Data Processing Addendum

This Data Processing Addendum (“DPA”) is part of the agreement between [COMPANY NAME LTD] (company number [COMPANY NUMBER], registered office [REGISTERED ADDRESS], “Shelfprice”) and the Customer named in the Terms of Service or an order form. It applies automatically when the Customer accepts the Terms. We will sign a copy on request at [CONTACT / DPO EMAIL]. It meets Article 28 of the UK GDPR and the equivalent Article 28 of the EU GDPR.

• Customer Personal Data means personal data that Shelfprice processes on the Customer’s behalf to provide the Service: details of the Customer’s users (name, work email address, role), and personal data in the Customer’s workspace (notes, assignments, email recipients, saved settings), as set out in Annex A.
• Data Protection Law means the UK GDPR, the Data Protection Act 2018 and, where it applies to the Customer Personal Data, the EU GDPR and any other data protection law that applies. “Controller”, “processor”, “personal data”, “personal data breach”, “data subject” and “processing” have their meanings in that law.
• Roles. For Customer Personal Data the Customer is the controller and Shelfprice is the processor.
• Retail data (products, sizes and prices collected from Kroger’s public API) is not personal data and is outside this DPA.
• Our own purposes. Shelfprice is an independent controller, under its Privacy Policy and not this DPA, for the limited personal data it uses for its own purposes: signing users in and keeping the Service secure, billing, its legal duties, support records, and aggregate improvement of the product.

For the reviewer: The split of roles is my judgment call (open point 1).

The subject matter is the provision of the Service. It lasts as long as the agreement does, plus the time needed to return or delete data under section 9. The nature and purpose of the processing, the types of personal data and the data subjects are in Annex A.

• Shelfprice will process Customer Personal Data only on the Customer’s documented instructions, unless law requires otherwise (in which case it tells the Customer first, unless the law forbids that). The agreement, this DPA, and the Customer’s use of the Service’s settings and features are the Customer’s complete instructions. Further instructions must be agreed in writing, and Shelfprice may charge reasonable costs for ones outside the Service.
• Shelfprice will tell the Customer if it thinks an instruction breaks Data Protection Law.
• The Customer confirms it has a lawful basis to give Shelfprice the Customer Personal Data, and that it has given the notices the law requires to its users and to anyone whose details its users enter.

Shelfprice will make sure everyone it allows to process Customer Personal Data is under a duty of confidence, and gives access only to those who need it to provide the Service. Staff access to a customer workspace for support is read-only and logged.

Shelfprice will put in place appropriate technical and organizational measures to protect Customer Personal Data, taking into account the state of the art, costs, and the nature and risks of the processing, as required by Article 32. The measures in place at the date of this DPA are in Annex B. Shelfprice may update them provided it does not reduce the overall level of protection.

• General authorization. The Customer allows Shelfprice to use the sub-processors in Annex C, and to appoint others under this section.
• Notice and objection. Shelfprice will tell the Customer at least [SUB-PROCESSOR NOTICE DAYS] days before a new or replacement sub-processor handles Customer Personal Data (by email to the workspace owner, or by updating Annex C and notifying the owner). The Customer may object on reasonable data protection grounds within [OBJECTION PERIOD DAYS] days. We will then work with the Customer in good faith to find a solution; if none is found, the Customer may end the affected part of the Service and receive a refund of prepaid fees for it.
• Flow-down and responsibility. Shelfprice will bind each sub-processor by a written contract with data protection obligations no less protective than this DPA, and remains responsible to the Customer for each sub-processor’s performance of them.

• Data subject requests. If a data subject asks Shelfprice for access, correction, erasure, restriction, portability or to object about Customer Personal Data, Shelfprice will not answer except to refer the person to the Customer, and will pass the request to the Customer promptly. Taking into account the nature of the processing, Shelfprice will help the Customer to answer such requests, with the Service’s features where it can and otherwise on reasonable request.
• Other help. Shelfprice will give reasonable help with the Customer’s duties on security, breach notification, data protection impact assessments and prior consultation (Articles 32 to 36), considering the information it holds.

Shelfprice will tell the Customer without undue delay, and in any case within [BREACH NOTICE HOURS] hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice goes to the workspace owner’s email address and will say, as far as then known:

1. what happened and when it was found;
2. the kinds and approximate numbers of people and records affected;
3. the likely consequences;
4. what Shelfprice has done and will do to contain and fix it, and what it suggests the Customer do.

Shelfprice will give more detail as it learns it, and will help the Customer to meet its duty to notify a regulator and the people affected. A notice is not an admission of fault.

