Data processing agreement

This agreement is part of the terms of service. It covers personal data that the customer ("you") sends to Interlink Digital Group Limited ("we") so that we can issue and update passes.

Words such as controller, processor, personal data and processing have the meanings in the UK GDPR.

1. Roles

1.1 You are the controller of holder personal data (the people who receive a pass). We are the processor.

1.2 We are the controller for our own console users, billing contacts, security logs and marketing-site enquiries. That processing is described in our privacy notice, not in this agreement.

1.3 Apple and Google are independent controllers of the wallet apps on a holder's device once the holder adds a pass. They are not our sub-processors for that processing.

2. Instructions

2.1 We process holder data only to provide Interlink Wallet: creating and updating the pass, showing the add-to-wallet page, and supporting access, correction and deletion requests you make through the console or API.

2.2 We do not use holder data for our own marketing or analytics.

2.3 We tell you if an instruction would, in our view, break UK data protection law.

3. Details of processing

• Subject matter. Issuing and maintaining a digital pass for your holders.
• Duration. For the term of the terms of service, plus the retention periods below.
• Nature and purpose. Host, render and deliver the fields you map onto a pass; operate the add-to-wallet page; respond to your data-rights requests.
• Data. The fields in your template, typically a name, a reference, and the figures or text you choose to show. No special-category data is permitted.
• Data subjects. Your holders, and your console users where their details appear in an audit of a change they made.

4. Security

We apply tenant isolation, encryption in transit, access limited by role, and audit logging, as described on the security page.

5. Sub-processors

We use the following. A change is notified at least 30 days in advance, and you may object on reasonable data-protection grounds.

• IDG's own server (the host that serves wallet.interlink.digital). Application and database.
• Postmark (ActiveCampaign). Transactional email to console users: verification, invitations, sign-in and security notices. Sending address: @interlink.digital.

Apple and Google are described in the holder notice as independent controllers. They are not in this list.

Where a sub-processor is outside the UK, the transfer uses the UK International Data Transfer Addendum, or the EU Standard Contractual Clauses where EU data is involved.

6. People and confidentiality

People who can access holder data are bound to keep it confidential and are limited to what their role needs. Operator access by Interlink Digital Group staff is separate from tenant access and is audited.

7. Assistance

We help you with access, correction, deletion, restriction and portability requests. We tell you without undue delay, and in any case within 24 hours of becoming aware, if we become aware of a personal data breach affecting holder data.

8. Retention and deletion

Removed or voided passes are purged after 90 days by default. Event records are kept for 13 months. Apple device logs are kept for 14 days. At the end of the contract we delete or return holder data, and delete remaining copies, unless the law requires us to keep them.

9. Audits

You may audit our compliance with this agreement once a year, on reasonable notice. We do not yet have a SOC 2 or ISO 27001 report.

10. Law

This agreement is governed by the law of England and Wales.