Data Processing Agreement

1. Parties and scope

This Data Processing Agreement (“DPA”) is between the seller (“Controller”) and OpenStock (“Processor”). It forms part of the Terms of Service and applies whenever we process personal data on the seller’s behalf. It is entered into automatically when a seller accepts the Terms; no signature is required.

It is intended to meet Article 28 of the EU General Data Protection Regulation (“GDPR”) and the UK GDPR. Terms such as “personal data”, “processing”, “controller”, “processor” and “data subject” have the meanings given in the GDPR. If this DPA conflicts with the Terms, this DPA prevails for the processing of personal data.

2. Details of the processing

• Subject matter: providing OpenStock to the Controller under the Terms.
• Duration: for as long as the Controller uses the Service, plus the deletion period in section 11.
• Nature and purpose: hosting stores; taking, delivering and recording orders; customer accounts; sending order emails; fraud checks; Discord and license delivery; analytics and support for the Controller.
• Data subjects: the Controller’s buyers, store visitors, store customers and team members.
• Categories of data: name, email address, Discord ID and username, IP address and country, order, delivery and payment-status records, store account data, support messages, and any data the Controller adds through custom fields.
• Special categories: none intended. The Controller must not use the Service to collect special category data or data about criminal convictions.

3. Processing on instructions

We process personal data only on the Controller’s documented instructions, which are the Terms, this DPA and the Controller’s configuration and use of the Service, unless EU or member-state law requires otherwise. In that case we will tell the Controller first unless that law forbids it. We will tell the Controller if we believe an instruction infringes data protection law.

4. Controller obligations

The Controller is responsible for having a lawful basis for the processing, giving buyers the information required by Articles 13 and 14 GDPR, obtaining any consent required (including for cookies and tools the Controller adds to its store), and ensuring its instructions comply with the law.

5. Confidentiality

We ensure that everyone authorized to process the personal data is bound by confidentiality and accesses it only as needed to provide the Service, support the Controller or meet a legal obligation.

6. Security

We implement appropriate technical and organizational measures under Article 32 GDPR, including:

• encryption of all data in transit with TLS;
• encryption of stored payment-provider credentials and wallet keys; one-way hashing of passwords;
• hosting in the EU, with the primary database at Supabase (AWS eu-west-1, Ireland);
• access control that limits each store’s data to that store’s authorized users, and least-privilege staff access;
• optional two-factor authentication, session management and rate limiting;
• managed backups and the ability to restore data;
• error monitoring and logging, and a process for handling vulnerabilities and incidents.

More detail is in our Security Policy. We may update these measures as long as the overall level of protection does not decrease.

7. Subprocessors

The Controller gives general authorization for us to use the subprocessors listed on our Subprocessors page. We impose data protection obligations on each subprocessor that are at least as protective as this DPA, and remain responsible for their performance. We will notify the Controller at least 14 days before adding or replacing a subprocessor. The Controller may object on reasonable data-protection grounds within that period; if we can’t resolve the objection, the Controller may terminate the affected Service and receive a refund of prepaid fees for the remaining period.

8. International transfers

We primarily process personal data in the EU. Where a subprocessor processes it outside the European Economic Area or the UK, we ensure the transfer is covered by an adequacy decision (including the EU–US Data Privacy Framework) or by the Standard Contractual Clauses adopted by Commission Decision (EU) 2021/914, with the UK Addendum where relevant, together with any supplementary measures needed.

9. Data subject requests and assistance

The Controller can view and manage its buyers’ data in the dashboard; where it can’t act on a request itself, we will do so on its instruction. If we receive a request directly from a data subject about the Controller’s data, we will pass it to the Controller and won’t respond ourselves except to redirect them.

Taking into account the nature of the processing, we will reasonably assist the Controller with data subject requests, data protection impact assessments and prior consultations with supervisory authorities.

10. Personal data breaches

We will notify the Controller without undue delay, and in any case within 48 hours of becoming aware of a personal data breach affecting its data. The notice will describe the nature of the breach, the data and data subjects concerned, its likely consequences and the measures taken, with further information as it becomes available. We will take reasonable steps to contain and remedy the breach. Notifying a breach is not an admission of fault.

11. Deletion and return

When the Service ends, the Controller can ask for a copy of its data within 30 days. After that we delete the personal data, and remove it from backups as they expire on their normal rotation, unless EU or member-state law requires us to keep it. Retained data stays protected by this DPA.

12. Audits

We will make available the information reasonably necessary to demonstrate compliance with this DPA, including answers to security questionnaires. If that information is not sufficient, or a supervisory authority requires it, the Controller may audit our compliance, at its own cost, with at least 30 days’ notice, during business hours, no more than once a year, and subject to confidentiality. An independent auditor may carry out the audit on the Controller’s behalf.

13. Liability

Each party’s liability under this DPA is subject to the limitations in the Terms, except where the GDPR does not allow liability towards data subjects to be limited.

14. Contact

Data protection questions and notices under this DPA: [email protected]. Notices to the Controller go to the email address on its account.