1.1 This DPA applies where BeeLiked Processes Customer Personal Data as Processor or Subprocessor, or as a service provider or contractor under US State Privacy Laws, to provide the Services. It forms part of the Agreement and protects the Customer Personal Data of each Controller validly covered under clause 1.2. That protection does not itself grant a non-party direct enforcement rights; Customer exercises the DPA rights for a disclosed non-affiliate upstream Controller, and direct third-party enforcement is governed solely by Terms clause 16.6.
1.2 For Customer Personal Data, Customer is Controller or, where it acts for a disclosed end-client, Processor authorised to appoint BeeLiked as Subprocessor. A Customer Affiliate may be Controller only where Customer has authority to bind it to this DPA or it signs its own Order Form or accession. Customer warrants that each upstream Controller has authorised the Processing, BeeLiked’s appointment, subprocessors and transfers, and that Customer may give instructions and exercise DPA rights for it. BeeLiked is Processor, Subprocessor, service provider or contractor as the applicable law and actual Processing require. Each party is an independent Controller only for Personal Data for which it actually determines a separate lawful purpose and means, including BeeLiked’s account administration, billing, legal compliance and the specifically identified security, fraud-prevention or product-analytics purposes described in its applicable privacy notice. For clarity, authenticating a Customer User and administering that User’s access to Customer-selected Services under Annex A is Processing on the relevant Controller’s behalf. BeeLiked may separately act as Controller for its own account-security, fraud-prevention or legal-compliance purpose only to the extent it actually determines that separate purpose and means and does not retain or reuse Customer Personal Data from Processor systems contrary to this DPA. A label or privacy-notice update does not reclassify Processing performed on a Controller’s behalf.
1.3 The subject matter, duration, nature, purposes, Personal Data or personal-information types and Data Subject or consumer categories are in Annex A. Customer’s lawful selection, configuration and documented instructions identify which agreed Processing applies, but neither an Order Form nor an instruction expands the authorised Processing or materially alters the required safeguards or protected risk allocation. Any materially different purpose, individual category or regulated-information type, and any Restricted Data profile, must first be authorised through the applicable signed-amendment or rider route in clause 6A.3, Annex A A3 to A5 and clause 3.3 of the Terms. Additional operational assistance within the already authorised scope may be documented in an Order Form or written instruction accepted by BeeLiked and may be subject to agreed Fees.
1.4 Each party must comply with Data Protection Laws applicable to its role. Nothing relieves either party of direct statutory responsibility.
1.5 In this DPA: EU GDPR means Regulation (EU) 2016/679; UK GDPR has the meaning given in section 3(10) of the Data Protection Act 2018; SCCs means the standard contractual clauses approved by the European Commission for international transfers, including Commission Decision (EU) 2021/914 as applicable; UK Addendum means the then-current International Data Transfer Addendum issued by the UK Information Commissioner for use with the SCCs; and US State Privacy Laws means US state laws applicable to BeeLiked’s Processing as a service provider, contractor or processor, including the California Consumer Privacy Act as amended.
2.1 BeeLiked will Process Customer Personal Data only on Customer’s documented lawful instructions, including with regard to transfers to a third country or international organisation and including the Agreement, configured use and written instructions accepted by BeeLiked, unless required otherwise by UK law or, where the EU GDPR applies, by Union or Member State law to which BeeLiked is subject. BeeLiked will notify Customer of the legal requirement before Processing unless that law prohibits notice on important grounds of public interest.
2.2 BeeLiked will immediately inform Customer if, in BeeLiked’s opinion, an instruction infringes applicable Data Protection Laws and may suspend that instruction to the minimum extent and for the minimum period reasonably necessary while the parties resolve it.
2.3 Customer warrants it has all notices, lawful bases, permissions and authority necessary for Customer Personal Data and instructions, and that instructions are lawful, proportionate and within the agreed Services.
