Data Processing Agreement

1          Purpose

This Data Processing Agreement governs how XFunge processes personal data on behalf of clubs, businesses and organisations (“Clients”) that use XFunge’s managed service to issue digital membership and loyalty cards into Apple Wallet and Google Wallet.

It forms part of, and should be read together with, the XFunge Terms and Conditions and the XFunge Privacy Policy.

2          Definitions

Controller means the Client, which decides the purposes for which member personal data is processed.

Processor means XFunge, which processes personal data on behalf of the Controller.

Member means a person whose details the Controller supplies so that a card can be issued to them.

Subprocessor means a third party engaged by XFunge to process personal data as part of the service.

3          Roles and Responsibilities

The Controller is responsible for compliance with applicable privacy laws, including the Privacy Act 2020, and for ensuring that member data has been lawfully collected and that members may be contacted by email to receive their card.

XFunge acts solely as a Data Processor and processes data only on documented instructions from the Controller. Uploading a CSV file through the client portal is an instruction to issue cards to the members listed in it.

XFunge does not use member data for its own purposes. Member details are not entered into XFunge’s CRM or any custom list or database, and XFunge does not market to members.

4          Nature of Processing

Processing includes:
- Receiving member data through CSV files uploaded to the client portal
- Creating cards from the Controller’s approved template using a pass issuing platform
- Sending each card to the member by email to add to Apple Wallet or Google Wallet
- Updating or voiding a card, or resending the card link via email for an existing card, where the Controller requests it and the platform allows it
- Providing support to the Controller

5          Types of Personal Data

Personal data is limited to the details the Controller supplies to issue and deliver cards, which may include name, membership number or member identifier, email address, phone number, and membership type.

The Controller must not supply sensitive information, payment card details or passwords. XFunge does not process members’ payment details.

6          Security Measures

XFunge implements appropriate technical and organisational security measures to protect personal data.

Access to each Controller’s area of the client portal is limited to that Controller’s authorised users and XFunge.

7          Subprocessors

XFunge may engage subprocessors subject to equivalent data protection obligations and remains responsible for their performance.

Subprocessors include the pass issuing platform, the client portal and email delivery providers, and cloud hosting providers. Once a member adds a card to their wallet, Apple or Google stores it on the member’s device under their own terms and privacy policies.

Some subprocessors may store or process personal data outside New Zealand. XFunge takes reasonable steps to ensure that personal data is protected in a way comparable to the Privacy Act 2020.

8          Data Subject Rights

Members exercise their privacy rights through the Controller. XFunge assists the Controller in responding to access, correction or deletion requests as required by law. Where assisting with a request requires XFunge to change or remove a card, or resend the card link via email for an existing card, fees apply as set out in the XFunge Terms and Conditions.

Members can delete their card from Apple Wallet or Google Wallet at any time.

9          Personal Data Breaches

XFunge will notify the Controller without undue delay upon becoming aware of a personal data breach, and will provide the information the Controller needs to meet any obligation to notify the Privacy Commissioner and affected members.

10       Data Retention and Deletion

The Controller is responsible for the files and content it uploads to the client portal, and is free to delete its files once the cards have been issued. XFunge may also delete files from the portal once the cards have been issued.

Card details held by the pass issuing platform are kept for the life of the card. Cards stay on members’ devices until members delete them and cannot be removed remotely.

Upon termination of services or upon instruction from the Controller, personal data held by XFunge is deleted or returned, unless retention is required by law.

11       Audit and Compliance

XFunge will make information available to demonstrate compliance with this Agreement upon reasonable request.

12       Governing Law

This Agreement is governed by the laws of New Zealand, as set out in the XFunge Terms and Conditions.

13       Contact Information

For privacy enquiries, contact:
Email: [email protected]
Websites: www.xfunge.com and www.xfunge.co.nz