Bloxks Pay Data Processing Addendum

Words that are capitalised but not defined here have the meaning given in the Terms. “Controller”, “processor”, “data subject”, “personal data”, “processing”, “personal data breach” and “supervisory authority” have the meaning given in the GDPR.

• “GDPR” means Regulation (EU) 2016/679. “Data Protection Laws” means the GDPR, the French Data Protection Act (Law no. 78-17 of 6 January 1978), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and any other data protection law that applies to the processing under this DPA.
• “Bloxks”, “we” or “us” means Bloxks SAS, a French société par actions simplifiée, registered with the Paris Trade and Companies Register under number 130 543 515, whose registered office is at 47 rue Vivienne, 75002 Paris, France.
• “Developer”, “you” or “your” means the person or entity that accepted the Terms to use Bloxks Pay for one or more apps.
• “End User” means a person who uses one of your apps that is connected to Bloxks Pay.
• “Customer Personal Data” means the personal data about End Users that Bloxks processes on your behalf to provide Bloxks Pay, as described in Annex I.
• “Store” means a platform through which your app sells in-app purchases: the Apple App Store today, and Google Play once Bloxks Pay supports it.
• “Sub-processor” means a third party that Bloxks engages to process Customer Personal Data.
• “SCCs” means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914.

You are the controller of Customer Personal Data and Bloxks is your processor. If you are yourself processing that data on behalf of another controller (for example, an agency building an app for a client), Bloxks acts as your sub-processor, and you confirm that the controller has authorised you to appoint Bloxks under the terms of this DPA. In that case you remain our only point of contact and you pass on to the controller any notice we give you.

The Stores are not our sub-processors. Apple (and Google, once Google Play is supported) processes purchase data as an independent controller and as your own provider, under the agreement you have signed with it. When we receive data from a Store or send data to it on your behalf, we do so as your processor.

Bloxks acts as an independent controller, and not on your behalf, only for the following limited uses, described in the Privacy Policy: (a) securing its systems and preventing abuse (rate limiting with a hashed IP address); (b) totalling each app’s revenue to calculate any Bloxks Pay fee owed under the Terms, using amounts and not End User identities; (c) producing statistics that are aggregated or anonymised so that no End User can be identified; (d) totalling each app’s revenue to publish App-level figures as authorised in section 12 of the Terms, using amounts and never End User identities; and (e) complying with the law or establishing or defending legal claims. Bloxks does not use Customer Personal Data for any other purpose of its own.

Bloxks processes Customer Personal Data to provide Bloxks Pay: verifying in-app purchases with the Store, keeping track of who is entitled to what, receiving and processing Store notifications, crediting consumable purchases, handling refund requests where you enable this, showing you metrics and customer records in the dashboard, and sending events to the destinations you configure. The processing lasts for as long as you use Bloxks Pay, and then until deletion under section 13.

Annex I sets out the categories of data subjects and personal data, the nature and purpose of the processing, and how long each category is kept.

You are responsible for the lawfulness of the processing you instruct, and in particular you must:

• have a valid legal basis for the processing and give End Users the information required by Data Protection Laws, including in your app’s privacy policy and in the Store privacy disclosures. That information must mention Bloxks Pay as a service provider that processes purchase data;
• use pseudonymous identifiers as app user ids. You must not put names, email addresses, phone numbers or any special category of data (GDPR art. 9) or data about criminal convictions (GDPR art. 10) in app user ids, in the notes of manual grants, or in any other free-text field you send to Bloxks Pay. Bloxks Pay is not designed to process such data;
• obtain any consent required before you tell Bloxks Pay to share consumption information with a Store in reply to a refund request (see section 5);
• make sure that any destination you connect (webhook, Slack, Discord or another integration) is lawful and appropriate for the data it will receive;
• comply with the Store rules that apply to your app and to the data you receive from the Store.

Bloxks processes Customer Personal Data only on your documented instructions, unless EU or Member State law requires otherwise. In that case we will tell you about the legal requirement before processing, unless that law forbids us to do so on important grounds of public interest.

Your instructions are made up of the Terms, this DPA, and the choices you make in the Bloxks Pay dashboard, in the Bloxks builder or through the Bloxks Pay API. These include, in particular:

• connecting an app and its in-app purchase key, which instructs us to call the Store’s server API for that app;
• adding an integration (webhook, Slack, Discord or another destination), which instructs us to send the events listed in that integration to the destination you chose;
• choosing a refund preference and confirming that your End Users have consented, which instructs us to answer the Store’s consumption requests with the information described in Annex I;
• granting or revoking an entitlement, crediting a consumable through the server API, creating offer codes, and exporting data from the dashboard;
• the transfers described in section 9, which you authorise by accepting this DPA.

