Data processing agreement (DPA)

1. Subject

The operator of ShopDesk (processor) processes customers' order and case data on behalf of the Merchant (controller) under Article 28 GDPR.

2. Processor obligations

• Act only on the Merchant's documented instructions.
• Staff bound by confidentiality; role-based access; support sign-in only with a reason, audited, with masked customer data.
• Appropriate technical and organisational measures (encryption, 2FA, audit log, daily backups, recovery runbook).
• Subprocessors only from the published list; 30 days' notice of changes.
• Support for data subject requests through export and anonymisation features.
• Breach notification within 48 hours.
• Export and then deletion of data within 30 days after termination.

3. Transfers

Data is stored and processed within the EU. Transfers to third countries only with appropriate safeguards.

4. Audit

The Merchant may audit the processor once a year with prior arrangement or request a compliance statement.