Tenth Data processing terms
Part of the shop terms of service. This is the Article 28 agreement between you and us.
Last updated 2026-08-20 · Black Flame Digital Ltd · Shop terms · Data processing · Privacy · Cookies · Your card
Written in-house, not by a solicitor. These documents describe what Tenth actually does, accurately and specifically, which is more than a template can. They still need a UK solicitor’s eye before real customer or shop traffic — particularly the liability, indemnity and data-protection wording.
The processor under these terms is Black Flame Digital Ltd, a company registered in England and Wales (number 11861684) whose registered office is 45 Sir Peter Blake Way, DA10 1HB, United Kingdom, trading as Tenth. The controller is you, the shop.
When a customer joins your card scheme, that record is your customers’ personal data. You are the controller and Black Flame Digital Ltd is your processor. UK GDPR Article 28 requires that arrangement to be set out in writing, with specific terms in it. These are those terms. They form part of the shop terms of service and need no separate signature.
Scope of the processing
- Subject matter
- Running your digital stamp card scheme.
- Duration
- For as long as your shop is on Tenth, and then only as long as it takes to delete or export the data as described below.
- Nature and purpose
- Issuing a wallet pass per customer; recording stamps and rewards; keeping the pass up to date on the customer’s phone; showing you counts and patterns in your dashboard.
- Categories of data subject
- Your customers who choose to take a card.
- Categories of personal data
- Deliberately narrow, and worth reading, because it is less than most loyalty products hold:
- a random card identifier, a short code, and a card secret;
- a timestamped record of each stamp and each reward given, and which staff name was selected at the till;
- whether the customer opted in to your marketing, and when;
- for Apple Wallet, a device identifier and push token, so the card can be told to refresh.
- Special category data
- None, and none may be submitted. A scheme that reveals health, religion or similar — a pharmacy scheme naming a medicine, say — is outside these terms; talk to us first.
Our obligations
- We process only on your instructions and only for the purposes above. Configuring your scheme and stamping cards is how you instruct us. If we think an instruction breaks data protection law we will tell you rather than quietly carry it out.
- We do not sell your customer data, and we do not use it to advertise to your customers. We may use aggregate, de-identified figures — such as typical completion rates across all shops — to improve the service and describe how it performs.
- Confidentiality. Only people who need access have it, under a duty of confidence.
- Security. Set out below.
- Breach notification. If we become aware of a personal data breach affecting your customers we will tell you without undue delay and in any event within 48 hours, with what we know, so you can meet your own 72-hour reporting duty. Reporting to the ICO is yours to do as controller; we will help.
- Data subject requests. If a customer contacts us directly we will point them to you and tell you. Where you need us to act — producing a card’s history, or erasing it — we will do so promptly and without extra charge.
- Audit. On reasonable notice we will provide the information you need to show the ICO you have chosen a processor properly.
- Deletion or return. On the end of the agreement we delete your customers’ data, or export it to you first if you ask before closure.
Security
What actually protects the data, rather than a claim that it is protected:
- Encrypted in transit (HTTPS throughout) and at rest by our hosting providers.
- Per-shop isolation enforced by the database, not by our code. Row-level security means a query for another shop’s cards returns nothing even if an application bug asks for them.
- The stamp record is append-only. Stamps and rewards cannot be edited or deleted by anyone, including us, including our own servers — reversing a stamp means recording a correcting entry, which stays visible. The one exception is erasure, which runs through a single named database routine so it cannot happen by accident.
- Balances are calculated from that record every time, never stored, so a balance cannot be tampered with.
- A card’s secret is never put in a URL, a QR code, or an email.
Sub-processors
You authorise these. We will give you at least 30 days’ notice before adding another, and you may object — and if we cannot resolve it, end the agreement.
- Supabase
- Database, authentication and file storage. EU region.
- Vercel
- Application hosting.
- Google (Google Wallet API)
- Issues and updates the Android card. Receives the card’s identifier, its stamp count and your branding.
- Apple (Apple Wallet, Apple Push Notification service)
- Issues and updates the iPhone card. The push message is empty — it tells the phone to come and fetch, and carries no customer data.
Google and Apple operate outside the UK. Transfers rely on the UK International Data Transfer Addendum or an adequacy decision, as applicable.
Retention
- Stamps and rewards are kept for as long as the card exists, because the card is that history — a card with its stamps removed is not a card.
- A card unused for 24 months is deleted along with its history. Nothing in a dormant card benefits anyone.
- Diagnostic logs of wallet activity are kept for 90 days.
- On erasure the card, its stamps, its rewards and its device registrations all go, and the customer record goes too if that was their last card anywhere on Tenth.
Liability
The liability provisions of the shop terms of service apply to these terms too.
Contact
privacy@tenthcards.co.uk