StockpaceData processing addendum
This addendum applies when we, ORGANIC BOUTIQUE LTD (“processor”), process personal data on behalf of a merchant who uses Stockpace (“controller”), under the UK GDPR, the Data Protection Act 2018 and, where it applies, the EU GDPR. It takes effect when the merchant installs Stockpace and needs no signature. A signed copy is available on request from support@stockpace.app.
1. Subject matter, nature and purpose
We process personal data only to provide Stockpace: reading the controller’s Shopify store data, supplier documents and purchase-order emails to produce forecasts, purchase orders, receipts, cost updates, payment schedules and bills, and to support the controller.
2. Categories of data and data subjects
- Data subjects: the controller’s staff who use Stockpace; the controller’s suppliers’ contacts; in rare cases, people who email the controller’s connected mailbox.
- Personal data: names and email addresses of staff and supplier contacts; content of supplier emails and documents; staff names in change history. Stockpace does not read or store the controller’s customers’ names, addresses, emails or phone numbers from Shopify orders.
- Special category data: none intended. The controller should not connect mailboxes or folders used for special category data.
3. Duration
For as long as Stockpace is installed, and then until deletion as set out in section 9.
4. Instructions
We process personal data only on the controller’s documented instructions — these terms, the controller’s settings in Stockpace and any written instructions agreed with us — unless the law requires otherwise, in which case we will tell the controller first unless the law forbids it. We will tell the controller if we think an instruction breaks data protection law.
5. Confidentiality
Everyone we authorise to process the data is bound by confidentiality.
6. Security
We keep appropriate technical and organisational measures, including: separation of each store’s data by database row-level security; encryption in transit (HTTPS/TLS) and encryption of stored credentials and tokens; hosting in the United Kingdom with a provider that maintains recognised security certifications; access to production limited to the people who run the service; regular backups; and logging of changes made in the app.
7. Sub-processors
The controller gives general authorisation for the sub-processors listed on our sub-processors page. We will give at least 30 days’ notice of any new sub-processor by email and on that page. The controller may object on reasonable data protection grounds within that period; if we cannot address the objection, the controller may end the service by uninstalling. We impose data protection obligations on each sub-processor that are no less protective than this addendum and remain responsible for their performance.
8. International transfers
Store data is hosted in the United Kingdom. Where a sub-processor processes personal data outside the UK or EEA, the transfer is covered by an adequacy decision or regulation (including the UK Extension to the EU–US Data Privacy Framework for certified providers) or by the UK International Data Transfer Addendum / EU Standard Contractual Clauses.
9. Deletion and return
When the controller uninstalls Stockpace, we delete all of the store’s data when Shopify sends its deletion request (48 hours after uninstall) and in any case within 7 days; backups are overwritten within a further 14 days. Before uninstalling, the controller can download purchase orders (PDF / CSV), stock history and payment schedules from the app, or ask us for a full export.
10. Assistance
Taking into account the nature of the processing, we assist the controller with data subject requests (customer data requests and deletions arriving through Shopify are handled automatically), security, breach notification, data protection impact assessments and consultations with supervisory authorities.
11. Personal data breaches
We will notify the controller without undue delay, and in any case within 48 hours of becoming aware of a personal data breach affecting its data, with the information the controller needs to meet its own obligations.
12. Audits
We will make available the information reasonably needed to show compliance with this addendum and answer reasonable written questions. Where that is not enough, the controller may arrange an audit at its own cost, on reasonable notice, no more than once a year, subject to confidentiality.
13. Precedence
If this addendum conflicts with the terms of service on the processing of personal data, this addendum prevails.