Data Processing Addendum.

1. Roles

You (the merchant) are the controller of personal data about your customers and staff that resides in your Loyverse account. SKANDAN PTE. LTD. (operating VentaLens) is the processor, acting on your documented instructions when we read that data via the Loyverse API.

2. Categories of personal data

• Customer: an opaque customer reference id may appear on a receipt. We do not ingest customer names, contact details, visit counts, or spend history. No email, phone, address, or PIN.
• Employee: id and display name only. No contact details, and no role/permission data.
• Merchant account-holder: email, locale, timezone. Sign-in is passwordless (Google or magic link) — no password is set or stored.

Data minimization: each account processes sales data for only the single outlet you select at signup. No other outlet's receipts are ingested.

3. Categories of data subjects

• Your customers — referenced only by an opaque id on receipts; no customer records are stored
• Your employees (id + display name only)
• You and your team's user accounts on VentaLens

4. Sub-processors

We engage the following sub-processors to deliver VentaLens. By accepting this DPA you authorise their use.

We notify you by email at least 14 days before adding a new sub-processor, giving you time to object.

5. International transfers

Sub-processors outside Singapore and the EU (Stripe, Sentry, and FormSubmit.co — all US-headquartered) operate under the EU Standard Contractual Clauses (SCCs) and Singapore PDPA-equivalent safeguards. For any prospect requiring a country-specific DPA addendum, email [email protected] .

6. Security measures

• TLS 1.3 in transit, AES-256 at rest
• Postgres Row-Level Security for tenant isolation
• Encrypted Loyverse connection credentials (OAuth refresh tokens or access tokens)
• Passwordless authentication (Google OAuth or one-time magic link) — no passwords to store or leak
• Stripe webhooks signed and verified; idempotency on every retryable mutation
• Audit log on every privileged action
• Singapore-region hosting (data residency)

7. Breach notification

We notify affected controllers within 72 hours of becoming aware of a personal-data breach, with the nature of the breach, categories and approximate number of records affected, likely consequences, and mitigation actions.

8. Data return + deletion

On contract termination or request, we return your data via export and delete it from our systems within 30 days, including backups (which age out in line with our backup retention window). The only exception is a hashed, non-identifying record that a given Loyverse account used its free trial, retained for fraud prevention — it contains no sales data and cannot be reversed to identify a data subject.

9. Audits

You may request a written response to a security and privacy questionnaire — we respond within 14 days. We don't currently hold a SOC-2 report.