Data Processing Agreement

1. Parties and Roles

Processor: CaptiFi Limited
Company number: 15948581
ICO registration number: ZB362985
Registered address: Unit A, 82 James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE

Controller: the Customer, being the venue operator or other legal entity that holds a CaptiFi account and instructs CaptiFi to process guest personal data through the Services.

For guest personal data, the Customer is the data controller and CaptiFi is the data processor within the meaning of the UK GDPR and the EU GDPR.

This DPA does not apply to personal data for which CaptiFi is itself the controller (for example, Customer account and billing data), which is covered by the CaptiFi Privacy Policy.

2. Definitions

"Data Protection Laws" means all laws applicable to the processing of personal data under this DPA, including the UK GDPR, the Data Protection Act 2018, the EU GDPR, and, where applicable, the Australian Privacy Act 1988 and other comparable frameworks.

"Guest Data" means personal data relating to End Users (venue guests) that CaptiFi processes on the Customer's behalf through the Services.

"Services", "Customer", and "End User" have the meanings given in the Terms and Conditions.

"Subprocessor" means a third party engaged by CaptiFi to process Guest Data on the Customer's behalf.

3. Subject Matter, Duration, Nature and Purpose

Subject matter: the provision of the CaptiFi guest WiFi marketing and access management platform, including captive portal splash pages, guest data capture, marketing automation, analytics, and Customer-enabled integrations.

Duration: the term of the Customer's subscription, plus the deletion period described in Section 9.

Nature of processing: collection, storage, organisation, retrieval, use, disclosure by transmission (to Customer-enabled integrations), erasure, and anonymisation.

Purpose: to provide guest WiFi access, capture guest details with consent, deliver marketing and transactional communications on the Customer's instruction, and provide analytics and reporting to the Customer. CaptiFi does not use Guest Data for its own marketing, profiling, or analytics.

4. Categories of Data Subjects and Personal Data

Data subjects: venue guests and other End Users who connect to WiFi or interact with splash pages operated through the Services.

Categories of personal data:

• Name and email address
• Telephone number, where the Customer enables collection
• Date of birth, where the Customer enables collection
• Device MAC address and IP address
• Visit metadata: connection times, session duration, access point, visit counts
• Marketing consent and preference records
• Custom fields configured by the Customer

No special category data is intended to be processed. The Customer must not configure the Services to collect special category data.

5. Processor Obligations

CaptiFi shall:

• Process Guest Data only on the Customer's documented instructions, including those given through the dashboard configuration, unless required to do otherwise by law, in which case CaptiFi will inform the Customer unless the law prohibits it.
• Ensure that persons authorised to process Guest Data are bound by confidentiality obligations.
• Implement and maintain the technical and organisational measures set out in Annex 3.
• Engage Subprocessors only as permitted by Section 6.
• Taking into account the nature of the processing, assist the Customer with appropriate technical and organisational measures in responding to data subject requests (access, rectification, erasure, restriction, objection, portability).
• Assist the Customer in meeting its obligations regarding security, breach notification, and data protection impact assessments, taking into account the information available to CaptiFi.
• Notify the Customer without undue delay after becoming aware of a personal data breach affecting Guest Data, providing information reasonably required for the Customer's own notification obligations.
• Delete or return Guest Data in accordance with Section 9.
• Make available information necessary to demonstrate compliance with this DPA and allow for and contribute to audits as described in Section 10.

6. Subprocessors

The Customer grants CaptiFi general authorisation to engage the Subprocessors listed in Annex 2.

CaptiFi will give the Customer notice of any intended addition or replacement of a Subprocessor, by email or dashboard notice, before the change takes effect. The Customer may object on reasonable data protection grounds; if the objection cannot be resolved, the Customer may terminate the affected Services.

CaptiFi imposes data protection obligations on each Subprocessor that are materially equivalent to those in this DPA, and remains liable to the Customer for the performance of its Subprocessors.

Third party platforms that the Customer itself enables through the integrations settings (Annex 2, Part B) are engaged on the Customer's instruction. Once Guest Data is delivered to such a platform, that platform processes it under the Customer's own agreement with the platform, not under this DPA.

7. International Transfers

Guest Data is hosted and stored in the European Union (Finland/Germany), as set out in Annex 2.

Email delivery is currently routed through Amazon SES in the United States (us-east-1 region). For this transfer CaptiFi relies on the EU Standard Contractual Clauses and, for UK transfers, the UK International Data Transfer Addendum. Regional email delivery (EU or Australia) can be arranged for Customers who require it; contact accounts@captifi.io.

CaptiFi will not otherwise transfer Guest Data outside the UK or EEA without ensuring an appropriate safeguard under Data Protection Laws (adequacy decision, Standard Contractual Clauses, or UK IDTA/Addendum).

