Draft: not yet in effect. Details marked like {{THIS}} are still to be filled in.

VoraTill Data Processing Agreement

Draft. Effective {{EFFECTIVE_DATE}}.

This Data Processing Agreement ("DPA") is part of the VoraTill Terms of Service. It is between the shop using VoraTill (the "Controller") and {{COMPANY_NAME}} (the "Processor"). It applies whenever the Processor processes personal data on the Controller's behalf, and is written to meet Article 28 of the EU GDPR and the UK GDPR.

1. Roles and scope

• The Controller decides why and how personal data in its shop is processed. The Processor processes it only to provide VoraTill.
• Annex 1 describes the processing.
• If this DPA and the Terms conflict on data protection, this DPA wins.

2. Instructions

The Processor processes personal data only on the Controller's documented instructions. Those instructions are the Terms, this DPA, and the Controller's use of the app's features. If the Processor believes an instruction breaks data protection law, it will tell the Controller. If the law requires the Processor to process the data in some other way, it will tell the Controller first, unless the law forbids that.

3. Confidentiality

Everyone authorised to process the personal data is bound by confidentiality, and has access only as far as their job requires.

4. Security

The Processor applies the technical and organisational measures in Annex 2, and may improve them over time but not weaken them.

5. Sub-processors

• The Controller gives general authorisation for the sub-processors in Annex 3.
• The Processor will give at least 30 days' notice, by email to the shop owner or by updating Annex 3 at tillfolk.app/dpa, before adding or replacing a sub-processor. The Controller may object on reasonable data protection grounds. If the parties can't resolve the objection, the Controller may end the affected service and get a refund of any prepaid fees for the remaining period.
• Each sub-processor is bound by data protection obligations at least as protective as this DPA. The Processor remains responsible for its sub-processors.

6. Helping the Controller

• Data subject requests. The app lets the Controller find, correct, export and delete records. The Processor will help with requests the app can't handle, and will pass on any request it receives directly.
• Other obligations. The Processor will reasonably help with security, breach notifications, data protection impact assessments and consultations with authorities, as far as these relate to VoraTill.

7. Personal data breaches

The Processor will notify the Controller without undue delay, and within 48 hours of becoming aware of a breach affecting the Controller's personal data. The notice will say what is known, and the Processor will add details as they become available.

8. International transfers

Personal data is stored in {{DATA_REGION}}. Where a sub-processor processes it outside the UK or EEA, the transfer is covered by an adequacy decision or by Standard Contractual Clauses (with the UK Addendum for UK data), together with any supplementary measures that are needed.

9. Deleting or returning data

When the service ends, the Controller can export its data from the app at any time. After the Controller deletes its shop, the data can be restored for 30 days and is then permanently deleted from live systems. Backups are overwritten within {{BACKUP_RETENTION_DAYS}} days. Data the law requires the Processor to keep is excepted.

10. Audits

The Processor will provide the information needed to show it complies with this DPA, including answers to reasonable security questionnaires once a year. Where that isn't enough, the Controller may carry out an audit, or have an independent auditor do it, with 30 days' notice, during business hours, under confidentiality, at its own cost, and no more than once a year unless a breach or a regulator requires more.

11. Liability and term

Liability under this DPA follows the limits in the Terms, as far as the law allows. This DPA lasts as long as the Processor processes personal data for the Controller.

Annex 1: Description of processing

Annex 2: Security measures

• Encryption in transit (TLS) and at rest (provided by the hosting platform).
• Each shop's data is isolated by database row-level security, so members can reach only their own shop.
• Cloud sign-in tokens are kept in the operating system's secure storage on each device. Staff PINs are stored only as hashes.
• Server-side secrets (service keys, provider keys, webhook secrets) never reach client devices. Billing and payment webhooks are checked by their signatures.
• Access by our staff goes through an audited admin tool, with multi-factor authentication and role-based permissions.
• An audit log records sensitive shop actions such as sign-ins, member changes, billing changes and deletion requests.
• Separate development, staging and production environments; production data is not used for testing.
• Backups and point-in-time recovery from the hosting platform.
• A process for responding to incidents and notifying breaches (see §7).

Annex 3: Sub-processors

The card payment provider is chosen and contracted by the Controller. It receives only the payment details needed to process each sale.