2.4 An instruction requiring material configuration, additional Processing or disproportionate assistance within the already authorised scope is subject to feasibility, additional Fees and an Order Form or amendment. An Order Form, configuration or instruction cannot change a Protected Term or authorise a materially different purpose, Data Subject category or Personal Data type, Restricted Data, or materially increased security or risk; any such change must first be documented in a signed amendment or rider satisfying clause 3.3 of the Terms and the applicable requirements of clause 6A.3 and Annex A A3 to A5.
3.1 BeeLiked will ensure persons authorised to Process Customer Personal Data are bound by confidentiality and receive appropriate privacy/security training for their responsibilities.
3.2 Access is limited to personnel who need it for the Services and is removed or adjusted when no longer required.
4.1 BeeLiked will implement and maintain all technical and organisational measures required by Article 32 of the UK GDPR and corresponding Data Protection Laws, including the Security Measures, taking account of the state of the art, implementation cost, nature, scope, context and purposes of Processing and risks to individuals.
4.2 Annex B states the contractual Security Measures. Policies, audit materials, reports, questionnaires and presentations do not modify it unless expressly incorporated by an amendment satisfying clause 3.3 of the Terms.
4.3 BeeLiked may update the Security Measures where the update does not materially reduce overall protection. Customer is responsible for securely configuring Customer-controlled settings, Users, devices, integrations and credentials.
5.1 Customer gives general written authorisation for BeeLiked to use Subprocessors. BeeLiked will make available, at a current Subprocessor-list location notified to Customer or on reasonable request, a list identifying the Subprocessors used to Process Customer Personal Data and the general service each provides. BeeLiked will provide reasonably available information about relevant Processing locations and transfer safeguards on reasonable request. A privacy notice may link to that list but is not incorporated into the Agreement as a contractual warranty except for the list commitment expressly stated here.
5.2 BeeLiked will give at least 10 calendar days’ prior notice by email or in-app notification of an intended new or replacement Subprocessor using the last Account, Admin User or designated privacy contact details notified to BeeLiked. Customer is responsible for keeping those details current. Email notice is deemed received at 9:00 a.m. on the next Business Day after it is correctly addressed and sent without a delivery-failure message; an in-app notice is deemed received when first displayed to an Admin User. A silent webpage update is not notice. Customer may object within the notice period only on reasonable documented data-protection grounds and has no individual approval or general veto right. If Customer does not object within that period, it loses the contractual objection right for that appointment and silence is treated as no objection.
5.3 BeeLiked will respond in good faith to a timely objection by providing further information or safeguards, avoiding the Subprocessor where reasonably feasible, or offering a commercially reasonable alternative, which may involve additional cost or different functionality. The proposed Subprocessor will not Process affected Customer Personal Data until the objection is resolved or BeeLiked has reasonably demonstrated that the objection is unfounded. If no reasonable solution exists, Customer may terminate only the Service that cannot reasonably be provided without that Subprocessor by notice before the Subprocessor begins Processing. Customer’s sole entitlement arising merely from that termination is a pro-rata refund of prepaid Fees attributable to the unused affected Service, with no damages or other compensation. An objection does not permit termination of unaffected Services.
5.4 Notwithstanding clause 5.2, where a Security Incident, serious vulnerability, provider outage, insolvency or threatened withdrawal, urgent legal or regulatory requirement, or material continuity or data-protection risk requires an expedited change, BeeLiked may give a prior-notice period shorter than 10 calendar days for an intended Subprocessor addition or replacement, but will give as much prior notice as reasonably practicable. The abbreviated period stated in that notice is the applicable objection period, Customer will consider any reasonable objection promptly, and the new Subprocessor will not Process Customer Personal Data until Customer has received the required information and had an opportunity to object during that period and the general-authorisation requirements have otherwise been satisfied. If any prior notice is reasonably impossible, BeeLiked will not use a new Subprocessor under Customer’s general authorisation unless Customer first gives specific written authorisation for the identified provider. BeeLiked may instead use an already authorised Subprocessor or suspend or limit the affected Processing to the extent reasonably necessary until the notice and authorisation requirements can be satisfied. A disclosure or Processing step directly required by law is governed by clause 2.1 and does not by itself appoint the recipient as a Subprocessor. BeeLiked may use an already authorised Subprocessor immediately and need not disclose confidential commercial terms or information whose disclosure would create a security risk.
