Data Processing Addendum

Last updated: June 17, 2026

This Data Processing Addendum (“DPA”) is incorporated into and forms part of the LockBuzz Terms of Service. It applies where LockBuzz processes personal data of a Brand’s Subscribers on the Brand’s behalf.

1. Definitions

• Controller: the Brand, who determines the purposes and means of processing Subscriber personal data.
• Processor: LockBuzz, who processes Subscriber personal data on behalf of and under the instruction of the Brand.
• Personal Data / Subscriber Data: pseudonymous data relating to identified or identifiable individuals who have installed a Brand’s LockBuzz wallet pass, as further described in Section 2.
• Processing: any operation performed on personal data, including collection, storage, retrieval, use, disclosure, or deletion.
• GDPR: the EU General Data Protection Regulation 2016/679, and where applicable the UK GDPR and Data Protection Act 2018.
• Sub-processor: any third party engaged by LockBuzz to process Subscriber Data on the Brand’s behalf.

2. Scope of Processing

Purpose

LockBuzz processes Subscriber Data as Processor solely for the purpose of delivering wallet pass installation, maintenance, gamification, and push notification services on behalf of the Brand.

Categories of Data Processed

Data Subjects

Individuals who install a Brand’s LockBuzz wallet pass (“Subscribers”).

Duration

For the term of the Brand’s LockBuzz subscription, plus the retention periods specified in Section 9.

3. Brand Obligations (Controller)

The Brand shall:

• Establish and maintain a lawful basis for collecting and processing Subscriber Data before using the LockBuzz platform
• Provide Subscribers with clear notice of data processing at or before pass installation, including LockBuzz’s role as Processor and reference to this DPA
• Ensure Subscriber Data is not used for purposes beyond operating the Brand’s LockBuzz channel
• Not instruct LockBuzz to process Subscriber Data in a manner that violates applicable data protection law
• Fulfill Subscriber data subject rights requests within applicable legal deadlines, using the tools provided by LockBuzz
• Not combine pseudonymous Subscriber identifiers with external personally identifiable information without a separate, documented lawful basis
• Not sell, share, or otherwise transfer exported Subscriber Data to third parties for advertising, targeting, or data brokering purposes

4. LockBuzz Obligations (Processor)

LockBuzz shall:

• Process Subscriber Data only on documented instructions from the Brand (i.e., operating the pass notification service) and notify the Brand if an instruction appears to violate applicable law
• Ensure personnel authorised to process Subscriber Data are bound by written confidentiality obligations
• Implement and maintain the technical and organisational security measures described in Section 6
• Assist the Brand in fulfilling data subject rights requests (access, correction, deletion, portability) using tools provided in the LockBuzz platform
• Notify the Brand without undue delay, and within 72 hours where feasible, upon becoming aware of a personal data breach affecting Subscriber Data
• Upon account termination, delete all Subscriber Data within 30 days, or return it in a portable format at the Brand’s written request made within 14 days of termination
• Provide information reasonably necessary to demonstrate compliance with this DPA upon written request, subject to the audit rights in Section 10

5. Sub-processors

The Brand grants general authorisation for LockBuzz to engage the following sub-processors. LockBuzz will impose data protection obligations on each sub-processor equivalent to those in this DPA.

LockBuzz will notify Brands of any intended additions or replacements to sub-processors at least 14 days in advance, giving the Brand opportunity to object on reasonable grounds. If the Brand objects and LockBuzz cannot accommodate the objection, either party may terminate this DPA with 30 days’ notice.

6. Security Measures

LockBuzz implements the following technical and organisational measures:

• Encryption in transit using TLS 1.2 or higher
• Encryption at rest using AES-256
• Row-level security policies in the database restricting Subscriber Data access to the authorised Brand account
• Pseudonymisation of all Subscriber records (UUID identifiers; no name, email, or phone number stored)
• Access controls limiting internal staff access to Subscriber Data
• Audit logging of material system events
• Regular review of sub-processor security posture

7. Data Subject Rights

Upon receiving a verifiable erasure request from a Subscriber, the Brand shall use LockBuzz’s Subscriber deletion tool (Settings › Danger Zone › Delete Subscriber by ID) to delete the record. LockBuzz will execute the deletion within 24 hours of the Brand’s instruction.

For access and portability requests, the Brand may use the Subscriber data export feature (Settings › Danger Zone › Export Subscriber Data) to provide a portable copy of the relevant data to the requesting Subscriber.

LockBuzz will assist the Brand with data subject requests that cannot be fulfilled by self-serve tools upon written request to privacy@lockbuzz.io.

8. Data Breach Notification

In the event of a personal data breach affecting Subscriber Data, LockBuzz will notify the Brand without undue delay and within 72 hours where feasible. The notification will include, to the extent available:

• The nature of the breach and categories of data affected
• The approximate number of Subscribers affected
• The likely consequences of the breach
• Measures taken or proposed to address the breach

The Brand is responsible for any notifications to Subscribers or supervisory authorities required by applicable law, based on information provided by LockBuzz.

9. Data Retention and Deletion

• Active Subscribers: Subscriber Data retained while the pass is installed
• Unsubscribed Subscribers: Records automatically purged within 90 days of pass removal
• Account termination: All Subscriber Data deleted within 30 days, unless the Brand requests a portable export within 14 days of termination
• Individual erasure: Brand-initiated deletions via the Settings panel are executed immediately
• Pause plan: Subscriber Data retained for up to 12 months of inactivity; 60-day advance notice before auto-deletion

10. Audit Rights

The Brand may, with at least 30 days’ written notice and no more than once per calendar year, request that LockBuzz provide documentation demonstrating compliance with this DPA, or engage a mutually agreed qualified third-party auditor to conduct an audit. The Brand shall bear the reasonable cost of any such audit. LockBuzz may object to specific auditor firms that present a conflict of interest.

11. International Data Transfers

Subscriber Data may be transferred to and processed in countries outside the European Economic Area (EEA), including the United States, in connection with the sub-processors listed in Section 5. Such transfers are made under appropriate safeguards.

For transfers of EEA or UK Subscriber Data to sub-processors in third countries, LockBuzz relies on the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module 2: Controller to Processor) or the UK International Data Transfer Addendum where applicable. By entering into this DPA, the Brand and LockBuzz agree to be bound by the SCCs for any such transfers.

The SCCs are available at the European Commission’s SCC page or upon request to privacy@lockbuzz.io.

12. Liability

Each party’s liability to the other under this DPA is subject to the limitations of liability set out in the LockBuzz Terms of Service. Where a claim arises under data protection law attributable to both parties’ conduct, liability is allocated in proportion to each party’s responsibility for the damage.

13. Term and Termination

This DPA forms part of the Terms of Service and remains in effect for as long as LockBuzz processes Subscriber Data on behalf of the Brand. It terminates automatically upon final deletion of all Subscriber Data following account termination. Sections 6, 8, 9, and 11 survive termination for the periods specified therein.

14. Governing Law

This DPA is governed by the same governing law as the Terms of Service, except where a different governing law is mandated by applicable data protection legislation (in which case the relevant data protection law governs with respect to those requirements).