The data processing
agreement.

Roles

You are the controller.You decide why your customers' data is collected, what it is used for, who sees it and how long it is kept. That is the ICO's own test, and every one of those answers is yours.

We are the processor. We hold it and do what you instruct. The moment we used your customers for our own purposes we would become a controller in our own right — different law, different liability, and a broken promise. So we do not.

The reasoning, with the case law, is on Who owns your customers?

We process only on your documented instructions

We use your customers' data to run your shop and for nothing else. Not for our marketing, not sold on, not fed into anyone else's product, and not used to build a cross-shop data product.

Your instructions are this agreement plus what you do in the dashboard. If we are ever required by law to do something you have not instructed, we tell you first unless the law forbids it. If we think an instruction breaks data protection law, we tell you that too.

Everyone who touches it is under a duty of confidence

Access is limited to the people who need it to do their job, each of them bound by confidentiality that survives them leaving, and every access is logged.

Security measures appropriate to the risk

Article 32 measures: encryption in transit and at rest, access control with multi-factor authentication on anything administrative, tested backups, and a documented incident process. The specifics are in Annex 3, and they are ours to keep current as threats change.

Sub-processors: named, and never a surprise

We do not engage anyone new to handle your customers' data without telling you first and giving you a reasonable window to object. Every sub-processor is bound to the same terms we are bound to, and if one of them fails, we are answerable to you for it.

The current list is Annex 2.

We help you answer your customers' requests

Access, correction, deletion, portability, objection: because you are the controller, those requests come to you, so the dashboard has the tools to answer them — look someone up, export what you hold, delete it. Where a request is complicated we help. If one reaches us by mistake, we pass it to you rather than answering it ourselves.

We help you with breaches, assessments and the regulator

If there is a personal data breach we tell you without undue delay, with what we know and what we are doing, in time for you to make your own report inside the deadline the law gives you. We also help with data protection impact assessments and with prior consultation of the ICO where you need to do either — Articles 32 to 36.

Delete or return at the end — you choose which

When the contract ends you tell us to delete or to return your customers' data. It is the controller's choice, which means it is yours, and we confirm in writing when it is done. Backups roll off on their normal cycle and are put beyond use in the meantime.

You do not have to wait for the end to get your data out: the export is one click, standard CSV, free, with no notice period and no billing-dispute exception. There is no lien over a database in English law, and there is none in this agreement.

Audit and information

We give you the information you need to show that we are doing all of this, and we submit to audits and inspections you carry out or commission — on reasonable notice, during working hours, in a way that does not put other shops' data at risk.

And what you take on, as the controller

Article 28 lists what the processor owes the controller. It works because the controller carries the other half, and a published agreement that only sets out our side would be half a document. Every competitor agreement worth reading splits it this way.

• Your instructions have to be lawful.You decide why your customers' data is collected and what it is used for, and you need a lawful basis for it. We act on what you tell us; we are not the ones who decided it.
• You publish a privacy notice on your storefront.Telling your customers what happens to their details is the controller's duty, so it is yours. We write it for you and keep it current — the specimen is here — but you publish it and you can change it.
• You keep the permission trail honest. Every contact records how and when you got the details and whether an opt-out was offered. That record is only worth what the shop puts into it, and it is the thing PECR turns on.
• You keep your own access under control — staff logins go to the people who should have them, and you tell us promptly when one should be revoked.
• You answer your own customers. Access, deletion and portability requests come to you because you are the controller. We built the tools and we help when one gets complicated, but the answer is yours to give.
• You do not put special category data into the system. It is not designed to hold health, religious or similar data, and a dietary note typed into an order is not a substitute for asking a customer about allergens.