5.5 BeeLiked will impose on each Subprocessor by written contract: (a) the same data-protection obligations required by Article 28(4), insofar as applicable to the Processing entrusted to that Subprocessor; and (b) where US State Privacy Laws apply, restrictions and obligations that comply with those laws and are no less protective than clause 6A, including the applicable limited-purpose, no-sale, no-sharing, use, disclosure, combination, privacy-protection, security, consumer-request, compliance-notification and assistance requirements. The Subprocessor contract will give BeeLiked rights sufficient to monitor compliance and to stop and remediate unauthorised use so that BeeLiked can meet its corresponding obligations to Customer, and will require any further Subprocessor to be bound by a compliant written contract. BeeLiked remains responsible to Customer for the Subprocessor’s performance of those obligations, subject to the Agreement.
6.1 For this clause 6, a restricted transfer means a transfer of Customer Personal Data treated as restricted under applicable Data Protection Laws. BeeLiked will not make a restricted transfer without a lawful transfer mechanism, the required data-protection or transfer-risk assessment and supplementary measures where required.
6.2 For a restricted transfer by BeeLiked to a Subprocessor, BeeLiked will enter into the applicable SCCs, UK International Data Transfer Agreement (IDTA), UK Addendum or other lawful safeguard with that Subprocessor and complete the required modules, tables and annexes before the transfer. BeeLiked may rely on certification only where a competent authority has approved the applicable scheme for that transfer and the recipient has made binding and enforceable commitments providing the required safeguards. Customer authorises BeeLiked to enter the applicable mechanism as necessary to perform the Services.
6.3 If a restricted transfer directly between Customer and BeeLiked requires SCCs, the IDTA or a UK Addendum and is not covered by adequacy regulations or another lawful mechanism, the parties will put the applicable transfer mechanism and required assessment in place before commencing that transfer. Annex A, Annex B, the Order Form, BeeLiked’s then-current Subprocessor list and the parties’ contact details may be used to complete it, but this DPA does not treat an incomplete mandatory table, module, annex or assessment as completed.
6.4 The SCCs, IDTA or UK Addendum prevail only to the minimum extent of direct conflict. Neither party will amend them in a way that undermines required safeguards.
6.5 Customer will reasonably cooperate with transfer risk assessments for transfers it instructs or controls. BeeLiked will provide information reasonably available about its transfers and safeguards.
6A.1 Where US State Privacy Laws apply to Customer Personal Data, Customer discloses that data to BeeLiked only for the following limited and specified business purposes, and BeeLiked will Process it only as reasonably necessary and proportionate for the purposes that apply to the Services Customer uses: (a) configuring, implementing, integrating, hosting, operating, maintaining, supporting and providing the Services and Customer-Operated Promotions; (b) collecting, recording, organising, storing, retrieving, displaying, transmitting and deleting data through the Account, Promotion, form, entry, workflow and reporting fields configured by Customer; (c) administering entries, eligibility checks, winner or outcome selection, Reward allocation and redemption records, and Participant transactions and communications on Customer’s documented instructions; (d) authenticating Users, administering access, providing Customer support and troubleshooting, and maintaining service, usage and audit records on Customer’s behalf; (e) protecting the Services and Customer Personal Data through access control, security monitoring, fraud and abuse prevention, incident detection and response, backup, recovery and business continuity; (f) producing Customer-requested reports, exports and analytics on Customer’s behalf; and (g) returning, retaining only where law requires, and deleting Customer Personal Data in accordance with the DPA. Only purposes necessary for the selected and configured Services apply; this list does not authorise a materially different purpose. BeeLiked will not sell or share Customer Personal Data, retain, use or disclose it outside the direct business relationship with Customer or for a commercial purpose other than those specified purposes, or combine it with Personal Data received from another person or from BeeLiked’s own interaction with an individual, except where US State Privacy Laws expressly permit.