When the agreement ends, or earlier on the Customer’s written request, Shelfprice will, at the Customer’s choice, return Customer Personal Data in a common format or delete it. The Customer must ask within [DATA RETURN WINDOW DAYS] days of the agreement ending; if it does not, Shelfprice will delete it. Deletion happens within [DELETION PERIOD DAYS] days, except that Shelfprice may keep what law requires it to keep, and copies in backups, which it will not use and will delete when the backups expire ([BACKUP RETENTION PERIOD]). Shelfprice will confirm deletion in writing on request.

For the reviewer: There is no one-click export or self-service deletion in the product today (open point 6).

Shelfprice will give the Customer the information it reasonably needs to check that Shelfprice is meeting Article 28, including answers to a reasonable security questionnaire once a year and this DPA’s Annexes.

If that is not enough, or a regulator requires it, the Customer (or an independent auditor bound by confidentiality, not a competitor of Shelfprice) may audit Shelfprice’s processing of Customer Personal Data once a year, or after a breach, on [AUDIT NOTICE DAYS] days’ notice, in working hours, without disturbing its business, and at the Customer’s cost. Audits cover Shelfprice’s own systems and records, not other customers’ data. Shelfprice may satisfy an audit request with an independent report if it holds one.

• Location. Shelfprice is in the United Kingdom. Its sub-processors process Customer Personal Data in the United States (Annex C), region [HOSTING REGION].
• UK personal data. Where Customer Personal Data subject to the UK GDPR goes to a sub-processor outside the UK, Shelfprice will make sure the transfer is lawful: under the UK-US data bridge where the sub-processor is certified to it, or otherwise under the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, which are incorporated here when needed.
• EU personal data. Where Customer Personal Data subject to the EU GDPR is transferred to Shelfprice in a country without an adequacy decision, the EU standard contractual clauses (Commission Implementing Decision (EU) 2021/914), Module Two (controller to processor), are incorporated: Annex A is their Annex I, Annex B their Annex II, Annex C their list of sub-processors; the Customer is the exporter and Shelfprice the importer; option 7 (docking clause) is omitted; Clause 9(a) option 2 (general authorization) with the notice period in section 6; Clause 11(a) optional wording is omitted; Clause 17 option 1 and Clause 18(b) name the law and courts of Ireland [TO CONFIRM]; and the competent supervisory authority is that of the exporter’s establishment. The UK is currently covered by an EU adequacy decision, so these clauses apply only if that ends or the Customer’s data is sent to a country that has none.
• Other countries. Shelfprice will follow any other transfer mechanism that Data Protection Law requires, and the Customer will tell us if it applies.

For the reviewer: The transfer picture is a judgment call (open point 4). I have not confirmed which mechanism each sub-processor relies on.

Each party’s liability under this DPA is subject to the limits and exclusions in the Terms of Service, which apply to this DPA as if set out here, except where the law, or the standard contractual clauses, does not allow it. Nothing here limits a data subject’s rights against either party.

• This DPA starts when the agreement starts and ends when Shelfprice has returned or deleted all Customer Personal Data.
• If this DPA conflicts with the Terms of Service or an order form about personal data, this DPA wins. If it conflicts with the standard contractual clauses, the clauses win.
• Shelfprice may change this DPA to follow a change in law or a regulator’s guidance, on notice to the workspace owner, and the Customer may object as section 6 describes for sub-processors.
• It is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction, as in the Terms of Service, except where the standard contractual clauses say otherwise.
• Questions or a signed copy: [CONTACT / DPO EMAIL].

These are the measures in the product at the date at the top of this page. They are described as they are; none is overstated.

Access and authentication

• Every page, export, action and scheduled email is authorized on the server for the user and organization. A customer sees only its own workspace and the categories it is entitled to.
• Passwords are stored only as one-way bcrypt hashes. Sign-in links are single-use, expire in 24 hours and are stored as hashes. Sessions are signed, encrypted tokens in a cookie that page scripts cannot read.
• Only a workspace owner can invite or remove users. The staff role is held in the database or a server allowlist, never set from the browser.
• Staff view customer workspaces read-only, only through a logged support session (who, which organization, why, when, pages opened).

Network and data

• The application is served over HTTPS and talks to its database over the host’s private network.
• Production and development use separate databases, and the development login cannot open production.
• Scheduled jobs call the server with a secret key; secrets are held in environment settings, not in code.
• Backups and encryption at rest are provided by the host (backup retention [BACKUP RETENTION PERIOD]) [TO CONFIRM].

Organizational

• Changes are made through version control and deployed automatically from it.
• Breach handling follows section 8.

Not in place today

Two-factor sign-in, independent certification (SOC 2, ISO 27001) and independent penetration testing are not in place. This list will be updated when they are.

Sub-processors authorized at the date at the top of this page for Customer Personal Data:

Services that receive no Customer Personal Data

These are not sub-processors. They are listed for completeness.

Stripe, our payment processor, is listed above: it holds card and payment details, which we never see.