1. Who we are
Digital Partner Co. Ltd (""we"", "us"") operates Tabsery Reward at reward.tabsery.com. We are the data controller for merchant account data. Merchants are independent data controllers for their customer data collected through the loyalty programme.
Contact: info@tabsery.com
Address: 18 Lane 434, Doi Can Street, Ha Noi, Vietnam
VAT: 01-1041897-8
2. What data we collect
From merchants (you, if you sign up)
- Account data: email address, business name, logo, brand colours.
- Billing data: handled by our payment processor (Stripe); we do not store card numbers.
- Usage data: dashboard activity, programme settings, scan logs.
From your customers (on your behalf)
- Pass identifier (anonymous token) used to link a wallet pass to a record.
- Visit timestamps and stamp/point balances.
- Push notification delivery status.
- Optional: name, email, or phone number if you collect them during enrolment.
Automatically collected
- Server logs: IP address, browser/device type, pages visited, timestamps.
- Analytics: aggregated page-view and click data via Vercel Analytics (no cookies, no cross-site tracking).
3. Legal basis and purposes
| Purpose | Legal basis |
|---|---|
| Providing and operating the service | Contract (Art. 6(1)(b) GDPR) |
| Billing and invoicing | Legal obligation (Art. 6(1)(c) GDPR) |
| Fraud prevention and security | Legitimate interests (Art. 6(1)(f) GDPR) |
| Product analytics and improvement | Legitimate interests (Art. 6(1)(f) GDPR) |
| Marketing emails to merchants | Consent or legitimate interests; opt-out available at any time |
4. Data storage and transfers
All data is stored on servers located in the European Union (Supabase EU region). We do not transfer personal data outside the EEA except where a sub-processor is covered by Standard Contractual Clauses or an adequacy decision.
5. Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication, file storage | EU |
| Vercel | Hosting and edge delivery | EU / global CDN |
| Stripe | Payment processing | EU / US (SCC) |
| Apple / Google | Wallet pass delivery and push notifications | Global |
6. Retention
- Active account data is retained for the duration of the contract.
- After account deletion, data is purged within 30 days, except where retention is required by law (e.g. tax records: 7 years).
- Server logs are retained for 90 days.
7. Your rights
Under GDPR you have the right to:
- Access the personal data we hold about you.
- Rectify inaccurate data.
- Erase your data ("right to be forgotten"), subject to legal retention obligations.
- Restrict or object to processing.
- Data portability.
- Withdraw consent at any time (where processing is based on consent).
To exercise any right, email info@tabsery.com. We will respond within 30 days. You also have the right to lodge a complaint with Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
8. Cookies
We use a single first-party session cookie for authentication and one optional preference cookie for the A/B headline test. We do not use advertising or third-party tracking cookies. See our Cookie Policy for details.
9. Changes to this policy
We may update this policy. Material changes will be notified by email to active merchants at least 14 days before they take effect. Continued use of the service after that date constitutes acceptance.