Data processing agreement

This Data processing agreement ("DPA") forms part of our Terms of service between Clever Little Cart ("Processor", "we") and the business using Clever Little Cart ("Controller", "you"). It applies whenever we process personal data on your behalf in providing the Service, and it is made under Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR").

If this DPA and the Terms conflict on data protection, this DPA prevails.

1. Definitions

Words such as personal data, processing, controller, processor, data subject, personal data breach and supervisory authority have the meanings given in the GDPR. Customer Data means the personal data we process on your behalf. Sub-processor means another processor we engage to process Customer Data.

2. Roles

You are the controller of Customer Data, and we are your processor. You are responsible for having a lawful basis for the processing, for giving data subjects the information the law requires (including in your Shop's privacy notice), and for the lawfulness of your instructions.

3. Details of the processing

4. Instructions

We process Customer Data only on your documented instructions. These are the Terms, this DPA, and the settings you choose in your dashboard. We do so unless the law requires otherwise, in which case we tell you first unless the law forbids it. We tell you immediately if we believe an instruction breaks the GDPR or other data protection law.

5. Confidentiality

We ensure that everyone authorised to process Customer Data is bound by confidentiality, and accesses it only as needed to provide, support and secure the Service, or on your request.

Support access. To support you, our support staff may sign in to your dashboard and see the Customer Data it shows. You allow or refuse this with Allow support access under Settings → Privacy, which is one of your instructions under section 4. It is on until you switch it off. Each visit:

• is for a reason we record, lasts at most an hour, and is announced to you by email when it starts;
• is shown by a banner in your dashboard, and everything done in it is in your audit log under the staff member's name;
• is to look only, unless it is opened by one of the staff allowed to make changes;
• can never manage your Users or their roles, export or erase Customer Data, sign in as one of Your Customers, or change your payment settings.

Switching support access off ends any visit in progress and stops new ones.

6. Security

We implement appropriate technical and organisational measures under Article 32 GDPR, set out in Annex 1, and review them regularly. We may update them, provided the overall level of protection is not reduced. Our Security page describes them in more detail.

7. Sub-processors

• You give us general authorisation to engage sub-processors. The current list is on our Sub-processors page.
• We tell you at least 30 days before adding or replacing a sub-processor, by email and on that page. You may object on reasonable data protection grounds within that time. If we cannot reasonably accommodate the objection, you may end the agreement for the affected Service, and we refund fees prepaid for the period after the end.
• We impose on each sub-processor, by written contract, data protection obligations no less protective than this DPA, and remain liable to you for its performance.
• Services you choose to connect to your Shop are not our sub-processors. These include your payment provider account (such as Stripe), Google or Meta product feeds and advertising, and your own mail server. You engage them directly, under their own terms.

8. International transfers

We store Customer Data in the European Union. We transfer Customer Data outside the European Economic Area only to a country with an adequacy decision, or under the European Commission's Standard Contractual Clauses with supplementary measures where needed.

9. Assisting you

• Data subjects' rights. The dashboard lets you find, export, correct and erase a customer's data, and handle access and erasure requests. If we receive a request directly, we pass it to you without responding ourselves, unless you authorise us. We help you further where reasonable.
• Security, breaches, assessments. We help you meet your obligations under Articles 32 to 36 GDPR, taking into account the nature of the processing and the information available to us.

10. Personal data breaches

We notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Data. The notice includes, as far as we know at the time:

• the nature of the breach, and the categories and approximate numbers of data subjects and records concerned;
• the likely consequences;
• the measures taken or proposed.

We then keep you updated, and take reasonable steps to contain the breach and limit its effects. Notifying a breach is not an admission of fault.

11. Audits

We make available all information reasonably needed to demonstrate compliance with Article 28 GDPR. You may audit our compliance, by yourself or through an independent auditor bound by confidentiality, once a year, or more often after a breach or if a supervisory authority requires it. You give at least 30 days' notice. Audits are at your cost, take place during business hours, must not disrupt the Service or breach other customers' confidentiality, and may first be met by our written answers and documentation.

12. Return and deletion

You can export Customer Data at any time with Export everything. After the Terms end, we keep Customer Data for 60 days so you can reactivate or export it, then delete it. Deleted data is removed from backups as they expire, within 8 days of its deletion. We may keep data where the law requires, and continue to protect it under this DPA for as long as we do.

13. Liability

Each party's liability under this DPA is subject to the limits in the Terms, except where the law does not allow such limits.

Annex 1: Technical and organisational measures

• Separation: each Shop's data is held in its own database, with its own credentials.
• Encryption: all traffic is encrypted in transit (HTTPS/TLS). Secrets and credentials stored by the Service are encrypted at rest. Passwords are stored only as strong one-way hashes.
• Access control: staff access is on a need-to-know basis, with two-factor sign-in. Users' access is limited by roles and permissions you control. Sessions expire, and you can sign out other devices. Support staff reach your dashboard only while you allow it, an hour at a time, as section 5 describes.
• Logging: sign-ins and significant actions in your dashboard are recorded in an audit log. Platform staff actions are audited.
• Availability and resilience: the Service is monitored continuously, with alerts and incident procedures. Every change to a Shop's database is backed up as it happens, with a full backup each night, to separate storage in the European Union; backups are kept for seven days, so a Shop can be restored to any point in that time; a restore is tested automatically every month.
• Secure development: code review, dependency updates and security fixes applied promptly. Test data is never real customer data.
• Minimisation: card details are handled by Stripe and never stored by the Service. Visitor analytics on our own website are anonymous and cookieless.
• People: staff are bound by confidentiality, and access is removed when it is no longer needed.
• Incidents: a documented process for detecting, containing, investigating and notifying breaches.

Contact

Data protection questions: support@cleverlittlecart.com · Clever Little Cart, the company’s postal address, in Settings