Perkbase
Last updated: 22 October 2026
This Data Processing Agreement (“DPA”) forms part of the agreement between the merchant that installs and uses Perkbase (the “Merchant”) and Cultmetrics Oy (“Cultmetrics”) for the provision of the Perkbase application (the “Service”). It governs Cultmetrics’ processing of personal data relating to the Merchant’s shoppers on the Merchant’s behalf, and reflects the parties’ obligations under Article 28 of the EU General Data Protection Regulation (“GDPR”). It is read together with our Privacy Policy.
By installing or using the Service, the Merchant accepts this DPA, which takes effect on that date and remains in force for as long as Cultmetrics processes shopper personal data on the Merchant’s behalf. No physical signature is required; a countersigned copy is available to the Merchant on request.
For shopper personal data processed through the Service, the Merchant is the controller and Cultmetrics is the processor. Cultmetrics processes such data only to provide the Service. Each party complies with its own obligations under applicable data-protection law.
Cultmetrics processes shopper personal data only on the Merchant’s documented instructions, including as set out in this DPA, the Privacy Policy, and the Merchant’s configuration of the Service, unless required to do otherwise by EU or member-state law (in which case Cultmetrics will inform the Merchant unless legally prohibited). Cultmetrics will inform the Merchant if, in its opinion, an instruction infringes applicable data-protection law.
Cultmetrics processes personal data for the duration of the Merchant’s use of the Service and as described in Annex A. The nature and purpose is the operation of gamified activations (prize wheels and similar), including delivering prizes/discount codes, recording marketing consent, and producing activation analytics for the Merchant.
Cultmetrics ensures that persons authorized to process the personal data are bound by an appropriate duty of confidentiality and process the data only as necessary to provide the Service.
Cultmetrics implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, as described in Annex B (Article 32 GDPR).
The Merchant grants Cultmetrics general authorization to engage sub-processors to provide the Service. Current sub-processors are listed in Annex C, which reflects the list Cultmetrics maintains as of the effective date. Cultmetrics imposes data-protection obligations on each sub-processor no less protective than those in this DPA, and remains liable for its sub-processors’ performance. Cultmetrics will give the Merchant at least 30 days’ prior notice of any intended addition or replacement of a sub-processor. If the Merchant objects on reasonable data-protection grounds and the parties cannot resolve the objection, the Merchant may, as its sole remedy, terminate the Service by ceasing use and uninstalling the App.
Taking into account the nature of the processing, Cultmetrics assists the Merchant, by appropriate technical and organizational measures and insofar as possible, in fulfilling the Merchant’s obligations to respond to data-subject requests (access, rectification, erasure, restriction, portability, objection), and in complying with Articles 32–36 GDPR (security, breach notification, data-protection impact assessments, and prior consultation). Where the Service runs on Shopify, Cultmetrics honors Shopify’s mandatory privacy webhooks (customer data request, customer redaction, and shop redaction).
Cultmetrics notifies the Merchant without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting the Merchant’s data. The notification describes, to the extent known: the nature of the breach and, where possible, the categories and approximate number of data subjects and records concerned; the likely consequences; and the measures taken or proposed to address it. Cultmetrics provides reasonable further assistance to help the Merchant meet its own notification obligations.
Cultmetrics hosts data within the EU/EEA (Hostinger). Where a sub-processor may process personal data outside the EEA — in particular Cloudflare and Stripe (and Shopify, per its own terms) — Cultmetrics ensures an appropriate transfer mechanism is in place, being the European Commission’s Standard Contractual Clauses and/or, where the provider is certified, the EU–U.S. Data Privacy Framework.
On termination of the Service, or on the Merchant’s request, Cultmetrics deletes or returns the shopper personal data it processes on the Merchant’s behalf, and deletes existing copies unless EU or member-state law requires storage. Deletion timescales are set out in the Privacy Policy.
Cultmetrics makes available to the Merchant information reasonably necessary to demonstrate compliance with Article 28 GDPR, and allows for and contributes to audits, including inspections, conducted by the Merchant or an auditor it mandates, subject to reasonable notice, confidentiality, and frequency limits.
This DPA forms part of the agreement between the parties for the Service. In the event of a conflict between this DPA and any other terms of that agreement regarding the processing of personal data, this DPA prevails. Any liability arising under this DPA is subject to the limitations of liability agreed between the parties for the Service. This DPA is governed by the laws of Finland, without prejudice to mandatory data-protection law.
| Subject matter | Provision of the Perkbase gamified-activation Service. |
|---|---|
| Duration | For the term of the Merchant’s use of the Service, plus the retention periods in the Privacy Policy. |
| Nature & purpose | Running activations, delivering prizes/discount codes, recording marketing consent, and producing activation analytics. |
| Categories of data | Shopper email address (where provided), marketing-consent status, participation records (plays, prizes, generated discount codes, attributed orders), IP address, and browser user-agent. |
| Categories of data subjects | The Merchant’s shoppers who interact with an activation. |
| Retention | Participation records up to 12 months after the activation; IP address and user-agent up to 90 days; merchant/shop data deleted within 30 days of uninstall or a shop-redaction request. |
| Special-category data | None processed. |
| Sub-processor | Purpose | Location |
|---|---|---|
| Shopify | Platform the Service runs on for Shopify merchants; API access under Merchant-granted scopes | Per Shopify’s terms |
| Stripe | Subscription billing, payments and VAT calculation (WooCommerce merchants) | EU/US (SCCs and EU–U.S. DPF) |
| Hostinger | Application hosting and data storage | EU/EEA |
| Cloudflare | DNS and traffic routing | Global (SCCs where applicable) |
To exercise rights under this DPA (including sub-processor objections and audit requests), contact:
Cultmetrics Oy (Business ID / Y-tunnus: 3595346-9)
Perkiönkatu 33, 33900 Tampere, Finland
privacy@perkbase.app