy data transfer package.

The Parties agree that execution of the DPA, acceptance of the Terms of Service, signature of an order form, or continued use or provision of the Service constitutes agreement to this UK Addendum Completion Sheet, unless a separate signed version is required by either Party.

Related documents

• Subprocessor list: the subprocessors referred to in clause 18 and Annex III.
• Privacy Policy: how we handle merchant and visitor data for our own purposes.
• Terms of Service: the agreement this DPA forms part of.
• Security and vulnerability reporting.
• On request: our Security Summary (technical and organisational measures) and our Transfer Impact Assessment Summary. Email compliance@referralcandy.com.