Data Processing Agreement (DPA)

Last updated: 24 September 2026

This Data Processing Agreement (“DPA”) governs the processing of personal data carried out by the company Pauka, posredništvo in storitve, d.o.o., the provider of the Claime service (“Claime” or the “processor”), on behalf of the business user of the Claime service (the “business user” or the “controller”).

The DPA forms an integral part of the Claime Terms of Use and applies where Claime, in providing the service, processes personal data on behalf of the business user.

1. Roles of the parties

The business user is the controller of the personal data that it collects or otherwise processes in the course of using Claime in relation to its customers or end users.

In such processing, Claime acts as the processor and processes personal data only on the documented instructions of the business user and to the extent necessary for the provision, technical maintenance, support, security and operation of the functionalities of the Claime service.

For its own statistics and for the development and improvement of the product, Claime may use data that has been appropriately anonymised or aggregated in such a way that it no longer relates to an identified or identifiable individual.

This DPA does not apply to personal data that Claime processes as an independent controller. Such processing is governed by the Claime Privacy Policy.

2. Scope of processing

Claime may, on behalf of the business user, process the personal data necessary for the operation of the digital loyalty programme and related functionalities.

Processing may include the collection, recording, organisation, structuring, storage, adaptation, alteration, consultation, use, display, transmission, restriction, export and deletion of data.

Processing is carried out for the duration of the use of the service and, after it ends, for as long as is necessary for the lawful export, return, transfer or deletion of the data, or for as long as further retention is required by law.

A more detailed description of the processing is set out in Annex 1.

3. Instructions of the business user

Claime processes personal data only on the basis of the documented instructions of the business user. Documented instructions also include the business user's actions, settings, configurations and requests within the Claime service.

This also includes instructions regarding the transfer of personal data to a third country or an international organisation.

If European Union or Member State law requires Claime to carry out different processing, Claime informs the business user of that legal requirement before processing, unless the law prohibits such notification on important grounds of public interest.

If Claime considers that an instruction of the business user infringes applicable personal data protection legislation, it informs the business user of this and may temporarily suspend the execution of the instruction until the matter has been clarified.

The business user is responsible for the lawfulness of the collection and use of personal data, for determining the appropriate legal bases, and for providing the necessary information and obtaining consents where necessary.

4. Confidentiality and security

Claime ensures that only persons who need access to personal data in order to perform their tasks, and who are bound by appropriate confidentiality obligations, have access to it.

Claime implements appropriate technical and organisational measures, taking into account the nature of the processing, the risks, the state of the art and applicable legal requirements.

If Claime becomes aware of a personal data breach relating to the business user's data, it notifies the business user without undue delay.

To the extent of the information available to Claime at that time, the notification includes in particular a description of the nature of the breach and the available information about the data and data subjects affected, about the possible consequences and about the measures that have been or will be taken to address the breach.

If not all of the information can be provided at the same time, it may be provided in phases without undue further delay.

5. Sub-processors

The business user gives Claime general written authorisation to use sub-processors that are necessary for the provision of the service.

Claime maintains, and makes available to the business user, an up-to-date list of sub-processors.

Before the intended addition of a new sub-processor or the replacement of an existing one, Claime informs the business user and provides it with a reasonable period within which it may object to the change on justified grounds relating to the protection of personal data.

In urgent cases, in particular where the change is necessary for reasons of security or to ensure the uninterrupted operation of the service, the period of prior notification may be shorter.

Claime ensures that each sub-processor is contractually bound by personal data protection obligations that provide at least an equivalent level of protection to that laid down in this DPA and Article 28 GDPR.

Claime remains liable for the performance of the sub-processors' obligations to the extent provided by applicable legislation.

6. Data location and transfers

Claime's primary data storage infrastructure is located in the European Union.

If, in the provision of a particular functionality or the use of a sub-processor, a transfer of personal data outside the European Economic Area is necessary, the transfer is carried out only in accordance with the documented instructions of the business user and the applicable provisions of Chapter V GDPR.

7. Assistance to the business user

Taking into account the nature of the processing and the information available to it, Claime provides the business user with reasonable assistance in:

• handling requests from data subjects;
• ensuring the security of processing;
• handling personal data breaches;
• fulfilling obligations relating to data protection impact assessments;
• prior consultation with the supervisory authority, where necessary.

If Claime directly receives a request from a data subject concerning personal data that it processes for the business user, it, as a rule, forwards the request to the business user or directs the data subject to the controller, unless applicable legislation requires otherwise.

8. Return and deletion of data

After the end of the provision of services relating to processing, Claime, at the choice of the business user, deletes the business user's personal data or returns it to the business user and deletes existing copies, except where European Union or Member State law requires further retention.

The export, transfer or return of data is also carried out in accordance with the provisions of the Claime Terms of Use and the applicable requirements concerning portability or switching providers.

9. Demonstrating compliance and audits

Claime provides the business user with the information reasonably necessary to demonstrate compliance with the obligations under Article 28 GDPR.

Claime allows for and contributes to audits or inspections conducted by the business user or by an independent auditor authorised by the business user.

Audits are carried out with reasonable prior notice and in a manner that does not jeopardise the security of systems, trade secrets, confidential information or personal data of other customers.

Where compliance can be adequately demonstrated by documentation, certificates, independent reports, security questionnaires or other comparable information, such means are, as a rule, used first.

10. Term and relationship to other documents

This DPA takes effect when the business user accepts the Claime Terms of Use or starts using the service, and remains in force for as long as Claime processes personal data on its behalf.

If there is an inconsistency between this DPA and the Terms of Use regarding the processing of personal data, the DPA prevails.

For matters not specifically governed by the DPA, the Terms of Use and applicable Slovenian and European legislation apply.

Annex 1 – Description of processing

Subject matter and purpose of processing

Provision of the Claime digital platform and of functionalities for the creation, management and use of loyalty programmes, digital cards, rewards, communications, notifications and other related functionalities.

Duration of processing

For the duration of the use of the Claime service and, after it ends, for a limited period necessary for the export, transfer, return or deletion of the data, or for its statutory retention.

Categories of data subjects

Primarily customers and other end users of the business user, as well as other persons whose data the business user lawfully enters or collects through the service.

Types of personal data

Depending on the functionalities used, the data may include in particular:

• identifiers of users and digital cards;
• loyalty programme data, such as points, stamps, visits, rewards and other activities;
• contact details, where the business user collects them;
• data on communications and on notification settings;
• data on the status of consents or of other choices made by the individual regarding communications;
• data necessary to demonstrate the giving or withdrawal of consent, where such consents are managed through Claime;
• location data or data related to the use of location-based functionalities, when and to the extent that the Claime service actually receives or processes it;
• technical and other data necessary for the operation of the service.

The Claime service is not intended for the processing of special categories of personal data under Article 9 GDPR, such as health, biometric or other particularly sensitive personal data.

Nature of processing

Automated processing, collection, storage, organisation, updating, display, transfer, restriction and deletion of data to the extent necessary for the provision of the Claime service.

Controller: the Claime business user.

Processor:
Pauka, posredništvo in storitve, d.o.o.
Prožinska vas 55, 3220 Štore
Company registration number: 7534353000
Tax number: 20803460
Email: info@claime.eu