Data Processing Agreement

1. Scope

Subject matter: running the Brand's games, storing the leads they collect, sending the code email and delivering leads to the Brand's webhook.

Data subjects: people who play the Brand's games.

Personal data: email address, optional phone number, consent choice and wording, page URL, referrer, campaign tags, browser type, country, hashed device signal, prize result. IP addresses are used briefly for rate limits and bot checks and are not stored with leads.

Duration: for as long as the Brand uses SpinLoop, plus the deletion period below.

2. Instructions

SpinLoop processes the data only to provide the service and on the Brand's documented instructions, which are the Terms, this DPA and the settings the Brand chooses in the dashboard. We will tell the Brand if we think an instruction breaks data protection law.

3. US state privacy laws

Where the California Consumer Privacy Act or a similar US state law applies, SpinLoop acts as the Brand's service provider or processor. We will not:

• sell or share the personal data, including for cross-context behavioural advertising;
• keep, use or disclose it for any purpose other than providing SpinLoop to the Brand, or outside our direct business relationship with the Brand;
• combine it with personal data we get from other sources, except as those laws allow.

We will follow those laws, give the data the level of protection they require, and tell the Brand if we can no longer meet them. The Brand may take reasonable steps to stop and fix any unauthorised use. We certify that we understand these restrictions and will comply with them.

The Brand discloses personal data to us only for the limited and specified business purposes in section 1.

4. Confidentiality and security

Staff with access are bound by confidentiality. We keep these technical and organisational measures in place, and may improve them but will not make them weaker:

• Encryption in transit (HTTPS/TLS) for every page, API and webhook, and encryption at rest by our database provider.
• Row-level access controls in the database, so each Brand only sees its own data.
• Signed webhooks, so the Brand can check a lead really came from us.
• Bot checks and rate limits on every public endpoint.
• Least-privilege access to production systems, limited to the people who run SpinLoop.
• Automatic deletion of leads after 24 months, and backups that expire within 30 days.
• Error monitoring and logs that leave out player contact details.

5. Subprocessors

The Brand gives general authorisation for the subprocessors below. Our team in India accesses the data to run and support the service.

We will give 30 days' notice of a new subprocessor by email to account owners. The Brand may object on reasonable data protection grounds by emailing support@getspinloop.com within that time. We will then try to find a solution; if we can't, the Brand may cancel and we will refund any prepaid fees for the rest of the period. Each subprocessor is bound by data protection terms at least as protective as this DPA, and we stay responsible for them.

6. Helping the Brand

We help the Brand answer data subject and consumer requests (the dashboard lets the Brand find, export and delete leads), and with security, breach notices and impact assessments where reasonable.

We will tell the Brand without undue delay, within 48 hours where possible and never later than 72 hours, after becoming aware of a personal data breach affecting its data. We will say what happened, what data is affected, what we are doing about it and who to contact, and we will update the Brand as we learn more.

7. International transfers

The data is stored in the United States and accessed by our team in India. SpinLoop is offered to brands in the United States.

If a Brand in the EEA, UK or Switzerland uses SpinLoop, the EU Standard Contractual Clauses, Module 2 (controller to processor), are incorporated into this DPA by reference, with the Brand as data exporter and us as data importer, the optional docking clause not used, general authorisation for subprocessors as in section 5, and Irish law and courts for the Clauses. For the UK, the UK International Data Transfer Addendum applies on top. Section 1 and section 4 give the details the Clauses' annexes need.

8. Deletion and audits

Leads are deleted automatically 24 months after they were collected, or sooner when the Brand deletes them. When the agreement ends, we delete the Brand's personal data within 30 days, unless the law requires us to keep it, and backups expire within 30 more days. We will make available the information needed to show we comply with this DPA.

Audits: once a year, on 30 days' written notice, the Brand may audit our compliance by sending a written questionnaire, which we will answer in good faith. An on-site audit is only needed where the law requires it or after a breach affecting the Brand's data; it happens during business hours, under confidentiality, at the Brand's cost.

9. Liability

Each party's liability under this DPA is subject to the limits in the Terms of Service, as far as the law allows.