LoyalBase Platform — DPA
Effective Date: April 12, 2026
This Data Processing Agreement ("DPA") is entered into between LoyalBase LLC, a company organized under the laws of the State of Florida, with its principal place of business at 7901 4th St N, Ste 300, St. Petersburg, FL 33702, USA ("Processor," "LoyalBase"), and the Customer identified in the LoyalBase platform subscription agreement ("Controller," "Customer").
This DPA forms an integral part of the Terms of Service between the parties and governs the processing of Personal Data by LoyalBase on behalf of the Customer in connection with the LoyalBase platform and related services (the "Services").
By accepting the Terms of Service or accessing the Services, Customer agrees to the terms of this DPA. If Customer does not agree to this DPA, Customer must not use the Services.
The following definitions apply throughout this DPA. Terms not defined here have the meaning given in the Terms of Service.
LoyalBase acts as a Processor with respect to Personal Data of Customer's Members. Customer acts as the Controller, determining the purposes and means of processing Member Data through the LoyalBase platform. LoyalBase acts as an independent Controller for its own business operations and for Tenant account data, as described in the Privacy Policy.
LoyalBase processes Personal Data solely to provide and support the Services as described in the Terms of Service, including: operating Customer's branded loyalty program, managing Member accounts and loyalty activity, enabling push notification and email communications configured by Customer, generating analytics and reports for Customer, and processing reward redemptions.
LoyalBase may process the following categories of Personal Data on behalf of Customer:
LoyalBase does not intentionally collect or process special categories of Personal Data (such as data revealing racial or ethnic origin, health information, biometric data, or financial account numbers). Customer must not configure the Services to collect or process such data without prior written consent from LoyalBase and implementation of appropriate additional safeguards.
Processing will continue for the duration of the active subscription plus thirty (30) days following termination, unless Customer requests earlier deletion. Upon written request within this period, Customer may receive a full data export. After thirty (30) days post-termination, all Personal Data will be permanently and irrecoverably deleted from LoyalBase systems and those of its Sub-processors, except where retention is required by applicable law.
LoyalBase shall process Personal Data only in accordance with Customer's documented instructions as set forth in this DPA, the Terms of Service, and any written instructions provided by Customer through the platform interface or via email to legal@loyalbase.dev. The Services themselves constitute Customer's primary processing instructions.
LoyalBase shall not: (a) process Personal Data for any purpose other than providing the Services; (b) sell, rent, or commercially exploit Personal Data; (c) combine Personal Data with data from other customers or third-party sources for profiling purposes; or (d) disclose Personal Data to third parties except as authorized under this DPA.
If LoyalBase is required by applicable law to process Personal Data in a manner inconsistent with Customer's instructions, LoyalBase shall inform Customer of that legal requirement before processing (unless prohibited by law from doing so), and shall limit processing to what is strictly required by that legal obligation.
LoyalBase shall ensure that all personnel authorized to process Personal Data have committed to confidentiality or are under an appropriate statutory obligation of confidentiality. Access to Personal Data is restricted to personnel who require access to perform the Services.
LoyalBase shall not disclose Personal Data to any third party other than Sub-processors authorized under Section 6 of this DPA, or as required by applicable law.
LoyalBase implements and maintains appropriate technical and organizational security measures designed to protect Personal Data against unauthorized or unlawful processing and against accidental loss, destruction, damage, alteration, or disclosure. These measures include:
LoyalBase shall review and update its security measures on a regular basis to account for changes in technology and risks. LoyalBase may update these measures over time, provided that updates do not materially decrease the overall level of protection of Personal Data.
Customer is responsible for implementing and maintaining appropriate security measures on its own systems and for ensuring that any access credentials or API keys provided by LoyalBase are kept confidential and are not shared with unauthorized parties.
Customer grants LoyalBase general authorization to engage the following Sub-processors to assist in delivering the Services. LoyalBase has entered into or will enter into written agreements with each Sub-processor imposing data protection obligations no less protective than those in this DPA:
LoyalBase shall notify Customer at least thirty (30) days in advance of engaging any new Sub-processor that will process Personal Data, by updating this page and sending notice to the email address associated with Customer's account. Customer may object to the engagement of a new Sub-processor within fourteen (14) days of such notice by sending written objection to legal@loyalbase.dev. If Customer objects and the parties cannot resolve the objection, Customer may terminate its subscription without penalty upon written notice, with a pro-rated refund of prepaid but unused fees.
LoyalBase shall remain liable to Customer for the acts and omissions of its Sub-processors to the same extent LoyalBase would be liable if performing the services of each Sub-processor directly, subject to the limitations of liability in the Terms of Service.
Customer is solely responsible for providing privacy notices to its Members and obtaining all legally required consents for the processing of Member Data through the Services. Customer must maintain a lawful basis for all processing it instructs LoyalBase to perform.
LoyalBase shall provide Customer with reasonable technical and organizational assistance to fulfill Customer's obligations to respond to Data Subject requests to exercise rights under Applicable Data Protection Law, including rights of access, correction, deletion, portability, restriction, and objection. LoyalBase will make available in the platform dashboard the following self-service tools: Member account deletion, Member data export, and Member consent management.
