Last updated: October 9, 2026

This Data Processing Addendum ("DPA") forms part of the Casa Apps Terms of Service, or any other agreement governing the merchant's use of Casa Loyalty (the "Agreement"), between the merchant ("Customer") and Casa Apps Inc. or its Affiliate ("Casa Apps"). It applies to Casa Apps' processing of Personal Data solely on the Customer's behalf in providing Casa Loyalty (the "Services").

By installing or using the Services, the Customer accepts this DPA. The person installing or using the Services on the Customer's behalf confirms they have authority to bind the Customer. If the Customer does not agree to this DPA, it must not send Personal Data to Casa Apps.

Terms used in this DPA have the following meanings:

(a) "Affiliate" means any entity that controls, is controlled by, or is under common control with a party, where control means owning more than 50% of the voting interests.

(b) "CCPA/CPRA" means the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act, and its regulations.

(c) "Controller", "Data Subject", "Member State", "Processor", "Processing" and "Supervisory Authority" have the meanings given in the GDPR, and "Business", "Business Purpose", "Consumer" and "Service Provider" have the meanings given in the CCPA/CPRA.

(d) For the CCPA/CPRA, references to Controller mean Business, references to Processor mean Service Provider, and references to Subprocessor mean a Service Provider engaged by Casa Apps.

(e) "Data Protection Laws" means all privacy and data protection laws that apply to the processing of Personal Data under the Agreement, including the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection, the CCPA/CPRA, the Virginia Consumer Data Protection Act and the Colorado Privacy Act.

(f) "Data Subject" means the identified or identifiable person to whom Personal Data relates.

(g) "GDPR" means Regulation (EU) 2016/679.

(h) "Personal Data" (or "Personal Information") means information that identifies, or could reasonably be linked to, a person or Consumer, to the extent Casa Apps processes it solely on the Customer's behalf.

(i) "Security Measures" means the security measures for the Services described in Section 3, as updated from time to time.

(j) "Sensitive Data" means personal data that requires special treatment under the Data Protection Laws, including special categories of personal data under the GDPR.

(k) "Standard Contractual Clauses" or "SCCs" means (i) the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914 ("EU SCCs"), or (ii) the International Data Transfer Addendum issued by the UK Information Commissioner ("UK SCCs"), as applicable.

(l) "Subprocessor" means a third party that processes Personal Data under Casa Apps' instruction or supervision, as listed in Schedule D.

(m) "UK GDPR" means the GDPR as retained in UK law, together with the UK Data Protection Act 2018, as amended.

2.1 Roles. The Customer is the Controller and Casa Apps is the Processor. For the CCPA/CPRA, the Customer is the Business and Casa Apps is the Service Provider.

2.2 Customer's obligations. The Customer will comply with the Data Protection Laws in its use of the Services. The Customer is responsible for having all legal bases, notices and consents needed to collect Personal Data and transfer it to Casa Apps, and authorises Casa Apps to process it, including for the Business Purposes under the CCPA/CPRA.

2.3 Casa Apps' processing. Casa Apps will process Personal Data only: (i) in line with the Agreement and this DPA; (ii) to provide the Services; (iii) to follow the Customer's reasonable documented instructions that are consistent with the Agreement; and (iv) where required by law or by a court or government authority, in which case Casa Apps will inform the Customer first unless the law prohibits this on public-interest grounds. If Casa Apps believes an instruction breaks the Data Protection Laws, it will tell the Customer promptly. Casa Apps may then pause the affected processing (while keeping the Personal Data securely stored) or suspend the Customer's access to the Services, without liability. If the parties cannot resolve the issue, the Customer's sole remedy is to stop the affected processing, and it remains liable for any amounts owed under the Agreement.

2.4 Details of processing. The details of the processing are set out in Schedule A.

2.5 Sensitive Data. The Services are not intended for Sensitive Data. The Customer may use the Services to process Sensitive Data only with Casa Apps' explicit prior written consent and any additional agreement Casa Apps requires.

2.6 No sale of Personal Data. Casa Apps does not receive Personal Data as consideration for the Services. Casa Apps will not acquire any rights in the Personal Data, combine it with data from other parties, or use it for any purpose other than those set out in the Agreement and this DPA. Casa Apps will not sell or share Personal Data without the Customer's prior written consent or instruction.

Casa Apps will implement technical and organisational measures appropriate to the risk of the processing, and will give the Customer reasonable assistance to meet its own security obligations under the Data Protection Laws. These Security Measures include encryption of Personal Data in transit and at rest, access controls limited to authorised personnel, secure hosting and backups, and monitoring of its systems.

The Services are hosted on Amazon Web Services, which maintains SOC 2 Type II and ISO 27001 certifications. Casa Apps will not materially reduce the Security Measures during the term of the Agreement without giving the Customer reasonable prior written notice.

Casa Apps maintains policies and procedures for managing security incidents. Where required by the Data Protection Laws, Casa Apps will notify the Customer without undue delay after becoming aware of an accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data (a "Data Incident"). Casa Apps will take reasonable steps within its control to remediate and mitigate the Data Incident. This section does not apply to incidents caused by the Customer or its users.