6A.2 BeeLiked will comply with all applicable obligations imposed on a service provider, contractor or processor under US State Privacy Laws and provide the same level of privacy protection required of the applicable Customer. BeeLiked will implement reasonable security procedures and practices appropriate to the nature of the Customer Personal Data; enable and assist Customer to respond to applicable consumer requests under clause 7; and, taking account of the nature of Processing and information available to BeeLiked, reasonably assist with Customer’s legally required cybersecurity audit, risk assessment and automated-decisionmaking or profiling assessment, pre-use or other information duty, request to access, request to opt out and request to appeal concerning the Services. Where applicable California law requires cooperation with Customer’s cybersecurity audit or risk assessment, BeeLiked will make available to Customer or its auditor all relevant information requested for the audit, and all facts necessary for the risk assessment, that are in BeeLiked’s possession, custody or control, and will not misrepresent a fact relevant or necessary to them, subject only to restrictions permitted by that law. BeeLiked will permit Customer to take reasonable and appropriate steps, using the evidence and audit sequence in clause 9, to help ensure Processing is consistent with Customer’s obligations; will not misrepresent material information supplied for those activities; will notify Customer if BeeLiked determines it can no longer comply; and will permit Customer, on reasonable notice, to take reasonable and appropriate steps to stop and remediate unauthorised use. Despite the ordinary sequence and notice periods in clause 9, if Customer gives BeeLiked credible and reasonably substantiated evidence of suspected unauthorised use of Customer Personal Data, BeeLiked will without undue delay provide proportionate information, review and remediation reasonably necessary to investigate, stop and remediate that suspected use, subject to reasonable confidentiality, security, privilege, legal and third-party protections. This does not create a right to unrestricted access to systems, premises, source code or other customers’ data. BeeLiked certifies that it understands and will comply with this clause 6A to the extent applicable to its Processing.
6A.3 The limited and specified business purposes in clause 6A.1 and Annex A A2, and the standard Data Subject categories and Personal Data types in Annex A A3 and A4, apply automatically to the standard Services and do not need to be repeated in an Order Form. Customer’s lawful selection, configuration and documented instructions identify which of those purposes, operations, categories and types apply, but do not expand them. Processing for a materially different purpose, Data Subject category or Personal Data type is not authorised and must not begin unless the parties first document it and any required safeguards in a signed amendment or rider satisfying clause 3.3 of the Terms. Customer remains responsible for its notices, lawful bases, consumer-request decisions and determining that the configured Services meet Customer’s obligations under applicable US State Privacy Laws. This clause does not authorise consumer health data or other Restricted Data; such Processing remains excluded unless approved under Annex A A5 and separately assessed and documented against applicable law before it begins.
7.1 Taking account of the nature of Processing and information available, BeeLiked will provide appropriate technical and organisational assistance for Customer to respond to Data Subject or consumer requests and data-protection complaints and to comply with security, breach notification, DPIA, risk-assessment and prior-consultation obligations under Articles 32 to 36 and applicable complaint-handling or US State Privacy Laws.
7.2 If BeeLiked receives a Data Subject request or data-protection complaint relating to Customer Personal Data, it will refer it to Customer without undue delay, preserve information reasonably required to investigate it and not respond substantively unless instructed or legally required. BeeLiked will provide information reasonably available to help Customer acknowledge, investigate, update the complainant and communicate an outcome within applicable statutory periods. BeeLiked may respond directly for data where it is Controller.
7.3 Standard functionality and reasonable routine assistance are included. Disproportionate, repeated or bespoke assistance may be charged at agreed rates unless required because of BeeLiked’s breach or to the extent charging would prevent or materially delay assistance that applicable Data Protection Laws require BeeLiked to provide.
8.1 BeeLiked will notify Customer without undue delay after becoming aware of a Security Incident and provide information reasonably available to help Customer meet legal obligations, including the nature of the incident; categories and approximate numbers of affected Data Subjects and Personal Data records where known; likely consequences; measures taken or proposed; and an appropriate incident contact point.
8.2 BeeLiked may provide information in phases and will take reasonable steps to contain, investigate and remediate. Notification is not an admission of fault or liability.
