1. Purpose
The purpose of this annex is to govern the conditions under which Fydl processes certain personal data on behalf of the Merchants using the service.
It applies as soon as a Merchant creates, configures or uses a Loyalty Card, a customer file, a campaign, an integration or any feature involving the processing of the personal data of its Customers through Fydl.
This annex supplements the Fydl Terms of Use and Terms of Sale and the Fydl Privacy Policy.
2. Role of the parties
In the context of the use of Fydl by a Merchant, the Merchant remains the data controller for the processing relating to its loyalty programme, its Customers, its campaigns, its content, its offers and the data which it imports or transmits to Fydl.
Fydl acts as a processor when it processes personal data on behalf of the Merchant, in particular in order to enable the management of a Loyalty Card, of a customer file, of Points, of Rewards, of SMS or push campaigns, of data imports or of point-of-sale integrations.
Fydl remains the data controller for its own processing, in particular the processing necessary for the creation of Fydl accounts, for the general operation of the service, for security, for support, for billing, for maintenance and for the improvement of the service.
3. Data concerned
The data processed on behalf of the Merchant may in particular concern:
- the Customers attached to a Loyalty Card of the Merchant;
- the prospects or customers whose data is transmitted or imported by the Merchant;
- the team members added by the Merchant.
The data processed may in particular include:
- telephone number;
- surname and first name;
- email address;
- date of birth;
- Points history, former loyalty balance, Rewards and visits;
- data relating to consents, refusals or unsubscriptions;
- data relating to SMS campaigns or push notifications;
- data arising from a point-of-sale integration, where the latter is activated, such as date, amount, order identifier, point of sale, products or visit information;
- any other data transmitted by the Merchant and necessary for the use of the loyalty programme.
4. Purposes of the processing
Fydl processes the data on behalf of the Merchant solely in order to provide the features requested by the latter, in particular:
- creation and management of a Loyalty Card;
- management of the Merchant's customer file;
- award, removal, correction and monitoring of Points;
- management of Rewards and benefits;
- import or updating of customer data;
- sending of SMS campaigns or push notifications;
- management of consents and unsubscriptions;
- operation of the customer engagement modules;
- operation of the point-of-sale integrations activated by the Merchant;
- support, maintenance, security and the proper functioning of the service.
5. Obligations of the Merchant
The Merchant undertakes to use Fydl in accordance with the applicable regulations on the protection of personal data.
The Merchant warrants in particular:
- that it holds the rights necessary to collect, use, import or transmit the data processed through Fydl;
- that the data subjects have been properly informed where this is necessary;
- that the required consents, in particular for commercial communications by SMS or push notifications, have been validly obtained;
- that it is able to demonstrate the consents obtained outside Fydl;
- that the data transmitted to Fydl is relevant, accurate and limited to what is necessary;
- that the content, campaigns, offers and settings which it distributes through Fydl comply with the applicable regulations.
The Merchant remains responsible for the instructions which it gives to Fydl and for the use which it makes of the service.
6. Obligations of Fydl
Fydl undertakes to process personal data on behalf of the Merchant solely within the framework of the purposes provided for in this annex and of the features used by the Merchant.
Fydl undertakes in particular to:
- process the data in accordance with the documented instructions of the Merchant;
- not use the data processed on behalf of the Merchant for purposes other than those necessary for the provision of the service;
- limit access to the data to authorised persons who need it;
- implement reasonable security and confidentiality measures;
- assist the Merchant, as far as possible, in responding to requests from data subjects exercising their rights;
- inform the Merchant if an instruction appears manifestly unlawful or contrary to the applicable regulations.
7. Technical sub-processors
The Merchant authorises Fydl to use the technical service providers necessary for the operation of the application, of the webapp and of the associated services.
These service providers may in particular be involved in hosting, the sending of SMS messages, push notifications, payment, billing, wallet media, addresses, maintenance, security or the technical integrations activated by the Merchant.
Fydl ensures that these service providers offer sufficient guarantees as regards the protection of personal data and limits their access to the data necessary for their task.
Fydl may change its service providers according to its technical needs, subject to maintaining a level of protection that complies with the applicable regulations.
8. Security and confidentiality
Fydl implements reasonable technical and organisational measures in order to protect personal data against unauthorised access, loss, alteration, destruction or disclosure.
The Merchant remains responsible for the confidentiality of access to its Account, for the management of its team members and for the rights which it assigns to them within Fydl.
Each party undertakes to inform the other in the event of a security incident liable to have an impact on the personal data processed in connection with Fydl.
9. Rights of data subjects
Where a Customer exercises their rights directly with Fydl, Fydl handles the request where it concerns its own processing.
Where the request concerns processing carried out on behalf of the Merchant, Fydl may assist the Merchant as far as possible and within the limits of the available features.
The Merchant remains responsible for handling requests relating to its own customer file, its campaigns, its offers and its loyalty programme.
10. Personal data breach
In the event of a personal data breach concerning data processed on behalf of the Merchant, Fydl shall inform the Merchant as soon as possible after becoming aware of it.
Fydl shall provide the Merchant with the information reasonably available in order to enable it to assess the consequences of the incident and, where applicable, to comply with its legal obligations.
11. Fate of the data at the end of the relationship
In the event of the deletion of a Loyalty Card, the closure of a Merchant Account or the cessation of use of the service, Fydl deletes or anonymises the data processed on behalf of the Merchant, save for temporary retention necessary to comply with a legal obligation, to ensure the security of the service or to preserve evidence of a right.
Deletion or anonymisation may result in the loss of access to the data, histories, Points, Rewards and information associated with the Loyalty Card concerned.
12. Term
This annex applies throughout the entire period of use of Fydl by the Merchant and for as long as Fydl processes personal data on its behalf.
Certain obligations may continue to apply after the end of the relationship, in particular those relating to confidentiality, security, evidence, legal obligations and the fate of the data.