FOR PARTICIPATING BUSINESSES

Data Processing Addendum

The required UK GDPR data-processing terms for the relevant business-to-platform relationship.

Roles

For processing carried out on a participating business’s documented instructions, that business is the controller and Wee Rewards is the processor. Wee Rewards is an independent controller for its own account, security, service-improvement and legal-compliance processing.

Processing details

Subject matter: loyalty and campaign platform services. Duration: the business relationship and documented retention period. Data: customer identifiers, card/stamp activity, contact and channel-preference data. Data subjects: customers and authorised business users.

Processor commitments

Wee Rewards will process personal data only on documented instructions, maintain confidentiality, apply appropriate security measures, assist with data-subject rights and incident obligations, and delete or return data at the end of the service where required.

Subprocessors and transfers

Wee Rewards will use subprocessors only under appropriate written commitments. Any international transfers will use an appropriate UK transfer mechanism where required.

Audit and assistance

On reasonable written request, Wee Rewards will provide information needed to demonstrate these obligations and reasonably assist with security, breach, DPIA and regulatory obligations.

Completion required

This is a product-specific launch template. It must be reviewed, completed with the legal operator and subprocessors, and incorporated into the signed Business Terms before live customer data is processed.

Last updated: 1 November 2026