8.3 Customer is responsible for notifications to Supervisory Authorities and Data Subjects unless law requires BeeLiked to notify directly. Public statements naming the other party require prior consultation where practicable, except where legally required.
9.1 BeeLiked will make available all information necessary to demonstrate compliance with Article 28 and corresponding Data Protection Laws and will allow and contribute to required audits and inspections. Customer will ordinarily use, in order: current independent reports/certifications where available; completed reasonable questionnaires; additional written information; and then an audit where earlier evidence is insufficient. That sequence does not prevent or materially delay an audit, inspection or information request required by Data Protection Laws, a Supervisory Authority or substantiated risk.
9.2 Customer may conduct one audit in any 12-month period on at least 30 days’ notice, unless a substantiated Security Incident, Supervisory Authority, Data Protection Law or material compliance concern reasonably requires more or shorter notice. Audits occur during business hours where practicable, minimise disruption and protect other customers and confidential/security information. An auditor must be independent, qualified and bound by appropriate confidentiality and conflict safeguards; BeeLiked may object reasonably to a competitor auditor, but not where Customer shows that no equally qualified independent alternative is reasonably available or law requires the appointment.
9.3 Customer bears audit cost unless the audit identifies BeeLiked’s material breach, in which case BeeLiked bears reasonable audit cost directly attributable to confirming that breach. BeeLiked may charge for disproportionate assistance.
9.4 BeeLiked may propose that an on-site request be satisfied through current independent audit evidence, an independent qualified auditor or remote evidence where that adequately demonstrates compliance. BeeLiked will nevertheless allow an on-site inspection by Customer or its appropriately bound independent auditor where the earlier evidence is insufficient and the inspection is reasonably necessary to demonstrate compliance, or where Data Protection Laws or a Supervisory Authority require it, subject to the reasonable safeguards in clauses 9.1 to 9.3. Nothing restricts a Supervisory Authority’s lawful powers.
10.1 Customer may export Customer Personal Data using standard functionality while the Account remains accessible. For clauses 10.1 to 10.3 and Annex A, the applicable Exit Trigger occurs when the provision of the relevant Services involving the relevant Customer Personal Data and all ordinary substantive Processing authorised for them have ended. In determining whether that trigger has occurred, Processing strictly necessary to export, return or delete Customer Personal Data, retain it to the extent required by law binding on BeeLiked, protect and expire backup copies, or perform clauses 10.1 to 10.3 is disregarded.
10.1.1 When the applicable Exit Trigger occurs, Customer may choose to receive all Customer Personal Data in a commonly used format or have it deleted. BeeLiked will honour a written choice received before irreversible active-system deletion begins; the ordinary election period is 30 days after the applicable Exit Trigger. If Customer makes no choice, deletion is the default under clause 10.1.4.
10.1.2 If the Exit Trigger occurs only for Processing attributable to an identified Service, Order Form, Scope or other severable part while other Processing continues, this clause applies at that time only to Customer Personal Data exclusively attributable to the ended part and no longer reasonably required for continuing Processing. Shared Customer Personal Data and Customer Personal Data reasonably required for continuing Processing remain protected by this DPA and will be returned or deleted when the last relevant Exit Trigger occurs, or earlier on Customer’s documented lawful instruction subject to clause 10.2.
10.1.3 Standard export functionality may be used only if it includes all Customer Personal Data required to be returned; otherwise BeeLiked will provide the remaining data by another reasonably available commonly used format. BeeLiked need not maintain Account access and may charge reasonable documented Fees agreed in advance only for non-standard assistance not required by law or BeeLiked’s breach.
10.1.4 After satisfying a return request, BeeLiked will delete remaining active-system copies without undue delay unless law binding on BeeLiked and valid under the applicable data-protection regime requires retention, subject to clause 10.2. If Customer makes no choice within 30 days after the applicable Exit Trigger, BeeLiked will delete remaining active-system Customer Personal Data without undue delay after that period, subject to clause 10.2; deletion is the default, but Customer may still elect return until irreversible active-system deletion begins. BeeLiked need not reconstruct data already irreversibly deleted.
