Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms and Conditions between RETAILED ("Retailed", the processor) and any business user of Retailed (the "Customer", the controller). It applies when Retailed processes personal data on the Customer's behalf through the Services, and meets the requirements of Article 28 of the EU General Data Protection Regulation (GDPR) and of the UK GDPR. No signature is needed: it applies automatically. A signed copy is available on request at support@retailed.io.

1. Scope and roles

1.1 The Customer is the controller of the personal data it stores in the Services about third parties (the "Customer Personal Data"), described in Annex 1. Retailed processes it as processor.

1.2 Retailed is the controller of the data it collects to manage the Customer's account, billing and its own services. That data is covered by the privacy policy, not by this DPA.

2. Instructions

2.1 Retailed processes Customer Personal Data only on the Customer's documented instructions. The Terms, this DPA and the Customer's use and settings of the Services are the Customer's complete instructions.

2.2 Retailed tells the Customer if it believes an instruction breaks data protection law, and may suspend that processing until it is confirmed or changed. If the law requires Retailed to process data otherwise, it tells the Customer first unless the law forbids it.

3. Confidentiality

Retailed makes sure that everyone it authorises to process Customer Personal Data is bound by a duty of confidentiality and accesses the data only as needed to provide the Services or support.

4. Security

Retailed implements the technical and organisational measures in Annex 2, and may improve them over time provided the overall level of security does not decrease.

5. Sub-processors

5.1 The Customer gives Retailed a general authorisation to use sub-processors. The current list is in the privacy policy.

5.2 Retailed tells the Customer at least 30 days before adding or replacing a sub-processor that processes Customer Personal Data, by email or a notice in the app. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may terminate the affected Services and get a refund of any prepaid, unused period.

5.3 Retailed puts in place a written contract with each sub-processor with data protection obligations equivalent to this DPA, and remains responsible for its sub-processors.

6. International transfers

Customer Personal Data is stored in the United Kingdom, which benefits from an adequacy decision of the European Commission. Where a sub-processor processes it in a country without an adequacy decision, Retailed ensures an appropriate safeguard under Chapter V GDPR, such as the EU-US Data Privacy Framework or the Standard Contractual Clauses (with the UK addendum where the UK GDPR applies).

7. Assistance

7.1 Taking into account the nature of the processing, Retailed helps the Customer respond to requests from data subjects (access, correction, deletion, portability, objection). The Services let the Customer edit, export and delete data itself. If Retailed receives a request directly, it forwards it to the Customer without answering it, unless authorised.

7.2 Retailed gives the Customer reasonable help with data protection impact assessments and prior consultations with authorities, as far as they concern the Services.

8. Personal data breaches

Retailed notifies the Customer without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice includes what Retailed knows at the time: the nature of the breach, the categories and approximate number of people and records concerned, likely consequences, and the measures taken or proposed. Retailed updates the Customer as it learns more.

9. Deletion and return

When the Customer deletes data or its account, Retailed deletes the Customer Personal Data within 30 days, and from backups within a further 30 days, unless the law requires it to keep it. Before closure, the Customer can export its data with the tools in the Services.

10. Audits

Retailed makes available the information needed to show compliance with this DPA. The Customer may audit Retailed's compliance once a year, at its own cost, with 30 days' written notice, during business hours, and under confidentiality. Retailed may first answer with written responses and documentation; an on-site audit happens only if these are not enough or if an authority requires it.

11. Liability and term

The liability provisions of the Terms apply to this DPA. This DPA lasts as long as Retailed processes Customer Personal Data.

Annex 1: Description of the processing

• Subject matter and nature: hosting, storage, organisation, display, search, export and deletion of data entered or imported by the Customer in an inventory and sales management tool; automated reading of documents and emails the Customer submits.
• Purpose: providing the Services to the Customer.
• Duration: the term of the Customer's account, plus the deletion period in section 9.
• Data subjects: the Customer's customers, buyers, suppliers and other contacts; shoppers who send inquiries through the Customer's public inventory page; people named in emails and documents the Customer forwards or uploads.
• Categories of data: names, email addresses, phone numbers, postal and shipping addresses, order and transaction details (items, prices, dates, order numbers, platforms), messages, and any other data the Customer chooses to enter. The Customer must not store special categories of data (Art. 9 GDPR) or data about criminal convictions.
• Sub-processors involved: database, file storage and hosting providers; background jobs; email reception (for the supplier inbox); the AI provider (for documents and emails the Customer chooses to have read automatically).

Annex 2: Security measures

• Encryption of data in transit (TLS/HTTPS) on all public endpoints.
• Encryption of the database and file storage at rest by the hosting provider.
• Each customer's data separated from other customers' data by access rules enforced at the database level.
• Private file storage: uploaded files are not publicly accessible and are served through short-lived signed links.
• Passwords stored only as salted hashes by the authentication provider; optional sign-in with Google or Discord.
• Production access limited to named staff, with multi-factor authentication on hosting, database, payment and source code accounts.
• Secrets stored outside source code and rotated after any suspected exposure.
• Daily backups of the database, kept for 30 days.
• A process to assess, contain and notify security incidents.