Processing...
This Data Processing Agreement ("DPA") sets out how Mintcom processes personal data on behalf of the businesses that use the Services. It forms part of our Terms of Service and is accepted together with them, when you create your account or accept an updated version. You do not need to sign a separate copy.
This DPA is between Mintcom Ltd, a company registered in England and Wales with company number 17544555, whose registered office is at 4th Floor Office, 205 Regent Street, London, England, W1B 4HB ("Mintcom", "we", "us"), and the business that holds a Mintcom account ("you").
It applies to Customer Personal Data, meaning personal data about your customers, staff and suppliers that you or your staff enter into the Services, or that the Services create when you use them. For this data you are the controller and Mintcom is your processor.
It does not cover personal data we use for our own purposes as a controller, such as account sign-in, billing, security, support and our website. Our Privacy Policy covers that.
If this DPA and the Terms of Service conflict on anything to do with personal data, this DPA applies. Words such as controller, processor, personal data, personal data breach and data subject have the meanings given in Data Protection Law.
"Data Protection Law" means the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, the EU General Data Protection Regulation (EU GDPR) where it applies, and any other data protection or privacy laws that apply to Customer Personal Data, including Jordan's Personal Data Protection Law No. 24 of 2023, regional data protection laws in the Middle East, and applicable US state privacy laws where Mintcom acts as a "service provider" or "processor". References to UK GDPR articles and to the Information Commissioner's Office are read as references to the matching articles and supervisory authorities under the applicable law.
Providing the Services to you under the Terms of Service, for as long as you use them, followed by deletion as described in section 11.
Hosting, storing, syncing between your devices, backing up, displaying and reporting on your data; sending the emails and receipts you or your staff choose to send; creating loyalty passes; answering questions you ask the AI assistant; and sending data to the services you choose to connect. We process Customer Personal Data only to provide, secure and support the Services for you.
The Services are not designed for special category data, such as health information, and you should not enter it.
You authorise us to use the sub-processors below. We place data protection obligations on each one that are no less protective than this DPA, by written contract, and we remain responsible to you for their work.
We will give you at least 14 days' notice, by email or in the Services, before we add or replace a sub-processor. If you object on reasonable data protection grounds, we will discuss it with you, and if we cannot resolve it you may cancel the affected Services without penalty before the change takes effect.
Services you choose to connect, such as Xero, QuickBooks, government e-invoicing systems, Foodics and Loyverse, are not our sub-processors. When you connect one, you instruct us to send it the data that feature needs, and it handles that data under its own terms.
Our main database and servers are in Germany, in the European Economic Area, which UK law recognises as giving adequate protection.
Where a sub-processor in section 5 processes Customer Personal Data outside the UK and EEA, we protect the transfer with the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the sub-processor's certification under the UK Extension to the EU-US Data Privacy Framework. You can ask for a copy of these safeguards by emailing privacy@mintcompos.com.
Where Customer Personal Data is transferred from the Kingdom of Saudi Arabia and governed by the KSA Personal Data Protection Law (PDPL) and its Transfer Regulations, the parties incorporate and apply the standard contractual clauses (Controller-to-Processor) approved by the Saudi Data and Artificial Intelligence Authority (SDAIA). For the purpose of completing the SDAIA Standard Contractual Clauses: (a) Annex 1 (Details of the Parties) designates the Merchant as Data Exporter and Mintcom Ltd as Data Importer; (b) Section 3 of this DPA constitutes Annex 2 (Description of Transfer and Processing Operations); (c) Section 12 of this DPA constitutes Annex 3 (Technical and Organisational Measures); and (d) Section 5 of this DPA sets forth the authorized sub-processors and onward-transfer safeguards in accordance with statutory requirements. Mintcom ensures all onward transfers to authorized sub-processors outside the Kingdom comply with statutory onward-transfer conditions and equivalent data protection safeguards. Where other regional data protection laws (such as in Jordan or the UAE) apply to cross-border transfers to our hosting facilities in Germany or sub-processors in the US, transfers are protected by the applicable statutory transfer mechanisms, or by explicit customer and staff consent obtained by the merchant in accordance with local law.
We will tell you without undue delay (and, where a personal data breach is likely to cause severe harm to individuals, as quickly as possible and within 24 hours of discovery so you can meet any short local notification deadlines, such as under Jordan's Personal Data Protection Law) after we become aware of a personal data breach affecting Customer Personal Data. As far as we know it at the time, and then as it becomes available, we will tell you:
We will help you meet your own obligation to notify the Information Commissioner's Office and affected people, where that applies. Telling you about a breach is not an admission of fault.
If we receive a request from one of your customers or staff to exercise their data protection rights, we will pass it to you and will not answer it ourselves unless you ask us to or the law requires it.
The Services let you view, correct, export and delete Customer Personal Data yourself. Where you need more help to respond to a request, we will provide reasonable assistance.
We will make available the information you reasonably need to show that we comply with this DPA. If that information is not enough, we will allow for and contribute to audits, including inspections, by you or an independent auditor you appoint, on at least 30 days' written notice, during normal business hours, and subject to confidentiality.
Audits are limited to once in any 12 months, unless a regulator requires one or a personal data breach affecting your data has occurred. Each party pays its own costs of an audit.
At the end of the Services involving Customer Personal Data, you may instruct us to return that data to you in an available structured, commonly used, machine-readable format or to delete it. You may give or change the instruction before the Services end by contacting privacy@mintcompos.com or using the available export and deletion controls. We will explain the scope, format, secure delivery method and timetable, and give reasonable help where needed.
After return, or following your deletion instruction, we delete existing copies unless the law requires us to keep them. Any data we keep remains protected under this DPA, is used only for the legal purpose for which it is kept, and is deleted when that purpose ends. This section is subject to mandatory switching and retrieval rights, any later protected deadline, and the backup process described below.
A deletion request normally has a 30-day grace period. Restoration is possible only before permanent deletion and the related subscription cancellation begin. We investigate and resolve failed or uncertain cancellation and deletion steps without undue delay, and these do not create a general exception to legal duties to erase data.
Backup copies are kept apart from ordinary use and expire on a fixed rotation. Nightly database dumps are normally kept for around 30 days, and our continuous backups keep a set number of recent backups rather than a set number of days. Your choice to return or delete data does not require us to change backup copies immediately, as long as they stay isolated from ordinary use until they expire.
We maintain these technical and organisational measures:
Each party's liability under this DPA is subject to the limitations of liability in the Terms of Service, unless Data Protection Law does not allow it.
This DPA applies for as long as we process Customer Personal Data for you, including during the deletion period in section 11. We may update it as the Terms of Service describe, and we will give notice of new sub-processors as section 5 describes.
This DPA is governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction, unless Data Protection Law requires otherwise.
This DPA is written in English. Translations (including in Arabic and Chinese) are provided for convenience. If there is any difference in meaning between the English version and a translation, the English version applies to the extent permitted by law.
For questions about this DPA, to object to a sub-processor or to ask for a copy of our transfer safeguards, email privacy@mintcompos.com.