Data processing agreement

This is written in plain English on purpose. It is a real agreement and we intend to be held to it, but it has not been reviewed by a lawyer in your country, and it is not legal advice. If your own contracts require a specific form of words, write to us and we will sign yours instead.

You, the shop, decide what customer data is collected and why. That makes you the controller. KANJIN holds and processes it on your instructions, which makes us the processor. Where the two of us disagree about what may be done with a customer’s data, your instruction governs, unless following it would break the law.

This agreement covers everything a shop keeps with us — the customer card, the ledger, the items and the figures — and the emails sent from it, on the free plan and the paid plan alike. The only thing it does not cover is the public calculators, which run in a visitor’s browser and send us nothing.

We process customer data only to run the features you switch on: holding the stamp card, sending the emails you send, and asking for the reviews you ask for.

We do not sell customer data. We do not share one shop’s customers with another shop. We do not use your customers to train a model. We do not email your customers on our own behalf.

The suppliers listed on the subprocessors page, and nobody else. You agree to those suppliers by using the product. If we add one that receives customer data, this page changes and the shop is told before it takes effect.

Data is encrypted in transit and at rest by the database provider. Each shop’s records are separated at the database level, so one shop’s sign-in cannot read another shop’s customers.

If customer data is exposed, we tell the affected shops without undue delay and within 72 hours of becoming aware, with what we know at the time rather than waiting until we know everything.

Any customer on the shared card can be exported as a file or deleted completely, from the customer list in the back office. Deletion removes their card, their visits, their rewards, and their name and address from every email record.

One thing survives deletion, on purpose: if that person had asked to stop receiving email, that instruction is kept as an unreadable fingerprint of their address, so that deleting them cannot cause them to be emailed again.

A customer can also do both of those things themselves, from their own card page, without asking the shop.

A customer who has not visited for the period set in your Settings is deleted automatically. The default is three years. You are told thirty days before it happens, with the number of customers affected.

When a shop closes its account, its customer data is deleted within 30 days.

Your customers’ records are held in Singapore, on Amazon Web Services (ap-southeast-1), by Supabase. KANJIN itself is operated from Taiwan, so data moves between the two. When you send an email, that message and the recipient’s address go to our email provider in the United States so it can be delivered. Nothing else leaves those three places.

None of Taiwan, Singapore or the United States has a general adequacy decision from the UK or the European Commission. Those transfers are therefore made on the standard contractual clauses and the UK addendum that each of our providers publishes in its own terms, which apply to us as their customer and flow down to you as ours. The providers and what each receives are listed on the subprocessors page, and that list is part of this agreement.

We have not appointed a representative in the UK or the EEA under Article 27. We are not going to pretend otherwise on a page a lawyer reads: KANJIN is operated from Taiwan and has no establishment in either, and appointing one is in progress rather than done. Until it is, write to us directly at the address on the support page and we answer ourselves — the same address a regulator can use.

If your own contracts require the clauses in a particular form, or your regulator requires a named representative before you can sign, write to us. We would rather sign your paper than have you rely on ours.

You can export your customers at any time, and you do not need our permission or our help to do it.

When this agreement ends, we delete the customer data we hold for you within 30 days, except anything a law requires us to keep, and the unreadable fingerprints described above.

A shop accepts this agreement in Settings, and the date is recorded on the shop's own record. Using the shared customer card without accepting it is still covered by the terms of service; the acceptance exists because some shops need to be able to show a date.

The companies named in it are listed on the subprocessors page, and what is collected at all is in the privacy policy.