Data Processing Agreement
ATOUCH gift card system — Article 28 GDPR terms.
Last updated: 29 August 2026
When you record details about your own customers in ATOUCH — their email address, or any field you configure — you are the data controller and we are your processor. Article 28 GDPR requires a written agreement governing that. This page is that agreement. It applies automatically to every ATOUCH account and forms part of our Terms & Conditions; you do not need to sign anything separately. If your organisation requires a countersigned copy, email support@atouch.com.
In this agreement, "Processor" means ATOUCH, the provider of the ATOUCH gift card service, established in Ireland; "Controller" means the business holding the ATOUCH account; "Customer Personal Data" means personal data about the Controller's own customers that the Controller records in the service; and "GDPR" means Regulation (EU) 2016/679 as applicable in Ireland, together with the Data Protection Act 2018.
1. Subject matter, duration, nature and purpose
The Processor processes Customer Personal Data solely to provide the ATOUCH gift card service described in the Terms & Conditions: storing gift card sale records, sending gift card emails to the Controller's customers at the Controller's request, tracking the delivery outcome of those emails, and making the records available to the Controller through the app and API. Processing lasts for as long as the Controller's account exists, plus the deletion window in clause 9.
2. Types of data and categories of data subject
| Categories of data subject | Types of personal data |
|---|---|
| The Controller's customers — people who buy or receive a gift card | Email address (where the Controller records one); any additional field the Controller configures (for example a name); the gift card's sale, top-up, redemption and balance history; and the delivery outcome of emails sent to that address. |
| The Controller's staff | The account email address recorded against each action in the card's audit trail. |
No special categories. The service is not designed for Article 9 data (health, beliefs, biometrics and the rest) and the Controller must not record such data in configurable fields. The service holds no payment card data of the Controller's customers: gift cards are paid for in the Controller's own shop, by means ATOUCH never sees.
3. The Controller's instructions
The Processor processes Customer Personal Data only on the Controller's documented instructions, which consist of this agreement, the Terms & Conditions, and the Controller's own use of the service's features (for example choosing to send a customer a PIN email, or configuring a metadata field). The Processor will tell the Controller if, in its opinion, an instruction infringes the GDPR. Where EU or Irish law requires the Processor to process for another purpose, it will inform the Controller first unless that law forbids it.
The Controller is responsible for having a lawful basis to collect the data it records, and for giving its customers the information the GDPR requires about that collection.
4. Confidentiality
The Processor ensures that every person authorised to process Customer Personal Data is bound by an appropriate duty of confidentiality and processes it only as needed to operate the service.
5. Security (Article 32)
The Processor implements appropriate technical and organisational measures, including:
- encryption of all data at rest, and TLS for all data in transit;
- production access restricted to authorised operators, protected by multi-factor authentication;
- authentication of Controller users through a managed identity provider; API credentials stored only as hashes, capped per account, and revocable at any time, with every action attributed to the credential that performed it;
- gift card PINs excluded from bulk data exports and from any email to the Controller, and previous customers' addresses withheld from API-key reads of a card's history;
- continuous point-in-time database backups over a rolling 35-day window; and
- automated alerting on service errors, monitored by the operator.
The Processor is a small organisation and does not hold ISO 27001 or SOC 2 certification; the measures above are what it actually operates, and the Controller should assess them against its own risk appetite.
6. Sub-processors
The Controller gives general authorisation for the Processor to engage the sub-processors listed in the Privacy Policy (currently Amazon Web Services, Stripe and Google). The Processor imposes data protection obligations on each sub-processor no less protective than this agreement, and remains fully liable to the Controller for their performance. The Processor will give the Controller at least 30 days' notice by email before adding or replacing a sub-processor; if the Controller reasonably objects on data protection grounds within that period, it may terminate the affected service without penalty.
7. International transfers
Customer Personal Data is stored in the EEA (Amazon Web Services, Ireland). Transfers outside the EEA occur only through the sub-processors named above and are covered by standard contractual clauses adopted by the European Commission and/or the EU–US Data Privacy Framework, as set out in the Privacy Policy. The Processor will not transfer Customer Personal Data outside the EEA on any other basis without informing the Controller.
8. Assistance to the Controller
Taking into account the nature of the processing, the Processor will:
- Data subject rights (Art. 12–23). Provide the self-service tools in the app and API through which the Controller can itself access, correct, export and delete its customers' records — which for most requests is the complete answer. Where a request cannot be met that way, the Processor will assist on request. If a data subject contacts the Processor directly, it will not respond substantively but will forward the request to the Controller without undue delay.
- Breach notification (Art. 33–34). Notify the Controller without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data, with the information the Controller needs to meet its own notification duties.
- Impact assessments (Art. 35–36). Provide reasonable assistance with data protection impact assessments and prior consultation, given the information available to it.
9. Deletion and return (Art. 28(3)(g))
The Controller can export its data at any time through the service's export features. On termination, or on the Controller's written request, the Processor deletes Customer Personal Data: deleting the account moves its data to a restricted store for 30 days — a recovery window during which the Controller can restore the account by signing up again with the same email address — after which it is permanently and automatically deleted. Residual copies in backups are deleted as those backups age out, within the rolling 35-day window, and remain protected by this agreement until then. The Processor retains data beyond these periods only where EU or Irish law requires it.
10. Audit (Art. 28(3)(h))
The Processor makes available all information reasonably necessary to demonstrate compliance with this agreement, and will respond to a Controller's reasonable written questionnaire no more than once a year. The Controller may audit on reasonable prior notice of at least 30 days, no more than once a year (unless a supervisory authority requires otherwise or a breach has occurred), during business hours, subject to confidentiality, and at the Controller's own cost.
11. General
This agreement takes effect on the Controller's first use of the service and continues until processing ends under clause 9. If any provision conflicts with the Terms & Conditions, this agreement prevails for matters of data protection. It is governed by Irish law, and the Irish courts have jurisdiction. The Processor may update this agreement to reflect changes in the service or the law, giving notice as it would for a material change to the Terms.
Questions about this agreement: support@atouch.com.