Data Processing Addendum (DPA)

Last updated: October 1st, 2025

This Data Processing Addendum (“DPA”) supplements the Payaz Terms and Conditions (the “Terms”) between S&G Creative Solutions Ltd (“Payaz”) and the entity or individual agreeing to these terms (“Fundraiser”, “you”, or “your”).

This DPA applies where Payaz processes personal data on behalf of the Fundraiser in connection with the provision of the Payaz platform and related services (the “Services”).

1. Scope and Roles

For the purposes of applicable data protection law (including the UK General Data Protection Regulation (“UK GDPR”)), the Fundraiser acts as the data controller of any personal data it collects from donors and supporters (“Donation Data”), and Payaz acts as a data processor.

The Fundraiser’s configuration of the Payaz platform and its use of the Services constitute the documented instructions to Payaz regarding processing of Donation Data (“Documented Instructions”). Payaz will only process Donation Data in accordance with these instructions and the Terms.

Each party must comply with all applicable Data Protection Laws in connection with its performance under this DPA.

2. Data Processing Details

• Subject Matter: Processing of Donation Data in connection with the Services.
• Duration: For as long as the Fundraiser uses the Services or until termination of the Terms.
• Purpose: To provide and support the Payaz platform and related Services.
• Nature of Processing: Collecting, storing, transmitting, and displaying Donation Data through the Payaz platform.
• Categories of Data Subjects: Donors, Fundraiser Administrators.
• Types of Personal Data:

• Donor: name, email, postal address, and any additional data requested by the Fundraiser through the platform.
• Administrators: name, organisation details, email address.

3. Confidentiality

Payaz will not access, use, or disclose Donation Data except as necessary to provide the Services or as required by law. All Payaz personnel (including contractors) with access to Donation Data are subject to confidentiality obligations.

4. Sub-Processing

The Fundraiser authorises Payaz to engage sub-processors for the provision of the Services. Payaz currently uses the following sub-processors:

• Google (Firebase) – Hosting and database services (EU)
• Stripe – Payment processing (EU/UK)
• SumUp – Payment processing (EU/UK)

Payaz will ensure sub-processors only access Donation Data as necessary, enter into written agreements imposing equivalent data protection obligations, and remain liable for sub-processor compliance with this DPA.

4.1 Future Sub-Processors
The Fundraiser acknowledges and accepts that Payaz may change, add, or replace sub-processors at any time without prior notice, provided that:

• any new sub-processor is subject to data protection obligations no less protective than those set out in this DPA; and
  
• Payaz will always act in good faith and in the Fundraiser’s best interests when engaging or replacing sub-processors, ensuring appropriate security and privacy measures remain in place.

4.3 Sub-Processor Obligations
 Payaz will restrict sub-processors’ access to Donation Data only as necessary to provide the Services, ensure written data protection obligations are in place, and remain responsible for compliance with this DPA and the acts or omissions of its sub-processors.

5. Aggregated Data

Payaz may occasionally review or process aggregated or anonymised information relating to how Fundraisers and donors use the platform. Aggregated simply means that any personal details (like names or contact information) have been removed, and the data is grouped together so no individual person or organisation can be identified.

This type of data helps Payaz understand general trends — for example, which features are most used, or how donation patterns change over time — so that we can continue improving the platform and maintaining security and reliability.

Any such analysis will only ever be carried out in a way that protects the privacy of all individuals and Fundraisers, and in line with good industry practice and applicable data protection laws.

6. Data Subject Requests

Payaz provides the Fundraiser with tools within the Payaz platform to manage donor data and respond to data subject requests. If a data subject contacts Payaz directly, Payaz will forward the request to the Fundraiser.

7. Security

Payaz implements appropriate technical and organisational measures to protect personal data, including encryption at rest and in transit, secure authentication mechanisms, access controls, and regular internal security reviews.

Payaz will notify the Fundraiser without undue delay, and no later than 72 hours, after becoming aware of a security incident involving Donation Data. Payaz will take reasonable steps to mitigate its effects and cooperate with the Fundraiser in compliance with applicable law.

8. Data Retention and Deletion

Within 90 days after termination of the Terms, Payaz will delete Donation Data and all existing copies, unless required by law to retain it. Fundraisers will have 10 days’ access to export their data before deletion.

9. Audit and Information Rights

Upon reasonable written request, Payaz will provide the Fundraiser with information necessary to demonstrate compliance with this DPA. If that information is insufficient, Payaz will allow for an independent audit once every 12 months, under confidentiality obligations and with reasonable notice.

10. Assistance

Taking into account the nature of the processing and the information available, Payaz will assist the Fundraiser with data protection impact assessments, cooperation with supervisory authorities, and security incident notifications.

11. Liability and Indemnity

Payaz shall indemnify and hold harmless the Fundraiser against direct losses or damages resulting from proven breaches of this DPA caused by Payaz’s failure to comply with its obligations, subject to any limitations in the Terms. Neither party will be liable for indirect or consequential losses.

12. Termination

This DPA remains in force for the duration of the Terms. Upon termination of the Terms, this DPA shall automatically terminate following the deletion of all Donation Data in accordance with Section 7.

13. Governing Law

This DPA shall be governed by and construed in accordance with the laws of Northern Ireland, and the parties submit to the exclusive jurisdiction of the courts of Northern Ireland.

Schedule 1 – Sub-Processors