Any further instruction must be given in writing and must be consistent with the Terms. We will tell you promptly if, in our opinion, an instruction infringes Data Protection Laws. We may then suspend that instruction until you confirm or change it.

Bloxks gives access to Customer Personal Data only to the staff and contractors who need it to provide, support or secure Bloxks Pay, and only to the extent they need it. Each of them is bound by a contractual or statutory duty of confidentiality that continues after their engagement ends.

Bloxks implements the technical and organisational measures described in Annex II to protect Customer Personal Data, taking into account the state of the art, the cost of implementation, and the nature, scope, context and purposes of the processing, as well as the risks to End Users (GDPR art. 32).

We may update these measures over time, provided the overall level of protection is not reduced. Annex II describes the measures actually in place. Bloxks does not currently hold a third-party security certification such as ISO 27001 or SOC 2.

You are responsible for the security of everything under your control: your Bloxks account and its password, your Bloxks Pay API keys (in particular the secret server key), your Store Credentials, your own servers, and the destinations you connect.

You give Bloxks a general authorisation to engage Sub-processors. The Sub-processors in place on the date of this DPA are listed in Annex III, which you approve by accepting the Terms.

Before a new Sub-processor starts processing Customer Personal Data, we will give you at least 30 days’ notice by updating Annex III on this page and by email to the address of your Bloxks account. You may object on reasonable data protection grounds by writing to contact@bloxks.app within that period. If you object, we will discuss in good faith a way to address your concern. If we cannot, you may stop using Bloxks Pay for the affected apps and terminate the Terms for those apps without penalty, before the change takes effect.

Bloxks imposes on each Sub-processor, by written contract, data protection obligations that offer at least the same level of protection as this DPA. Bloxks remains fully liable to you for the performance of each Sub-processor’s obligations.

The following are not Sub-processors: the Stores; the destinations you choose for your integrations (your webhook endpoint, Slack, Discord or any other recipient you configure); and your own projects or servers, such as a Supabase project you linked in the Bloxks builder. These are your own recipients or providers. Once data reaches them at your request, their processing is your responsibility.

Bloxks is established in France. The Bloxks Pay database is stored in the European Union (Ireland). Bloxks Pay’s server functions also run in the European Union (Dublin, Ireland), operated by our hosting provider Vercel Inc., a United States company. Bloxks will not transfer Customer Personal Data outside the European Economic Area (EEA) except under a mechanism recognised by GDPR Chapter V. Annex III states the mechanism that covers each Sub-processor, including its UK and Swiss equivalents where relevant.

If you are established outside the EEA, then to the extent that Bloxks making Customer Personal Data available to you is a transfer under GDPR Chapter V, Module 4 (processor to controller) of the SCCs is incorporated into this DPA by reference, with Bloxks as data exporter and you as data importer. Clause 7 (docking clause) applies; the optional wording of Clause 11 does not; the SCCs are governed by French law (Clause 17) and disputes go to the courts of Paris, France (Clause 18). Annex I of the SCCs is completed by Annex I of this DPA. For data subject to the UK GDPR or the Swiss Federal Act on Data Protection, the SCCs apply with the adaptations required by those laws.

If a transfer mechanism is invalidated or ceases to apply, the parties will cooperate in good faith to put in place a valid alternative.

End Users do not have a Bloxks Pay account, so requests to exercise their rights (access, rectification, erasure, restriction, portability, objection) must be handled by you. If Bloxks receives such a request directly, we will forward it to you without undue delay and will not answer it ourselves, except to tell the person to contact you.

You can view an End User’s records and transactions in the dashboard and export the displayed customer and payment rows as a CSV file. For anything the dashboard does not yet do, in particular erasing a specific End User’s records, write to contact@bloxks.app from the email address of your Bloxks account. We will carry out your request within 30 days, or within any shorter period you need to meet a legal deadline, provided you give us enough information to identify the End User concerned.

Taking into account the nature of the processing and the information available to us, Bloxks will also give you reasonable assistance with your obligations under GDPR articles 32 to 36: security, breach notification, data protection impact assessments and prior consultation of a supervisory authority. Assistance beyond the information in this DPA and its annexes may be charged at a reasonable rate agreed in advance.

Bloxks will notify you of any personal data breach affecting Customer Personal Data without undue delay, and in any case within 48 hours of becoming aware of it, by email to the address of your Bloxks account. The notice will include, as far as the information is then available:

• the nature of the breach, including where possible the categories and approximate number of End Users and records concerned;
• a contact point at Bloxks for more information;
• the likely consequences of the breach;
• the measures taken or proposed to address the breach and to limit its possible adverse effects.

