Data Processing Agreement

1.What this DPA covers#

This DPA applies whenever we process personal data in your Store Data on your behalf while providing the Services. It sets out the terms Article 28 of the UK GDPR requires, and the equivalent terms of the EU GDPR and other data protection laws where they apply to your processing.

If this DPA and the rest of the Agreement conflict on anything about personal data, this DPA wins. Words defined in the Terms of Service mean the same here.

Data Protection Law

The UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, and, where they apply to your processing, the EU GDPR and any other law on the processing of personal data.

Store Personal Data

Personal data in your Store Data that we process on your behalf.

Sub-processor

Another processor we engage to process Store Personal Data.

Personal Data Breach

A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Store Personal Data.

Controller, processor, data subject, processing

Have the meanings given in the UK GDPR.

2.Our roles#

You are the controller of Store Personal Data and we are your processor. If you are yourself processing the data for another controller, we are your sub-processor, and you confirm that the other controller has authorised you to appoint us on these terms.

Personal data we hold about you and your staff to run your account, such as your billing details, is not Store Personal Data. We are its controller, and our Privacy Policy explains how we handle it.

3.Details of the processing#

Subject matter

Providing the My-Pepts Platform and the optional services you use: hosting and running your store and its admin, sending its email, and providing AI features and integrations you switch on.

Duration

The term of the Agreement, and afterwards until the data is deleted as Deleting or returning data describes.

Nature

Collecting through your store, recording, storing, organising, retrieving, displaying, transmitting (for example by email), backing up, analysing in aggregate for your reports, and erasing. Processing is continuous while your store is live.

Purpose

Providing the Services to you under the Agreement, and following your instructions.

Data subjects

• Your shoppers: people who visit your store, create an account on it, place an order, subscribe to its emails, write a review or contact you through it.
• Your staff and contractors who use your store admin.
• People connected with your business whose details you record in the store, such as supplier contacts and affiliates.

Personal data

• Identity and contact details: name, email address, phone number, delivery and billing addresses.
• Account details: login email, password (as a salted hash), saved addresses, preferences.
• Orders: what was ordered, prices, discounts, order status, delivery and tracking details, and any notes, including photos of parcels where the store takes them, which show the label.
• Payment references: the status and reference of a payment from your payment provider. We do not receive full card or bank account numbers.
• Declarations: the record of a shopper's age confirmation, research-use declaration and acceptance of your terms.
• Store activity: baskets, pages viewed, how the shopper arrived (such as the referring site, campaign tags and advert click identifiers), and consent choices.
• Communications: messages to and from the store, the emails it sends, and their delivery, bounce and open events.
• Marketing: subscription status and the record of consent or unsubscribe.
• Reviews: display name, rating and review text.
• Technical data: IP address, browser and device type, cookie identifiers.
• Affiliate and supplier records: contact details and, for affiliates you pay, the payout details you record.

Special category data

The Platform is not designed to collect special category data, and you must not configure your store to ask for it, such as health information. Because what a shopper orders could in some cases be used to infer something about their health, treat order data with care and do not use it to profile individuals.

4.Processing on your instructions#

We process Store Personal Data only on your documented instructions, including on transfers to other countries, unless the law requires us to do otherwise; in that case we tell you before processing, unless the law forbids it.

Your instructions are the Agreement, the settings you choose and the actions you take in the Platform, and any further written instructions you give us that we agree are consistent with the Agreement. Instructions that go beyond what the Services do may carry a charge, which we agree with you first.

We tell you straight away if we think an instruction breaks Data Protection Law, and we may decline to follow that instruction until you confirm or change it.

We do not sell Store Personal Data, use it for our own purposes, or combine it with personal data from other sources, except for the aggregated, non-identifying statistics and the security uses the Terms of Service allow. Where the California Consumer Privacy Act applies to you, we are your service provider, and we do not sell or share Store Personal Data or retain, use or disclose it outside our direct business relationship with you.

5.Confidentiality of our people#

Everyone we authorise to process Store Personal Data is bound by a duty of confidentiality, by contract or by law, and has access only to what they need for their role.

6.Security#

We take the technical and organisational measures Article 32 of the UK GDPR requires, appropriate to the risk. In summary:

• Isolation. Each lab's store runs as its own deployment, with its own database and its own credentials. One store's code and credentials cannot reach another store's data.
• Separate domains. Storefronts are served from a different domain from the account dashboard, so a store's pages cannot read dashboard cookies.
• Encryption. Data is encrypted in transit with TLS. Backups are encrypted with a key unique to your store before they leave the server. Access tokens for connected services, and your other integration keys, are stored encrypted with your store's own key.
• Passwords. Shopper and staff passwords are stored only as salted hashes.
• Access control. Production access is limited to the people who run the Platform, protected by multi-factor authentication, and used only to support you, investigate a problem, keep the Platform secure or comply with the law.
• AI agents. Platform API keys are scoped to one store, carry only the permissions you grant, can be revoked at any time, and are rate limited, and every call is recorded in an audit log you can read. An agent using a key cannot reach other stores, the account dashboard or the Platform's code.
• Secrets. Credentials and keys are kept in our providers' secret stores and never in source code.
• Backups. Each store's database is backed up so that we can recover from failure, restores are tested regularly, and backups are deleted on the timetable in this DPA.
• Maintenance. We keep software and dependencies up to date and apply security fixes promptly.
• Monitoring and response. We monitor the Platform for faults and attacks, and follow an incident response process when something goes wrong.
• Suppliers. We choose sub-processors that offer strong security commitments, and review them when they change.