10.2 Customer Personal Data in backups may remain only until overwritten or deleted in BeeLiked’s documented ordinary backup cycle. BeeLiked will identify that cycle on reasonable request, and backup data will be kept no longer than reasonably necessary for continuity and recovery. Backup data will be protected, put beyond ordinary operational use and not restored except for continuity or recovery; if restored, the deletion requirement continues. Apart from backup copies retained under the preceding sentences, after satisfying Customer’s return or deletion choice BeeLiked may retain Customer Personal Data in active systems only to the extent and for the period that law binding on BeeLiked and valid under the applicable data-protection regime requires its storage, and will identify the legal requirement and expected period on reasonable request where lawful. Separately controlled account-administration, billing, legal-compliance, security, fraud-prevention or similar records described in DPA clause 1.2 may be retained under BeeLiked’s own lawful basis and retention rules, but this sentence does not authorise retention of copies or extracts of Customer Personal Data from Processor systems beyond the preceding legally required-storage exception.
10.3 On reasonable request BeeLiked will confirm deletion. Subject to clause 10.1, additional export, restoration or migration beyond standard functionality may be chargeable at reasonable documented Fees agreed in advance only where not required by law or BeeLiked’s breach.
11.1 As between the parties and to the maximum extent permitted by law, all BeeLiked liability arising from this DPA, the Security Measures, a Security Incident, confidentiality obligations and transfer mechanisms forms part of BeeLiked’s one single cumulative aggregate cap in clause 12.2 of the Terms where it relates to paid Services, or the separate limit in clause 12.3 of the Terms where it arises exclusively from Free Services, regardless of legal theory or document. Any liability that does not arise exclusively from Free Services, including liability from facts, failures or a series involving paid functionality to any extent, forms part only of clause 12.2 and the Free Services limit is not additional. A single loss, connected event or series may not be split between the two limits.
11.2 Nothing limits a Data Subject’s rights, a Supervisory Authority’s powers or either party’s direct statutory liability where it cannot lawfully be limited.
11.3 To the maximum extent permitted by law, BeeLiked’s inter-party damages, contributions, reimbursements and indemnities relating to regulatory action, Data Subject claims, SCCs, the IDTA or the UK Addendum remain subject to the applicable BeeLiked cap in clause 12.2 or 12.3 of the Terms. Customer’s liability is governed by clause 12 of the Terms, including the exclusions from Customer’s caps in clause 12.4 of the Terms; this DPA neither caps a Customer liability expressly excluded from those caps nor creates an additional uncapped category. If a mandatory statutory contribution or transfer-mechanism remedy cannot lawfully be capped, it is preserved only to that extent. Each party generally bears a sanction imposed directly on it, subject to any lawful right of contribution based on causation and fault.
11.4 No claim may be recovered twice. Multiple records, Data Subjects, Affiliates, documents, legal bases or events, whether related or unrelated, do not create a separate cap or reset the single cumulative cap. Liability is reduced to reflect the claimant’s or a third party’s contribution.
12.1 This DPA continues while BeeLiked Processes Customer Personal Data. After return or deletion, confidentiality, Security Incident notification and cooperation, compliance information and audits concerning prior Processing, deletion confirmation, transfer obligations, liability, claims and records survive for so long and to the extent reasonably necessary to address that prior Processing, demonstrate compliance, meet accrued obligations or comply with law. Where a later agreement or amendment validly provides that this DPA replaces a Historic Data Agreement, this DPA governs all Processing carried out on or after the replacement effective date, including Processing after that date of Customer Personal Data first received or collected before that date. The Historic Data Agreement ceases to govern that Processing unless a later signed customer-specific amendment expressly provides otherwise in accordance with clauses 3.2 and 3.3 of the Terms.
