Data Processing Agreement

This agreement is between you (the controller) and Thrilla Digital Ltd (registered in Scotland, SC878333) trading as Monact (the processor). It applies whenever we process personal data on your behalf and forms part of the Terms of Service. It is written to satisfy Article 28(3) of the UK GDPR and of Regulation (EU) 2016/679.

You do not need to sign anything. Accepting the Terms accepts this. If your own procurement process needs a countersigned copy, email contact@monact.co and we will sign yours.

1. Subject matter, duration, nature and purpose

Subject matter: collecting and presenting responses from people who scan a QR card you have printed.

Duration: for as long as your account is open, plus the retention period in section 8.

Nature and purpose: receiving a scan, showing the respondent the screens you configured, storing their answers, de-duplicating submissions, and displaying the results to you.

2. Types of personal data and categories of data subject

Data subjects: your customers, who scan a printed card.

Personal data:

• Answers given to the questions you wrote, including free-text answers.
• A randomly generated visit identifier stored in a cookie.
• A one-way, salted hash of the respondent’s IP address.
• The time of the scan and the print run it came from.

We do not ask respondents for a name, email address, postal address or order number, and the product provides no field in which to request one. Special category data must not be requested through Monact. If your questions invite it, you are responsible for the consequences, and we may require you to change them.

3. Processing only on your instructions

We process personal data only on your documented instructions, which are given by your configuration of the service and by these terms, unless we are required to do otherwise by law — in which case we will tell you first, unless that law forbids it.

We will tell you if, in our opinion, an instruction infringes data protection law.

4. Confidentiality

Everyone we authorise to process this data is under a duty of confidentiality, by contract or by statute, and only has access where their role requires it.

5. Security

We implement appropriate technical and organisational measures under Article 32, including:

• encryption in transit (HTTPS everywhere) and at rest by our infrastructure providers;
• salted one-way hashing of respondent IP addresses, which are not reversible;
• access to production data restricted to those who require it;
• separation of the scan-resolution service from the rest of the system, so that a failure elsewhere cannot expose or interrupt it;
• automated tests that fail the build if a change would let one customer’s data be queried outside their organisation.

6. Sub-processors

You give general authorisation for us to engage the sub-processors listed in the Privacy Policy, which is kept current. We impose data protection obligations on each of them no less protective than those in this agreement, and we remain fully liable to you for their performance.

We will give you at least 30 days’ notice by email before adding or replacing a sub-processor that handles personal data. If you reasonably object on data protection grounds within that period, tell us; if we cannot resolve it, you may terminate the affected service and receive a refund of any unused prepaid fees.

7. Assisting you

We will assist you, taking into account the nature of the processing:

• With data subject requests. If a respondent contacts us directly we will not respond substantively; we will pass the request to you without undue delay, because you are the controller. The dashboard and export let you locate and delete individual responses yourself.
• With your obligations under Articles 32 to 36 — security, breach notification, impact assessments and prior consultation — taking into account the information available to us.

8. Personal data breaches

We will notify you without undue delay, and in any event within 48 hours of becoming aware of a personal data breach affecting your data, with the information we hold about its nature, likely consequences and the measures taken. Notifying your supervisory authority and affected individuals is your decision as controller; we will give you what you need to make it.

9. Deletion and return

You may export your data at any time while your account is open. On closure, we delete or return the personal data at your choice, and delete existing copies, unless law requires us to keep them. Backups age out on their normal cycle and are not restored selectively.

Response detail is also deleted on the retention schedule for your plan, after which only non-identifying daily totals and answer distributions remain.

10. Audits

We will make available the information necessary to demonstrate compliance with this agreement, and allow and contribute to audits, including inspections, by you or an auditor you appoint. In practice we ask that you first accept written answers and any third-party reports we hold; where those are not sufficient, an on-site audit may take place once a year on 30 days’ notice, during business hours, without unreasonable disruption, and subject to confidentiality.

11. International transfers

Data is processed in the UK and the EEA, and by the providers listed in the Privacy Policy. Transfers from the EEA to the UK rely on the European Commission’s adequacy decision for the UK. Transfers to providers in the United States rely on the UK International Data Transfer Addendum, Standard Contractual Clauses, or that provider’s certification under the UK Extension to the EU–US Data Privacy Framework.

12. Precedence

Where this agreement conflicts with the Terms of Service on the processing of personal data, this agreement prevails.

Drafted against Article 28(3) of the UK and EU GDPR and not reviewed by a solicitor. It is not legal advice.