Revised September 8, 2025
This Attachment is part of the DPA and includes certain details of the Processing of Personal Data. Capitalized terms are defined in the DPA.
Purpose and duration of the Processing of Personal Data
The subject matter and duration of the Processing of Personal Data are set out in the DPA and the relevant Terms, and the obligations and rights of Blackhawk Network and its Affiliates are set forth in the DPA, however for purposes of reporting, the following descriptions may be used: The Vendor will process the below-identified consumer information in order to fulfill prepaid reward card orders, service cardholders, and provide associated services.
Data Subjects
The Data Subjects whose Personal Data is required to be processed as an essential part of delivering the Services described above could include any of the following:
Personal Data
As of the effective date of the Terms, the sub-processors listed below may support the performance of the Services in accordance with the Terms and pursuant to the terms of the DPA. The identified sub-processors will provide the identified services and nature of processing in the United States until the Personal Data is deleted pursuant to the Terms or Section 5 of the DPA.
Entity | Type of Service and Nature of Processing | Location | Duration of Processing |
Amazon Web Services, Inc. | Infrastructure-as-a-Service for data storage | U.S. (East & West Coast); EU (Ireland and Germany); APAC (Singapore, Australia, and Japan); Canada | Until deleted pursuant to the Agreement or Section 5 of the DPA. |
Arroweye Solutions, Inc. | Card Fulfillment | United States | Until deleted pursuant to the Agreement or Section 5 of the DPA. |
Fidelity Information Services | Card Fulfillment and Card Processing | United States | Until deleted pursuant to the Agreement or Section 5 of the DPA. |
Fiserv Solutions | Card Fulfillment | United States | Until deleted pursuant to the Agreement or Section 5 of the DPA. |
MessageBird USA, Inc. | Email Service Provider | United States | Until deleted pursuant to the Agreement or Section 5 of the DPA |
Vendor may periodically make available its then-current list of sub-processors through a link on its website (e.g., via the Privacy Policy, or otherwise), and Vendor notifications about changes to its sub-processors will be made via posting the list at that location.
If Customer is located in Canada, this Addendum applies in respect of Canadian open loop products and related services that Rybbon, LLC offers as agent for Blackhawk Network (Canada) Ltd. (“Blackhawk Canada”
This RPAA Trust Addendum is attached to and forms part of the Rybbon Terms of Service (“Terms”) by and between Customer and Rybbon, LLC (“Rybbon”), whereby in respect of certain open loop products and related services, Rybbon LLC offers such products and performs such services as agent for Blackhawk Network (Canada) Ltd. (“Blackhawk Canada”). Capitalized terms used but not defined in this RPAA Trust Addendum have the meanings given to them in the Terms.
“Beneficiary” means (i) Customer, (ii) any other end-user (within the meaning of the RPAA), in each case from whom, or for whom, Rybbon transfers funds to Blackhawk Canada and Blackhawk Canada receives and holds funds where such funds are transferred to Blackhawk Canada with the intention that they be held in trust and (iii) any income beneficiary designated under the Declaration of Trust;
“Blackhawk Canada Trust” means the trust established by the Declaration of Trust to hold Trust Property in trust for the benefit of the Beneficiaries;
“Customer Funds” means Customer funds that Blackhawk Canada receives and holds in accordance with these Terms that are required to be safeguarded in accordance with the RPAA;
“Declaration of Trust” means the declaration of trust entered into between Blackhawk Canada, as initial settlor, and the Trustee, establishing the Blackhawk Canada Trust, as such declaration of trust may be amended, modified, supplemented and replaced from time to time;
“Financial Institution” means a Canadian entity permitted to provide a trust account in accordance with the RPAA;
“Income” means any interest or other investment income or earnings that may be earned on the Customer Funds held in a Trust Account;
“In-Transit” means the period commencing at the point in time Blackhawk Canada receives an instruction to immediately transfer or withdraw funds to or from an account, including the Trust Account, until the point in time at which such transfer or withdrawal is complete;
“RPAA” means the Retail Payment Activities Act (Canada);
“Trust Account” means a segregated omnibus trust account maintained by and in the name of the Trustee as trustee on behalf of the Beneficiaries at a Financial Institution;
“Trustee” means the person or entity appointed by Blackhawk Canada pursuant to the Declaration of Trust as trustee of the Blackhawk Canada Trust and any successor or replacement trustee;
“Trust Property” means (i) all Customer Funds, and (ii) any other property held in trust pursuant to the Declaration of Trust.