If LoyalBase receives a Data Subject rights request directly from a Member, LoyalBase shall promptly notify Customer (where legally permissible) and shall not respond to such request without Customer's written authorization, except as required by applicable law.
LoyalBase shall notify Customer of any confirmed Security Incident involving Personal Data without undue delay and, where feasible, no later than seventy-two (72) hours after LoyalBase becomes aware of the incident. Notification will be sent to the email address associated with Customer's account.
The breach notification shall include, to the extent available at the time of notice:
LoyalBase shall cooperate with Customer and provide Customer with further information necessary for Customer to meet its own breach notification obligations to Data Subjects and supervisory authorities under Applicable Data Protection Law. LoyalBase shall take all reasonable measures to contain and mitigate the Security Incident.
Customer is solely responsible for determining whether the Security Incident triggers any notification obligations to Data Subjects or regulatory authorities, and for fulfilling those obligations. LoyalBase's notification to Customer under this Section does not constitute an admission of fault or liability.
At Customer's written request and reasonable expense, LoyalBase shall provide Customer with reasonable information and assistance to support Customer's obligations to conduct Data Protection Impact Assessments (DPIAs) and prior consultations with supervisory authorities under Applicable Data Protection Law, to the extent such obligations apply and to the extent the information required is available to LoyalBase.
LoyalBase shall make available to Customer, upon written request, all information reasonably necessary to demonstrate compliance with the obligations set forth in this DPA, including summaries of relevant security certifications, audit reports, or penetration testing results, subject to appropriate confidentiality restrictions.
Customer may request an audit of LoyalBase's processing activities covered by this DPA no more than once per calendar year, with at least thirty (30) days' prior written notice. Customer audits shall be conducted during regular business hours, in a manner that minimizes disruption to LoyalBase's operations, and at Customer's sole expense. LoyalBase may satisfy its audit obligations by providing Customer with reports prepared by qualified independent third parties. Any audit findings are confidential information of both parties.
LoyalBase processes Personal Data primarily in the United States. Where Customer's Members are located outside the United States, Customer acknowledges that transfer of Personal Data to LoyalBase in the United States may constitute an international data transfer under Applicable Data Protection Law.
For transfers of Personal Data from the European Economic Area (EEA), United Kingdom, or Switzerland to the United States, the parties agree that such transfers are subject to the Standard Contractual Clauses (SCCs) as published by the European Commission, which are incorporated by reference into this DPA. Where SCCs apply, LoyalBase shall act as data importer and Customer shall act as data exporter.
LoyalBase shall implement appropriate supplementary technical measures (including encryption in transit and at rest) to protect Personal Data during international transfers.
Upon termination or expiration of the Terms of Service, or upon Customer's written request, LoyalBase shall, at Customer's election: (a) return all Personal Data to Customer in a structured, commonly used, machine-readable format (CSV); or (b) permanently delete all Personal Data from its systems and those of its Sub-processors.
LoyalBase will complete the return or deletion within thirty (30) days of Customer's written election. Upon completion, LoyalBase shall provide written certification of deletion upon request.
LoyalBase may retain Personal Data beyond this period only to the extent and for the duration required by applicable law (e.g., retention of billing records for seven years under applicable tax law). Such retained data shall remain subject to the confidentiality and security obligations of this DPA.
This DPA enters into force on the effective date of the Terms of Service and remains in effect for as long as LoyalBase processes Personal Data on behalf of Customer.
This DPA automatically terminates upon expiration or termination of the Terms of Service, subject to the data deletion obligations in Section 12, which survive termination.
Each party's liability arising out of or related to this DPA is subject to the limitations and exclusions of liability set forth in the Terms of Service. Nothing in this DPA shall exclude or limit either party's liability for fraud, death or personal injury caused by negligence, or any liability that cannot be excluded or limited under applicable law.
This DPA shall be governed by and construed in accordance with the laws of the State of Florida, United States, without regard to conflict of laws principles, except to the extent that Applicable Data Protection Law of another jurisdiction (such as the GDPR) mandates a different governing law for specific provisions.
Any disputes arising under this DPA shall be subject to the exclusive jurisdiction and venue set forth in the Terms of Service.
In the event of any conflict or inconsistency between this DPA and the Terms of Service with respect to the subject matter of data protection, this DPA shall prevail. In all other respects, the Terms of Service shall govern.
If any provision of this DPA is found to be unenforceable, the remaining provisions shall remain in full force and effect.
This DPA, together with the Terms of Service, constitutes the entire agreement between the parties with respect to the processing of Personal Data and supersedes all prior agreements, understandings, and representations regarding the same subject matter.
LoyalBase may update this DPA from time to time. Material changes will be communicated to Customer by email at least thirty (30) days in advance. Customer's continued use of the Services after the effective date of any change constitutes acceptance of the updated DPA. If Customer does not accept the changes, Customer may terminate its subscription as provided in the Terms of Service.
For DPA inquiries, sub-processor objections, or data protection requests, contact us at legal@loyalbase.dev
LoyalBase LLC
7901 4th St N, Ste 300
St. Petersburg, FL 33702, USA
legal@loyalbase.dev