For Customers subject to the Australian Privacy Act 1988, the disclosures described in this Section and Annex 2 are cross-border disclosures for the purposes of Australian Privacy Principle 8 (APP 8). CaptiFi's contractual safeguards with each Subprocessor are designed to ensure the recipient handles Guest Data consistently with the Australian Privacy Principles.

8. Data Subject Rights

The Customer is responsible for responding to data subject requests relating to Guest Data.

The dashboard provides self-service tools to search, export, delete, and anonymise individual guest records, which the Customer should use as the first route for fulfilling requests.

If a data subject contacts CaptiFi directly about Guest Data, CaptiFi will refer the request to the relevant Customer without undue delay and will not respond substantively except on the Customer's instruction or where required by law.

9. Deletion and Return

During the term, the Customer may export Guest Data at any time (CSV, Excel, or API) and may delete or anonymise guest records using the dashboard tools.

Retention policies (for example, periodic deletion of records older than a defined age) are configured on request; contact accounts@captifi.io.

On termination of the Services, CaptiFi will delete Guest Data within 30 days, unless retention is required by law. On written request made before the end of that period, CaptiFi will first provide the Customer with an export of the Guest Data.

10. Audits and Information

CaptiFi will make available to the Customer information reasonably necessary to demonstrate compliance with this DPA, including summaries of its technical and organisational measures and its Subprocessor list.

Where the information provided is not reasonably sufficient, the Customer may conduct an audit (including inspection) no more than once in any 12-month period, on at least 30 days' written notice, during normal business hours, without disruption to CaptiFi's operations, and subject to confidentiality obligations. Each party bears its own costs.

11. Liability, Precedence and Governing Law

The liability of each party under this DPA is subject to the limitations and exclusions of liability in the Terms and Conditions.

If there is a conflict between this DPA and the Terms and Conditions in relation to the processing of Guest Data, this DPA prevails.

This DPA is governed by the laws of England and Wales, as set out in the Terms and Conditions.

Annex 1: Processing Details

• Subject matter: guest WiFi access, guest data capture, marketing automation, analytics, and Customer-enabled integrations, as described in Section 3.
• Duration: the subscription term plus up to 30 days for deletion.
• Frequency: continuous, for as long as the Services are active.
• Data subjects: venue guests and other End Users (Section 4).
• Personal data: name, email address, telephone number and date of birth where collected, device MAC address, IP address, visit metadata, consent records, Customer-configured custom fields (Section 4).
• Special category data: none intended.
• Retention: controlled by the Customer during the term; deletion within 30 days of termination.

Annex 2: Subprocessors

Part A: Subprocessors engaged by CaptiFi

• Hetzner Online GmbH: application and database hosting. Location: European Union (Finland/Germany).
• Amazon Web Services, Inc. (Amazon SES): email delivery. Location: currently the United States (us-east-1 region). Safeguards: EU Standard Contractual Clauses and UK International Data Transfer Addendum. Regional email delivery (EU or Australia) available on request.
• Stripe, Inc.: payment processing, including subscription billing and, where the Customer enables paid WiFi, guest payments. Location: global. Safeguards: Standard Contractual Clauses. CaptiFi does not store card details.
• Cloudflare, Inc.: object storage for uploaded media such as logos and splash page images. Location: European Union.

Email marketing campaigns are sent through CaptiFi's own self-hosted campaign system running on CaptiFi's EU infrastructure; it is not a third party subprocessor.

Part B: Platforms enabled by the Customer

Where the Customer enables an optional integration, opted-in Guest Data is sent to that platform on the Customer's instruction. Available integrations include Mailchimp, Klaviyo, EmailOctopus, HubSpot, Square, Toast, Incentivio, Pepper, Leat, Airship, Twilio, Zapier, and Slack.

These platforms are chosen and contracted by the Customer, and process Guest Data under the Customer's agreement with them (Section 6).

Annex 3: Technical and Organisational Measures

• Encryption in transit: TLS for all connections to the platform, dashboards, and APIs.
• Encryption at rest: integration credentials and other secrets are encrypted at application level; disk, snapshot and object storage encryption is applied where supported by the hosting infrastructure.
• Access control: role-based access control; access to Guest Data is limited to authorised personnel on a need-to-know basis, with per-venue scoping for Customer team members.
• EU hosting: application and database servers located in the European Union (Finland/Germany).
• Backups: daily snapshots to support recovery and resilience.
• Access logging: administrative and account activity is logged for audit purposes.
• Confidentiality: personnel with access to personal data are bound by confidentiality obligations.
• Payment data: card payments are processed by Stripe (PCI DSS Level 1); CaptiFi does not store card details.

Contact

CaptiFi Limited
Email: accounts@captifi.io

Unit A, 82 James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE

A countersigned copy of this DPA is available on request from accounts@captifi.io.