1. Scope & Purpose

This Data Processing Agreement (DPA) regulates the processing of personal data by Mazaya on behalf of merchants. It forms an integral part of our Terms of Service.

2. Definitions

'Personal Data', 'Data Controller', 'Data Processor', and 'Processing' have the meanings set out in GDPR and Israeli privacy regulations.

3. Party Roles

3.1 Merchant acts as the Data Controller (determining customer criteria). 3.2 Mazaya acts as the Data Processor (executing instructions to generate and update passes). 3.3 Mazaya is the Controller for merchant account details used for billing.

4. Processing Objectives

Operating loyalty dashboards, updating Apple/Google wallet passes, managing support requests, safeguarding platform databases, and resolving billing events.

5. Mazaya's Obligations

We process data strictly on merchant instructions, implement TLS/AES encryption, verify staff permissions, assist with customer data access requests, and maintain audit logs.

6. Merchant's Obligations

Merchants must collect customer data legally, display accurate privacy statements, and obtain consent before sending notifications.

7. Approved Subprocessors

We route secure operations through: Vercel (hosting), Convex (databases), PayPlus (credit cards), and Apple/Google wallet gateways.

8. Data Security

Mazaya implements logical multi-tenant database boundaries to ensure zero cross-tenant database visibility or leakage.

9. Deletion Schedules

Upon account cancellation, merchant and end-customer records are deleted from active production networks within 30 days.

10. Data Subject Requests

If customer data requests reach Mazaya, we will forward them to the merchant for action, as the merchant is the controller.

11. International Transfers

Where data is transferred out of Israel, Mazaya ensures compliance with standard data protection clauses.

12. Amendments

We may update this B2B DPA. Continued dashboard access by merchants constitutes agreement.

Data Processing Agreement (DPA)