12.2 The order of precedence in clause 3.2 of the Terms applies, provided that the SCCs, IDTA or UK Addendum prevail to the minimum extent required by law and this DPA prevails solely for mandatory Processor obligations concerning Customer Personal Data and, as against any Historic Data Agreement, for all Processing governed by this DPA. That conflict priority disapplies only conflicting provisions and does not by itself supersede or terminate the Historic Data Agreement or its non-conflicting provisions; replacement or supersession is governed by clause 15.6 of the Terms and clause 12.1 of this DPA. A genuinely cumulative historic privacy, data-protection, security, audit or Processing obligation may continue only as the standalone additional obligation described in clause 3.2(c) of the Terms; it does not alter liability, caps, exclusions, indemnities, remedies or insurance. Clause 3.3 of the Terms governs any other change to a Protected Term, subject only to the limited legally necessary DPA-update mechanism in clause 15.2 of the Terms. The Terms’ liability architecture applies across all documents except to the extent mandatory law, the SCCs, IDTA or UK Addendum prohibit it.
12.3 Legally required updates are governed by clause 15.2 of the Terms, subject to the protections for fixed Terms identified in clause 15.3 of the Terms.
Processing Customer Personal Data to provide, host, secure, support and maintain the Services and Customer-Operated Promotions from the earlier of: (a) commencement of the applicable Subscription Term; and (b) following formation of the Agreement, the first authorised Processing of Customer Personal Data to configure, implement, migrate, prepare, provide or support the applicable Service; throughout the Subscription Term; and thereafter during the return and active-system deletion period and, solely for protected copies put beyond ordinary use, the ordinary backup cycle described in DPA clause 10.2. If the applicable Service is cancelled or never supplied, its Exit Trigger occurs on the later of: (i) the effective date of its cancellation or termination or BeeLiked’s written notice that it will not be supplied; and (ii) the cessation of any ordinary substantive configuration, implementation, migration, preparation or support Processing that remains authorised for that Service. The Processing duration continues thereafter solely for export, return, active-system deletion, legally required retention, protected backup expiry and the compliance activities permitted by DPA clauses 10.1 to 10.3 and 12.1. Separately controlled account-administration, billing, legal-compliance, security, fraud-prevention or similar records identified in DPA clause 1.2 are outside this Annex A; neither that classification nor this paragraph authorises retention of copies or extracts of Customer Personal Data from Processor systems contrary to DPA clause 10.2.
The nature of Processing is collection, recording, organisation, storage, retrieval, display, transmission, support, analysis on Customer’s behalf, return and deletion. The specific purposes are: (a) configuring, implementing, integrating, hosting, operating, maintaining, supporting and providing the Services and Customer-Operated Promotions; (b) operating Customer-configured Accounts, Promotions, forms, entries, workflows and reports; (c) administering entries, eligibility, outcomes, Reward allocation and redemption records, Participant transactions and Customer-instructed communications; (d) authenticating Users and administering access on Customer’s behalf, including transiently receiving and validating a User-presented password, one-time code, passkey response, session token or other standard authentication factor through BeeLiked’s controlled authentication workflow, and providing support and troubleshooting and maintaining service, usage and audit records on Customer’s behalf; (e) access control, security, fraud and abuse prevention, incident response, backup, recovery and continuity; (f) Customer-requested reports, exports and analytics; and (g) return, legally required retention and deletion under the DPA. Only purposes necessary for Customer’s selected and configured Services apply.
Customer Users and administrators; entrants and participants in Customer-Operated Promotions, including children only where Customer lawfully configures a Promotion for them under clause 4.5 of the Terms; Customer personnel, contractors, partners, members, employees, suppliers and consumers whose Personal Data Customer submits or collects through the Services; and individuals who communicate with Customer through Customer-configured support or contact workflows. These are the standard Data Subject categories. Customer configuration selects among them but does not authorise a materially different category. A materially different Data Subject category is excluded unless first documented in a signed amendment or rider satisfying clause 3.3 of the Terms.
