Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms and Conditions between Pocket Labs Pty Ltd (ABN 93 695 191 621, "PocketPass", "we") and the merchant using PocketPass ("you"). It applies when we process personal data about your customers and golfers on your behalf and that processing is subject to the EU General Data Protection Regulation or the UK GDPR and Data Protection Act 2018 (together, "Data Protection Law"). If this DPA and the Terms conflict on personal data, this DPA prevails.

You are the controller of Customer Personal Data: you decide why it is collected and which PocketPass features use it. We are your processor. You are responsible for having a lawful basis, giving your customers the privacy information they are entitled to, and deciding whether each feature you enable is appropriate where you operate. We are a separate controller only for the account, billing and website data described in our Privacy Policy.

• We process Customer Personal Data only on your documented instructions, which are the Terms, this DPA and your use and configuration of PocketPass, unless the law requires otherwise. If so, we will tell you first where the law allows.
• We will tell you if we believe an instruction infringes Data Protection Law. We do not give legal advice and are not obliged to check your instructions for compliance.
• People we authorise to process Customer Personal Data are bound by confidentiality.
• We maintain the security measures in Annex 2. We may improve them, but will not materially reduce the overall level of protection.
• We do not sell Customer Personal Data or use it for our own marketing.

You authorise the sub-processors in Annex 3. We will give you at least 30 days' notice of a new sub-processor by updating this page and emailing your account's contact address. You may object on reasonable data protection grounds within that time; if we cannot resolve the objection, you may end the affected service. We bind each sub-processor to data protection obligations in substance no less protective than these, and remain responsible for its performance.

We are based in Australia, and Customer Personal Data is hosted in the United States (Annex 1). Where a transfer from the EEA or the UK is to a country without an adequacy decision, the parties agree to the European Commission's Standard Contractual Clauses (Decision 2021/914), Module Two (controller to processor), and, for UK data, the UK International Data Transfer Addendum, which are incorporated by reference. For those clauses: clause 7 applies; clause 9 uses Option 2 with the notice period in section 4; the optional wording in clause 11 does not apply; the governing law and courts are those of Ireland (and England and Wales for the UK Addendum); and Annexes 1 to 3 below supply the required information.

• Rights requests: PocketPass lets you view and correct a customer's data, export it from their profile, record their marketing preferences, and permanently erase them. Customers can download their data and ask you to delete it from their portal. Erasing keeps financial ledger amounts without the person's details, and a keyed record that stops the person being re-created by a sync. If a customer contacts us directly, we will refer them to you where we can identify you.
• We will give reasonable help with data protection impact assessments and regulator consultations, taking into account the information available to us.
• Personal data breaches: we will notify you without undue delay after becoming aware of a breach affecting Customer Personal Data, with the information you reasonably need to meet your own duties.

You can export your data while your account is active and for 90 days after termination. After that we delete or anonymise Customer Personal Data, except where the law requires us to keep it. Deletion starts at day 90 and finishes within about a week, because wallet passes are voided on customers' devices first. While your account is active, operational records are removed on the periods in our Privacy Policy. Backups are overwritten on their normal cycle and remain protected until then.

We will make available the information reasonably needed to show compliance with this DPA, and answer reasonable written security questions. Where that is not enough, or a regulator requires it, you may audit on 30 days' notice, once a year, during business hours, at your cost, under confidentiality, and without access to other customers' data.

Liability under this DPA is subject to the limits in the Terms, except where Data Protection Law or the Standard Contractual Clauses do not allow them to apply. Nothing here limits either party's liability to data subjects under the Standard Contractual Clauses.

• Parties: you as controller and exporter; Pocket Labs Pty Ltd, 1/84 View St, Gymea, Sydney, NSW 2227, Australia, as processor and importer. Contact: privacy@getpocketpass.com.
• Data subjects: your customers, members and golfers, and people named on their tee-time reservations.
• Categories of data: name, email, phone, birthday, member and pass numbers; tee times; house-account balances and transactions, including transfers between customers; purchases; loyalty and referral activity; visit and spend scores used for segmentation (RFM); marketing preferences and their history; wallet pass and device identifiers; card brand, last four digits and expiry (never full card numbers); records received from your point of sale or tee sheet; tags, notes and fields you add; portal sign-in details; and IP address and browser details in logs.
• Special categories: none intended. Do not enter them in notes or custom fields.
• Purpose and nature: providing PocketPass, including hosting, wallet passes, email and push messages, reports, the customer portal, and the features you enable.
• Duration: the term of your agreement and the period in section 7.
• Frequency of transfer: continuous.
• Location: Amazon Web Services us-east-1 (application) and Supabase on AWS (database), both in the United States.

• Encryption of data in transit (TLS) and at rest
• Tenant isolation through authorisation checks in our server code, with row-level security on the database blocking direct access across merchants
• Role-based permissions for merchant teams, optional two-factor authentication, and an append-only, merchant-readable audit log
• Secrets held in a secrets manager and not in source code or CI
• A web application firewall and rate limiting on sensitive actions
• Staff access limited to an allowlist and requiring two-factor authentication. Viewing a merchant's account requires a stated reason, ends after two hours, and is shown in that merchant's audit log
• Balance changes recorded on a ledger with locking and idempotency controls

• Amazon Web Services, Inc. (United States): application hosting, queues, secrets, transactional email
• Supabase, Inc. (United States): database and merchant-team authentication
• Stripe, Inc. and affiliates (United States, Ireland): card payments and saved cards, where you enable online payments
• Peach Payments (South Africa): card payments and saved cards, for merchants set up on Peach Payments instead of Stripe
• Apple Inc. (United States): Apple Wallet pass delivery and push updates
• Google LLC (United States): Google Wallet pass delivery and updates
• Anthropic, PBC (United States): the support assistant. When your team asks about a customer, it receives what they type and limited account details the assistant looks up, such as first name and last initial, pass status and visit dates
• Intercom, Inc. (United States): support conversations your team chooses to start, including the assistant conversation they hand over and their name, email, role and merchant. This workspace is also used for our related Pocket product
• Cloudflare, Inc. (United States): bot protection on sign-in forms

Integrations you connect yourself, such as Lightspeed, are your own service providers, not our sub-processors.