Where all of this information is not available at once, we will provide it in stages without further undue delay. We will take reasonable steps to contain and investigate the breach and will cooperate with you. You remain responsible for notifying the supervisory authority and End Users where the law requires it. Our notice is not an admission of fault or liability.

Bloxks keeps a record of the processing it carries out on your behalf (GDPR article 30(2)). It will make available to you the information needed to demonstrate compliance with GDPR article 28, and will allow and contribute to audits, including inspections, as follows:

• You will first ask in writing for the documentation you need. We will answer with this DPA, its annexes, and any further written information reasonably needed, such as answers to a security questionnaire.
• If the documentation does not reasonably answer your questions, or if a supervisory authority requires it, you may carry out an on-site or remote audit, no more than once in any 12-month period, except after a personal data breach or at the request of a supervisory authority. You must give at least 30 days’ written notice and agree the scope, timing and duration with us in advance.
• The audit may be carried out by you or by an independent auditor bound by confidentiality who is not a competitor of Bloxks. It must take place during business hours, avoid disrupting our operations, and must not give access to other customers’ data or to information covered by a confidentiality obligation towards third parties.
• You bear the cost of the audit, unless it reveals a material breach of this DPA by Bloxks, in which case Bloxks bears its own costs and reimburses your reasonable audit costs.

When the Terms end, or when you stop using Bloxks Pay for an app, you may export your data from the dashboard and ask us for a full export in a structured, commonly used and machine-readable format (such as CSV or JSON) by writing to contact@bloxks.app. Before you leave, export the entitlement and consumable balances of your End Users so that you can keep honouring their purchases with your next provider.

Within 30 days of your written request to delete the data of an app, Bloxks will delete the corresponding Customer Personal Data from its production systems. When the Terms end, you have 30 days to request an export, and Bloxks then deletes all Customer Personal Data within the following 30 days, so no later than 60 days after the end of the Terms. In both cases this does not apply where EU or Member State law requires us to keep part of the data. Any data kept under such a requirement stays protected under this DPA and is used only for that purpose. Copies in the hosting provider’s backups are deleted when those backups expire in their normal rotation cycle, and are not restored in the meantime except to recover from an incident.

Deletion removes every End User identifier, transaction, subscription, entitlement and Store notification concerned. Revenue amounts already counted are kept only without any link to an End User (the transaction number is replaced by an irreversible fingerprint), so that App-level figures remain correct. On request, Bloxks will confirm the deletion in writing.

Where a US state privacy law such as the California Consumer Privacy Act applies, Bloxks acts as your service provider or processor. Bloxks will not sell or share Customer Personal Data, will not keep, use or disclose it for any purpose other than providing Bloxks Pay under this DPA, and will not combine it with personal data it receives from other sources, except as those laws allow for service providers.

Each party’s liability under or in connection with this DPA is subject to the exclusions and limits of liability in the Terms. Nothing in this DPA limits either party’s liability to data subjects under GDPR article 82, or any liability that cannot be limited under applicable law or the SCCs.

In case of conflict, the SCCs (where they apply) prevail over this DPA, and this DPA prevails over the Terms, but only for matters relating to the processing of Customer Personal Data.

This DPA applies for as long as Bloxks processes Customer Personal Data on your behalf, including after the end of the Terms until the data has been deleted.

Bloxks may update this DPA to reflect changes in the law, in the guidance of supervisory authorities or in Bloxks Pay, under the procedure for changes to the Terms. A change that reduces the protection of Customer Personal Data does not apply to you without your agreement. Changes to the list of Sub-processors follow section 8.

This DPA is governed by French law. Any dispute relating to it is subject to the exclusive jurisdiction of the courts of Paris, France, without prejudice to the SCCs where they apply.

Contact for any question about this DPA: Bloxks SAS, 47 rue Vivienne, 75002 Paris, France, contact@bloxks.app.

The measures below describe what is actually in place on the date of this DPA.

Sub-processors that process Customer Personal Data on the date of this DPA:

Not Sub-processors: Apple and, once supported, Google, which act as independent controllers and as your own Store providers; the destinations you configure for integrations (your webhook endpoint, Slack, Discord or others), which are your recipients; and your own linked projects and servers. Providers that receive no Customer Personal Data, such as the public exchange-rate sources used for currency conversion and the channel used for internal technical alerts, are not listed. The bloxks.app platform, which registers your apps with Bloxks Pay, is operated by Bloxks SAS itself.