Names; email addresses; telephone numbers; postal addresses where configured; account and Customer-supplied internal reference identifiers; non-reversible password and token hashes, token identifiers and authentication metadata that cannot themselves be used to authenticate; IP addresses; device and browser identifiers; usage and audit records processed on Customer’s behalf; Promotion entries; survey and free-text responses that do not intentionally solicit Restricted Data; images, photographs, graphics, audio, video and other digital files uploaded or submitted through standard Service functionality, together with embedded or associated metadata, only where that content and metadata do not include precise geolocation, biometric identifiers or templates used for identification, consumer-health data, sensitive-trait inferences or other Restricted Data; preferences, including marketing preferences, consent and permission records; eligibility information; age or date-of-birth fields and parent or guardian consent records where lawfully configured; Reward allocation and redemption records; Customer support communications; organisation, employment and role information; and purchase, receipt or transaction evidence excluding payment-card and financial-account data. These are the standard Personal Data types. Customer configuration selects among them but does not authorise a materially different type. A materially different Personal Data type is excluded unless first documented in a signed amendment or rider satisfying clause 3.3 of the Terms. A User-presented password, one-time code, passkey response, session token or other standard authentication factor is included only for transient receipt and validation through BeeLiked’s controlled authentication workflow; BeeLiked will not retain a live password after validation and may retain only the non-reversible hash, token identifier or authentication metadata needed for the Service and security. Customer-supplied live credentials, bearer, access or refresh tokens and other usable authentication secrets submitted to Customer-configured content, data or support fields, or supplied for access to a third-party system, are not included in the standard Processing description. Where technically reasonably available, Customer should disable unnecessary sensitive inference and BeeLiked will strip unneeded embedded metadata from standard workflows it controls.
Except for the narrowly limited standard authentication-factor Processing expressly described in A2(d) and A4, Restricted Data, including any live credential or usable authentication secret, is excluded from the standard Processing description unless the category, purposes, safeguards, technical restrictions and commercial allocation have first been documented in a signed amendment or rider satisfying clause 3.3 of the Terms. A routine Order Form, online purchase, configuration, email or support message does not provide that initial authorisation. Once a Restricted Data profile is authorised, BeeLiked may approve non-material operational instructions within that authorised category, purposes and risk profile in writing without a further prescribed form, but no such instruction may expand the authorised category or purposes or materially increase the safeguards, risk or commercial exposure. Genuinely unexpected Restricted Data may nevertheless be Processed incidentally, without a rider, only to the extent technically unavoidable and strictly necessary to identify, secure, quarantine, restrict, return or delete it under clauses 4.8 and 4.9 of the Terms; this does not authorise its intended collection, ordinary use or continued Processing. Customer configuration and unexpected Participant submissions remain governed by clauses 4.5 to 4.9 of the Terms.
The Agreement, Customer’s lawful selection and configuration, and written instructions accepted by BeeLiked, in each case only within the purposes, Data Subject categories, Personal Data types and approved profiles in A2 to A5, including the narrow incidental handling of genuinely unexpected Restricted Data authorised by A5. An Order Form may identify selected Services and permitted commercial or operational particulars but does not expand A2 to A5 or bypass clause 3.3 of the Terms.
BeeLiked will maintain all technical and organisational measures required by Article 32 of the UK GDPR and corresponding Data Protection Laws, appropriate to the nature of the Services, the Personal Data processed and the risks to individuals. Those measures will be designed to ensure ongoing confidentiality, integrity, availability and resilience of Processing systems and services; restore availability and access to Customer Personal Data in a timely manner following an incident; and provide for regular testing, assessment and evaluation of their effectiveness, in each case as appropriate to risk.
Those measures include, as appropriate to risk: (a) access controls designed to restrict access to authorised personnel according to role and business need, including authentication controls and periodic access review; (b) appropriate encryption and network-security measures for Customer Personal Data in transit and at rest; (c) documented processes for secure configuration, change control, vulnerability management, security monitoring and incident response; (d) backup, recovery and business-continuity arrangements proportionate to the Services; (e) personnel confidentiality, security policies and proportionate security training; (f) risk-based assessment and oversight of relevant Subprocessors and service providers; and (g) processes for the secure retention, return and deletion of Customer Personal Data in accordance with the DPA.
BeeLiked may modify these measures from time to time, provided that the overall protection of Customer Personal Data is not materially reduced.