The Customer will not publicly disclose or report on a Data Incident in a way that identifies Casa Apps without Casa Apps' prior written approval, unless the law requires it. In that case, the Customer will, where lawful, give Casa Apps prior notice and limit the disclosure to what the law requires.

5.1 Appointment. The Customer agrees that Casa Apps may engage third-party Subprocessors to process Personal Data.

5.2 Current list. The current Subprocessors are listed in Schedule D. The Customer authorises them when it first uses the Services.

5.3 Notice of changes. Casa Apps will notify the Customer by email, sent to the email address on the Customer's Casa Loyalty account, before authorising a new Subprocessor. The Customer is responsible for keeping that email address up to date.

5.4 Objection. The Customer may object to a new Subprocessor on reasonable data protection grounds by writing to Casa Apps, with its reasons, within 7 days of the notice. If the Customer does not object within that period, it is deemed to have accepted the new Subprocessor. Casa Apps will make reasonable efforts to offer an alternative. If no alternative is available within 30 days, the Customer may terminate only the affected Services, as its sole remedy. Casa Apps may suspend the affected processing until a decision is made.

5.5 Subprocessor obligations. Casa Apps will have a written agreement with each Subprocessor imposing data protection obligations materially similar to those in this DPA, and remains responsible for any failure by a Subprocessor to meet them.

Data Subjects exercise their rights against the Controller. Where the law allows and in line with the functionality of the Services, Casa Apps will give the Customer reasonable assistance in responding to these requests. If Casa Apps receives a request directly from a Data Subject, it will notify the Customer, and the Customer will handle the request.

7.1 The Customer may verify Casa Apps' compliance with this DPA through certificates, reports or other evidence from independent bodies, provided at Casa Apps' discretion.

7.2 Casa Apps will make available to the Customer the information needed to demonstrate compliance with this DPA, and will allow for and contribute to audits by the Customer or an auditor it appoints, as follows:

8.1 EU SCCs. The EU SCCs (Module Two: controller to processor) apply to Personal Data from the European Economic Area transferred to Casa Apps in the United States, and are incorporated into this DPA by reference. For the EU SCCs: the optional language in Clause 11 does not apply; Option 2 of Clause 9 applies, with the notice process in Section 5; Option 1 of Clause 17 applies; and the law and courts of Ireland apply under Clauses 17 and 18. The Annexes to the EU SCCs are set out in Schedule B. If the EU SCCs conflict with this DPA, the EU SCCs prevail. If any provision of this DPA is found invalid under the EU SCCs, it will be severed and the rest of this DPA will remain in effect.

8.2 UK SCCs. The UK SCCs apply to Personal Data from the United Kingdom transferred to Casa Apps in the United States, on the same basis as Section 8.1, completed as set out in Schedule C. If the UK SCCs conflict with this DPA, the UK SCCs prevail.

8.3 Other territories. For Personal Data from any other territory, each party will comply with the data transfer laws of the territory where the Personal Data originates.

This DPA stays in effect for as long as the Agreement. After the Agreement ends, Casa Apps will delete all Personal Data it received from the Customer and, on request, provide the Customer with a written report confirming the deletion. Casa Apps may keep documentation showing that the processing was carried out properly for the applicable retention period after this DPA ends.

10.1 For the CCPA/CPRA, the Customer is the Business and Casa Apps is the Service Provider.

10.2 Casa Apps will process California Personal Information only for the Business Purpose of providing the Services, or as otherwise allowed by the CCPA/CPRA. Casa Apps will not: (i) sell or share the Personal Information; (ii) retain, use or disclose it outside the direct business relationship with the Customer; or (iii) combine it with personal information from other sources, except as the CCPA/CPRA allows. The Customer's disclosure of Personal Information to Casa Apps is not a sale and is not made for consideration.

10.3 Casa Apps will comply with its obligations under the CCPA/CPRA and will promptly notify the Customer if it can no longer meet them.

10.4 The Customer will give its end users any notice required by the CCPA/CPRA, including under California Civil Code § 1798.130, that their Personal Information is used or shared with Casa Apps.

10.5 For matters under the CCPA/CPRA, this Section 10 prevails over any other section of this DPA.

11.1 Governing law. This DPA is governed by the laws of the State of Delaware and the federal laws of the United States, except where the SCCs require otherwise.

11.2 Relationship to the Agreement. This DPA applies only to the extent required by the Data Protection Laws. In all other respects, the provisions of the Agreement on indemnities, limitation of liability and enforcement apply to this DPA. If this DPA conflicts with the Agreement, this DPA prevails only for data processing terms required by the Data Protection Laws; otherwise, the Agreement prevails.

11.3 Severability. If any provision of this DPA is invalid or unenforceable, it will be amended to the minimum extent needed to make it valid, with an effect as close as possible to the original, and the rest of this DPA will remain in effect.

11.4 Amendments. Any amendment to this DPA must be made in writing. Email is sufficient.

The supervisory authority of the EU Member State in which the data exporter is established.

The version of the EU SCCs incorporated in Section 8.1 of this DPA, including the Module and options selected there.

Neither party may end the UK SCCs under Section 19 of the UK SCCs.