Data Processing Addendum

Status: this Data Processing Addendum ("DPA") is a working skeleton published for transparency. It forms part of the host agreement between [LEGAL ENTITY] ("GWP") and the host retailer ("Host") once executed. [LEGAL REVIEW: entire document to be settled by counsel before execution.]

1. Parties and roles

This DPA is between the Host and GWP ([LEGAL ENTITY]).

[LEGAL REVIEW: controller/processor decision — operative sentence to be confirmed. Either: "GWP processes the personal data described in Annex I as a processor acting on the Host's documented instructions"; or: "GWP processes such personal data as an independent controller for the attribution and marketplace purposes described in Annex I." The remainder of this DPA is drafted to be adaptable to either determination.]

2. Subject matter and duration

The subject matter is the operation of the GWP gift-with-purchase unit on the Host's basket and order-confirmation pages, and the associated attribution and reporting, gifts in the Host's own order-confirmation emails where the Host's server requests them, gift-link emails sent from the Host's own domain where the Host has GWP send them, and (where opted in) gift-reminder emails. Processing continues for the term of the host agreement plus the retention periods in the Privacy Policy.

3. Data subjects and data categories

Data subjects: shoppers visiting the Host's basket and confirmation pages; where the Host's server requests order gifts, signed-in shoppers holding a gift on any page of the Host's site that carries the GWP tag, and customers whose orders that server asks about; and, where the Host has GWP email gift links, shoppers who sign in on the Host's site or give an email address on its confirmation page.

Data categories: as set out in section 3.1–3.2 of the Privacy Policy: opaque click-identifiers, session references, gift selections, basket snapshots (value, currency, item lines), resolved consent state, telemetry events, transient IP addresses for rate limiting, truncated error diagnostics, the Host's customer account number for a signed-in shopper where the Host's server requests order gifts (held only as a keyed hash, with the order number and optional order total that server sends; the shopper's device keeps a short hash of it while GWP holds their gift list), where the Host has GWP email gift links the shopper's email address (read from the email field of the Host's sign-in form only where the shopper's consent state allows the widget's full mode, or typed by the shopper on the confirmation page; held encrypted, with a keyed hash of it and the order number), and — only on explicit opt-in — a shopper email address with unsubscribe token. No special category data is intentionally processed; the widget does not receive names, postal addresses, passwords or payment data.

4. Documented instructions

To the extent GWP acts as the Host's processor, GWP will process personal data only on the Host's documented instructions (including this DPA, the host agreement and the Host's configuration choices in the dashboard — for example the consent posture applied where no CMP is present), unless required otherwise by law, in which case GWP will inform the Host unless legally prohibited from doing so.

5. Confidentiality, assistance and deletion

• GWP ensures persons authorised to process the data are bound by confidentiality obligations.
• GWP will assist the Host, taking into account the nature of the processing, in responding to data subject requests and in meeting the Host's obligations regarding security, breach notification and impact assessments.
• On termination, GWP will delete or return personal data processed for the Host, save for records GWP must retain by law or that GWP holds in a controller capacity [LEGAL REVIEW].

6. Breach notification

GWP will notify the Host without undue delay after becoming aware of a personal data breach affecting the Host's shoppers, and will provide information reasonably required for the Host to meet its own notification obligations. [LEGAL REVIEW: confirm notification window, e.g. within 48 hours of awareness.]

7. Audit rights

GWP will make available information reasonably necessary to demonstrate compliance with this DPA, and will allow for and contribute to audits, including inspections, conducted by the Host or its mandated auditor — no more than once in any 12-month period absent a breach or regulator requirement, on reasonable notice, and subject to confidentiality. [LEGAL REVIEW: audit scope and cost allocation.]

8. International transfers

Where processing involves transfers of personal data outside the UK or EEA (see Annex III — email delivery is in the United States), the parties incorporate by reference the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) and, for UK transfers, the UK International Data Transfer Addendum to those clauses. [LEGAL REVIEW: select modules, complete annexes and confirm transfer risk assessments.]

Annex I — Processing details

Annex II — Technical and organisational measures

Measures currently implemented in the shipped service:

• HMAC-signed conversion postbacks — server-to-server conversion notifications are authenticated with per-partner HMAC signatures;
• Secret-based pixel authentication — conversion pixels authenticate with per-partner secrets;
• Role-based access control in the partner dashboard, so users see only what their role permits;
• Audit logging of significant dashboard actions;
• Consent-gated storage — the widget reads the Host's CMP; when consent is declined or not yet given it stores nothing at all where the Host has switched essential mode off, and otherwise only the shopper's own gift choice, once made, for at most 7 days, with the markers tied to it (see Cookie Policy);
• Masked bank details in the dashboard interface;
• Single sign-on — the partner dashboard is reached only through THG Ingenuity Console, which manages each organisation's users and permissions;
• Data minimisation by design — the widget processes no names, passwords or payment data, and no contact details except, where the Host has GWP email gift links, the shopper's email address, which is encrypted on the shopper's device (or, if the shopper types it on the confirmation page, on arrival) so that only GWP can read it; IP addresses are used transiently for rate limiting only, and the Host's customer account numbers are kept only as keyed hashes.

[LEGAL REVIEW: supplement with organisational measures — personnel security, access reviews, encryption in transit/at rest as provided by the subprocessors in Annex III, business continuity.]

Annex III — Approved subprocessors

GWP will give the Host prior notice of any intended change to this list, allowing the Host to object on reasonable grounds. [LEGAL REVIEW: notice period and objection mechanics.]