We may change these measures over time, but never so that they give less protection overall.

7.Sub-processors#

You give us general authorisation to engage sub-processors. The current list, with what each one does and where, is on our Sub-processors page. Those that process Store Personal Data are currently Vercel, Hetzner, Amazon Web Services, Resend, Anthropic and Google, some of them only when you use the feature that needs them.

We impose data protection obligations on each sub-processor that are at least as protective as this DPA, in particular sufficient guarantees of appropriate security, and we remain fully responsible to you for their performance.

Notice of changes. We email the account owner at least 30 days before a new or replacement sub-processor starts processing Store Personal Data, and update the list on the same day. You may object on reasonable data protection grounds by email within that time. If we cannot address your objection, for example by not using that sub-processor for your store, you may end the affected Services before the change takes effect and we refund the fees you prepaid for the period after that.

If a sub-processor has to be replaced urgently, for example because it has failed or become insecure, we may make the change sooner and tell you as soon as we can, and the same right to object applies.

8.Helping you meet your obligations#

Requests from shoppers. The store admin lets you find, export, correct and delete a shopper's personal data, which covers most requests. Where it does not, we help you respond, taking into account the nature of the processing. If a shopper sends a request to us, we pass it to you without undue delay and do not answer it ourselves, unless you ask us to.

Security, breaches and impact assessments. We help you meet your obligations under Articles 32 to 36 of the UK GDPR, taking into account the nature of the processing and the information available to us: keeping Store Personal Data secure, notifying breaches, carrying out data protection impact assessments, and consulting the Information Commissioner's Office where one is needed.

Help that the Platform's tools provide is free. If you ask for help that takes us substantial time beyond them, we may charge a reasonable fee, which we agree with you first.

9.Personal data breaches#

We tell you without undue delay, and in any event within 48 hours, after we become aware of a Personal Data Breach affecting your Store Personal Data, so that you can meet the 72 hour deadline for telling the Information Commissioner's Office where that is required.

We tell you what we know at the time and add to it as we learn more: the nature of the breach, the categories and approximate numbers of people and records concerned, its likely consequences, the measures we have taken or propose, and a contact for more information.

We take reasonable steps to contain the breach and limit its effects. You decide whether to notify the regulator and the people affected; we do not notify them on your behalf unless you ask us to or the law requires it. Telling you about a breach is not an admission of fault.

10.International transfers#

Your store, with its database, files and backups, is hosted in the region recorded for it: the European Union (Germany or Finland) by default, or the United States for a store hosted there. Some sub-processors process Store Personal Data in other countries, mainly the United States, as the Sub-processors page shows.

Where that involves a restricted transfer under UK data protection law, we make sure it is covered by a safeguard the law allows: UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework where the recipient is certified under it, or the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses issued by the Information Commissioner, with a transfer risk assessment. You authorise us to enter into those safeguards with sub-processors on your behalf where that is needed.

If you are in the European Economic Area, your transfers to us in the UK rely on the European Commission's adequacy decision for the UK. If that decision stops applying, we will agree the EU Standard Contractual Clauses with you. If any safeguard we rely on stops being valid, we will put another lawful one in place, or stop the transfer.

11.Deleting or returning data#

While your subscription lasts, you can export or delete Store Personal Data yourself from your admin.

When the Agreement ends, you can export all of your Store Data, including Store Personal Data, for 30 days, and ask us for a complete copy of your store's database and files. After that we delete Store Personal Data from our live systems within 30 days, and within 35 days after that we delete your store's backups or make them permanently unreadable by destroying the key that encrypts them, unless the law requires us to keep the data. When deletion is complete we confirm it in writing if you ask.

12.Information and audits#

We make available to you the information you reasonably need to show that we comply with this DPA and Article 28, including answering a reasonable security questionnaire once a year and sharing our sub-processors' security reports where they allow it.

If that information is not enough, you, or an independent auditor you appoint who is bound to keep what they learn confidential, may audit our compliance with this DPA. Tell us at least 30 days before, limit the audit to what is needed, hold it during business hours without disrupting the Platform or other labs, and bear its cost. You may audit no more than once in any 12 months, unless a regulator requires it or we have had a Personal Data Breach affecting your data. Audits of our sub-processors' facilities are limited to what those sub-processors allow.

13.Your obligations as controller#

• Have a lawful basis for the processing you ask us to carry out, and give your shoppers the information Data Protection Law requires, in a privacy notice on your store.
• Obtain any consent the law requires, including for marketing email and for cookies your store sets that are not strictly necessary.
• Make sure your instructions comply with Data Protection Law.
• Do not use the Platform to collect special category or criminal offence data.
• Configure your store's settings, such as its consent banner and the regions it ships to, to suit your obligations.

14.Liability#

Each of us is liable for its own breaches of this DPA and of Data Protection Law. The limits and exclusions of liability in the Terms of Service apply to this DPA, and the cap there is a single cap for all claims under the Agreement and this DPA together.

Nothing in this DPA limits the rights of data subjects under Data Protection Law, including their right to compensation under Article 82 of the UK GDPR, or either party's liability where the law does not allow it to be limited.

15.How long this DPA lasts, and changes#

This DPA lasts for as long as we process Store Personal Data, and its obligations continue until that data has been deleted or returned.

We may update this DPA to reflect a change in Data Protection Law, in guidance from a regulator, or in our sub-processors. A change that reduces the protection your data has follows the notice and the right to end the Agreement in the Terms of Service.