Customer Data Processing Agreement

This Customer Data Processing Agreement (“DPA”) forms part of the agreement between D3 Digital Services Limited (“Processor”, “ARify”, “we”) and the publisher customer (“Controller”, “you”) for the ARify service. It applies where we process personal data on your behalf when providing the service.

We are registered with the UK ICO and hold Cyber Essentials certification.

1. Roles

• You are the controller of personal data contained in content you upload and of end-user/reader data generated through your QR experiences.
• We are the processor of that customer personal data, and process it only on your documented instructions (including configuration in the dashboard).
• For our own account, billing, and platform administration data about publisher users, we act as an independent controller as described in the Privacy Notice.

2. Subject matter and duration

Processing covers hosting, storage, transmission, display, analytics related to scans/engagement, backups, and support for the ARify service, for the term of your account and any agreed retention period afterwards.

3. Nature of processing & data types

• Content and media you upload that may include personal data.
• Technical and usage data from reader devices interacting with your QR experiences (for example scan events).
• Account contacts you choose to store in the service.

4. Our obligations as processor

• Process customer personal data only on your instructions, unless required by law.
• Ensure persons authorised to process the data are bound by confidentiality.
• Implement appropriate technical and organisational security measures (see section 5).
• Only use sub-processors that provide sufficient guarantees, and remain responsible for them.
• Assist you, where reasonably possible, with data-subject requests, DPIAs, and breach notifications.
• Delete or return customer personal data at the end of the service, subject to legal retention needs.
• Make available information needed to demonstrate compliance and allow audits on reasonable notice.

5. Security measures

• Hosting: production systems run on hardened cloud infrastructure with network and identity controls.
• Encryption: TLS for data in transit; protected storage for credentials and secrets.
• Backups: regular backups with restricted access to support continuity and recovery.
• Access controls: least-privilege access for staff, authentication controls, and logging of privileged activity.
• Incident response: documented handling of suspected incidents, including containment, assessment, customer notification where required, and remediation.

6. International transfers

If customer personal data is transferred outside the UK/EEA, we use an approved transfer mechanism (such as UK IDTA / Addendum or adequacy) where required.

7. Your responsibilities

You are responsible for the lawfulness of your content and instructions, providing any notices to end users, and configuring the service appropriately for your use case.

8. Contact

Privacy and processing enquiries: [email protected]. Related documents: Terms of Service and Privacy Notice.