Data Processing Addendum

Last updated: 07 November 2020

A data processing addendum is a contract between you and us, outlining how data is processed and what both our responsibilities are.

This Data Processing Addendum forms part of the Terms of Service and is between Us, TiliShop Ltd (Processor) and You, the Merchant (Controller).

1. Terms and Expressions

The terms and expressions set out in this Addendum shall have the following meanings:

1.1 Data Protection Legislation: (i) unless and until the GDPR is no longer directly applicable in the UK, the General Data Protection Regulation ((EU) 2016/679) and any national implementing laws, regulations and secondary legislation, as amended or updated from time to time, in the UK and then (ii) any successor legislation to the GDPR or the Data Protection Act 2018;

1.2 “Controller”, “Processor”, “Processing” and “Data Subject” shall have the meanings given to them in the Data Protection Legislation;

1.3 ICO means the Information Commissioner’s Office;

1.4 Personal Data means all such “personal data” as defined in the Data Protection Legislation as is, or is to be, processed by the Processor on behalf of the Controller;

1.5 Services means those described in Schedule 1 which are provided by the Processor to the Controller and which the Controller uses for the purposes described in Schedule 1.

1.6 “Security Measures” means the security measures set out in Schedule 2.

1.7 Clause, Schedule and paragraph headings shall not affect the interpretation of this Addendum.

1.8 A person includes a natural person, corporate or unincorporated body (whether or not having separate legal personality).

1.9 The Schedules form part of this Addendum and shall have effect as if set out in full in the body of this Addendum. Any reference to this Addendum includes the Schedules.

1.10 A reference to a company shall include any company, corporation or other body corporate, wherever and however incorporated or established.

1.11 Unless the context otherwise requires, words in the singular shall include the plural and in the plural shall include the singular.

Unless the context otherwise requires, a reference to one gender shall include a reference to the other genders.

It Is Agreed as follows:

2. Scope of Processing

2.1. The Controller determines the purposes and means of the processing of Personal Data. The Controller shall comply with its obligations pursuant to Data Protection Legislation, including responsibility to ensure necessary legal basis for collecting, processing and transfer of Personal Data.

2.2. The terms of this Addendum supersede any other arrangement, understanding or agreement made between the Parties at any time relating to protection of Personal Data.

2.3. This Addendum concerns the Processor’s processing of Personal Data on behalf of the Controller in connection with the Processor’s provision of the Services or otherwise as described in Schedule 1.

2.4. The nature and the purpose of the processing, including operations and activities, are specified in Schedule 1 but the Processor is only to carry out the Services, and only to process Personal Data received from the Controller:

for the purposes of those Services and not for any other purpose;
to the extent and in such manner as is necessary for those purposes; and
in accordance with the Controller’s instructions to provide the Services.

2.5. The Processor, its Sub-processors, and other persons acting under the authority of the Processor who has access to the Personal Data shall process the Personal Data only on behalf of the Controller and in compliance with its instructions and in accordance with this Addendum, unless otherwise stipulated in applicable statutory laws.

2.6. The Processor shall inform the Controller if, in the Processor’s opinion, an instruction infringes the Data Protection Legislation.

2.7. The Processor shall promptly comply with any request from the Controller requiring the Processor to amend, transfer or delete the Personal Data.

2.8. The Processor agrees to comply with any reasonable measures required by the Controller to ensure that its obligations under this Addendum are satisfactorily performed in accordance with the Data Protection Legislation and all applicable legislation from time to time in force and any best practice guidance issued by the ICO.

2.9. Where the Processor processes Personal Data (whether stored in the form of physical or electronic records) on behalf of the Controller it shall:

2.9.1 not process the Personal Data outside the European Union or the United Kingdom without the prior written consent of the Controller and, where the Controller consents to such a transfer, to comply with the transfer obligations of Chapter V of the Data Protection Legislation;
2.9.2 process the Personal Data only to the extent, and in such manner, as is necessary in order to comply with its obligations to the Controller or as is required by law or any regulatory body including but not limited to the ICO;
2.9.3 implement appropriate technical and organisational measures and take all steps necessary to protect the Personal Data against unauthorised or unlawful processing and against accidental loss, destruction, damage, alteration or disclosure, and promptly supply details of such measures as requested from the Controller; and
2.9.4 any transfer of Personal Data is subject to the Data Protection Legislation’s standard contractual clauses or other legal basis for such transfer or disclosure.

2.10. On at least 14 days’ prior notice, the Processor shall permit persons authorised by the Controller to audit the Processor’s processes relating to the processing of the Personal Data.

2.11. The Processor shall notify the Controller (within two working days) if it receives:

2.11.1 a request from a data subject to have access to that person’s Personal Data; or
2.11.2 a complaint or request relating to the Controller’s obligations under the Data Protection Legislation.

2.12. The Processor agrees to provide the Controller with co-operation and assistance in relation to any complaint or request made.

2.13. notify the Controller immediately if it becomes aware of any unauthorised or unlawful processing, loss of, damage to or destruction of any of the Personal Data.

3. Security Measures

3.1. The Processor shall implement appropriate technical and organisational to ensure an appropriate level of security of the Personal Data.

3.2. The Processor shall provide reasonable assistance to the Controller, taking into account relevant information available to the Processor, if the Controller is obliged to perform an impact assessment and/or consult ICO in connection with the processing of Personal Data. The Controller shall bear any costs accrued by the Processor related to such assistance.

