Data processor: Shams Factory · SIRET 88889743600026 · 43 Rue Talma, 94400 Vitry-sur-Seine
Data Processing Agreement (DPA)
Last updated: October 27, 2026 · Contact: legal@cartia.fr
This DPA supplements the terms of use and the privacy policy. It applies as soon as you use Cartia with the data of your customers (program members), as provided for by Article 28 of the GDPR.
1. Parties and roles
- Data controller: the merchant (SaaS Customer), who determines the purposes and means of its loyalty program.
- Data processor: Shams Factory (SIRET 88889743600026), which operates the Cartia Service and processes End Members’ data on behalf of the merchant, solely to provide the Service (hosting, digital card, scan, dashboard, exports, GDPR tools).
Rationalab is, like Cartia, a name and a business of Shams Factory. It is not a separate company: same legal entity, same SIRET. Only Shams Factory is a party to this DPA as data processor.
For merchant account data (registration, authentication, billing, support), Cartia acts as data controller - outside the scope of this DPA.
2. Subject matter of the processing
Purposes: performance of the merchant’s digital loyalty program through Cartia.
Categories of data subjects: End Members registered through the QR code / enrollment flow.
Categories of data (depending on the merchant’s configuration):
- identity (first name, last name), date of birth, gender and contact details (email and/or phone number);
- program data (stamps, points, EARN/REDEEM history);
- consents (enrollment, marketing) and timestamps;
- technical card / Wallet identifiers (serial numbers, tokens, balance);
3. Instructions and duration
Cartia processes End Members’ data only on the merchant’s documented instructions (use of the Service, settings, support requests related to the account). The duration of the processing corresponds to that of the SaaS contract, followed by the return / deletion operations provided for below and in the privacy policy.
4. Cartia’s obligations (data processor)
- process the data solely for the provision of the Service;
- ensure the confidentiality of the persons authorized to process the data (authorized staff, support, operations);
- implement appropriate technical and organizational measures (authentication, multi-tenant isolation, HTTPS/TLS in transit, logging, rate-limiting);
- assist the merchant in responding to requests to exercise data subjects’ rights (export and anonymization available in the product; other requests via legal@cartia.fr);
- notify the merchant without undue delay of any personal data breach affecting its End Members, with the information needed to meet its legal obligations;
- at the end of the Service, delete or anonymize End Members’ data, or return it through an export where available, unless retention is required by law.
Cartia keeps backups on its VPS in Germany, an encrypted copy at o2switch datacenters in Clermont-Ferrand, France, and an additional copy on physical media. Dumps are created every 6 hours. Configured retention is 14 days on the VPS and 30 days at o2switch. VPS monitoring alerts if no successful transfer to o2switch has been recorded for 8 hours.
If Cartia plans to permanently shut down, we commit to notifying each merchant and emailing them an export of their customer records and available loyalty balances before closure, regardless of their plan. Delivery is made to the account owner’s address after verifying the recipient, through an encrypted file or a secure link.
5. Hosting and sub-processors
Application hosting and the database are located in Germany (Hetzner Cloud), within the European Union.
Sub-processors that may be involved:
- Hetzner Online GmbH - infrastructure hosting (Germany, EU);
- o2switch - storage of backups encrypted before transfer (France, EU), without holding the private decryption key;
- Stripe - payment of merchant subscriptions (excluding the program’s End Member data, except in exceptional cases not applicable to the standard flow);
- Apple / Google - display and updating of Wallet passes, limited to the technical data necessary.
Separate from the sub-processors listed above, Cartia also keeps an additional backup copy on physical media.
Cartia informs the merchant of any material change of sub-processor concerning End Members’ data, by updating this page or by reasonable notice.
6. Transfers outside the EU
Primary storage remains in the EU (Germany). Processing related to Wallet (Apple/Google) or to certain payment providers may result in transfers governed by appropriate safeguards (standard contractual clauses / recognized mechanisms). Cartia limits these transfers to what is strictly necessary for the Service to operate.
7. Merchant’s rights (audits)
The merchant may request reasonable information about the security measures and the performance of this DPA via legal@cartia.fr. On-site audits remain exceptional and are subject to prior notice, confidentiality and no impairment of the security of other Cartia customers.
8. Merchant’s obligations
The merchant undertakes in particular to:
- have a legal basis for the processing of its End Members;
- inform its customers and collect the required consents, including for Wallet notifications and marketing emails;
- configure the program proportionately (data minimization);
- use the export / anonymization tools made available.
9. Contact
For any question about this DPA: legal@cartia.fr.