Data Processing Terms for Sellers

The Seller is the Data Fiduciary for Buyer Data. ShoperSite is the Data Processor and processes Buyer Data only to provide the Service to the Seller and on the Seller's documented instructions (which include the Seller's use of the Service's features).

• Process Buyer Data only to provide and secure the Service, and as the law requires.
• Keep Buyer Data confidential and limit access to people who need it and are bound by confidentiality.
• Use reasonable security safeguards, including encryption in transit, access controls that keep each shop's data separate, and encryption of sensitive credentials.
• Use sub-processors (currently Google Cloud / Firebase, Vercel and email delivery services) only under terms that protect the data at least as well as these.
• Tell the Seller without undue delay after becoming aware of a personal data breach affecting their Buyer Data, and help them meet their notification duties.
• Help the Seller respond to buyers' requests to access, correct or erase their data.
• Delete or return Buyer Data when the Seller closes their shop, except where the law requires us to keep it.

• Collect and use Buyer Data lawfully, for clear purposes, and give buyers a privacy notice (your shop's privacy policy).
• Send marketing only to buyers who agreed to it, and honour unsubscribes.
• Not export Buyer Data for unrelated purposes, or share or sell it to others without a lawful basis.
• Keep your account secure, and respond to buyers' data requests and grievances.
• Delete Buyer Data you've downloaded once it's no longer needed.