4. Notification of any Breach

4.1. The Processor shall notify the Controller without undue delay after becoming aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored or otherwise processed (“Personal Data Breach”). The Controller is responsible for notifying the Personal Data Breach to the ICO within 72 hours of any such breach.

4.2. The notification to the Controller shall as a minimum describe (i) the nature of the Personal Data Breach including where possible, the categories and approximate number of Data Subjects concerned and the categories and approximate number of Personal Data records concerned; (ii) the likely consequences, in the reasonable opinion of the Processor, of the Personal Data Breach; (iii) the measures taken or proposed to be taken by the Processor to address the Personal Data Breach, including, where appropriate, measures to mitigate its possible adverse effects.

4.3. In the event the Controller is obliged to communicate a Personal Data Breach to the Data Subjects, the Processor shall assist the Controller, including the provision, if available, of necessary contact information to the affected Data Subjects. The Controller shall bear any costs related to such assistance provided by the Processor and to such communication to the Data Subject. The Processor shall nevertheless bear such costs if the Personal Data Breach is caused by circumstances for which the Processor is responsible.

5. Sub-Processing

5.1. The Controller hereby gives its consent for the Processor to engage other processor (“Sub-processors”) as described in Schedule 3. The Processor shall inform the Controller of any intended changes concerning addition of replacement of any Sub-processors, and the Controller has the right to object to such changes within 30 days of any such notification.

5.3. The Processor shall ensure that its data protection obligations set out in this Addendum and the Data Protection Legislation are imposed to any Sub-processors by way of a written agreement. Any Sub-processor shall in particular provide sufficient guarantees to implement appropriate technical and organisational measures to comply with Data Protection Legislation. The Processor shall remain fully liable to the Controller for the performance of any Sub-processor.

6. Warranties and Indemnities

6.1. Each party warrants to the other that it will process the Personal Data in compliance with this Addendum and in accordance with the Data Protection Legislation.

6.2. The Parties shall each be liable for and shall indemnify (and keep indemnified) each other against each and every action, proceeding, liability, cost, claim, loss, expense (including reasonable legal fees and disbursements on a solicitor and client basis) and demand incurred by the other which arise directly or in connection with any data processing activities which are subject to this Addendum.

7. Confidentiality

7.1. The Processor shall maintain the Personal Data processed by the Processor on behalf of the Controller in confidence, and in particular, unless the Controller has given written consent for the Processor to do so, the Processor shall not disclose any Personal Data supplied to the Processor by, for, or on behalf of, the Controller to any third party. The Processor shall not process or make any use of any Personal Data supplied to it by the Controller otherwise than in connection with the provision of the Services to the Controller.

7.2. The Controller is subject to a duty of confidentiality regarding any documentation and information, received by the Processor, related to the Processor’s and its Sub-processors’ implemented technical and organisational security measures.

7.3. The obligations in this Clause 7 shall continue for a period of five years after the cessation of the provision of Services by the Processor to the Controller. Nothing in this Addendum shall prevent either party from complying with any legal obligation imposed by the ICO or a court. Both parties shall however, where possible, discuss together the appropriate response to any request from the ICO or court for disclosure of information.

8. Term and Termination

8.1. This Addendum is valid for as long as the Processor processes Personal Data on behalf of the Controller.

8.2. The Processor shall, upon the termination of this Addendum and at the choice of the Controller, delete or return all the Personal Data to the Controller, unless otherwise stipulated otherwise in the Data Protection Legislation. The Processor shall document in writing to the Controller that deletion has taken place.

9. General

9.1. This Addendum may only be amended by the Parties subject to mutual consent and in accordance with the Data Protection Legislation.

9.2. The Processor shall not sub-contract to any third party any of its rights or obligations under this Addendum save for where permitted by the Parties under this Addendum.

9.3. The Processor accepts the obligations in this Addendum in consideration of the payment of £1 from the Controller which the Processor hereby acknowledges.

9.4. Except as expressly provided in this Addendum, the rights and remedies provided under this Addendum are in addition to, and not exclusive of, any rights or remedies provided by law.

9.5. This Addendum shall be governed by the laws of England and Wales and subject to the exclusive jurisdiction of the courts of England and Wales.

Schedule 1 – Services, Processing, Personal Data, and Data Subjects

1. Services

The “Services” referred to in Sub-Clause 1.5 means the Services as defined in the Terms of Service.

The Controller uses the Services to manage its online store(s).

2. Processing

The Personal Data will be subject to the following basic processing activities:

Storage of the Controller’s customers personal data as is necessary to provide the Services

3. Personal data

The Personal Data processed concern the following type and categories:

Name
Email address
Phone number
Shipping address
Billing address
Payment details
Other categories as may be necessary for the provision of Services

4. Data subjects

The Personal Data processed concern the following categories of Data Subjects:

Controller’s customers
Controller’s employees
Other categories as may be necessary for the provision of Services

Schedule 2 – Security Measures

The following are the Security Measures referred to in Sub-Clauses 1.6:

1. The Processor will ensure that in respect of all Personal Data it receives from or processes on behalf of the Controller it maintains security measures to a standard appropriate to:

1.1 the harm that might result from unlawful or unauthorised processing or accidental loss, damage or destruction of the Personal Data; and
1.2 the nature of the Personal Data.