1. Parties and scope
This Data Processing Agreement ("DPA") is between the customer who accepts our Terms of Service ("you", the controller) and WaveSync NY LLC, registered in New York, United States ("we", the processor). It meets Article 28 of the UK GDPR and the EU GDPR. If this DPA and the terms disagree about personal data, this DPA wins.
2. Details of the processing
| Subject matter and purpose | Providing the Merchvio service: storing and processing orders, stock, purchasing, accounting, support, team and staff records for your business. |
|---|---|
| Duration | For as long as you have a workspace, plus the export and deletion periods in section 10. |
| Nature of processing | Storage, retrieval, organisation, calculation, transmission to the channels you connect, backup and deletion. |
| People the data is about | Your buyers and their delivery contacts, your suppliers' contacts, your staff and contractors, and the people you let use the workspace. |
| Types of personal data | Names, postal addresses, email addresses, phone numbers, order and return details, messages, staff records including pay where you enter it, and sign-in records. We ask you not to enter special category data unless you need to and have a lawful basis. |
3. Your instructions
We process personal data only on your documented instructions, which are these terms, your settings and your use of the service, unless the law requires otherwise; in that case we will tell you first unless the law forbids it. We will tell you if we think an instruction breaks data protection law.
4. Confidentiality
Everyone at WaveSync NY LLC who can access personal data is bound by confidentiality and accesses it only when needed to run or support the service.
5. Security
We keep appropriate technical and organisational measures in place to protect personal data, including a separate database and encryption key for each workspace, encryption at rest and in transit, access controls with two-step sign-in, a tamper-evident audit log and encrypted backups. They are described on our security page, which forms Annex 2 of this DPA. We may improve them but will not reduce the overall level of protection.
6. Sub-processors
You give us general authorisation to use sub-processors. The current list is on our sub-processors page (Annex 3). We will give you at least 30 days' notice by email to the workspace owner before adding or replacing a sub-processor. If you object on reasonable data protection grounds, tell us within that time; if we cannot address your objection, you may cancel and we will refund any prepaid time you have not used. We impose data protection terms on each sub-processor that are as protective as this DPA, and we remain responsible for their work.
7. Helping you meet your duties
The service lets you find, correct, export and delete the personal data in your workspace yourself. If you need more help to answer a request from a data subject, or with a data protection impact assessment or consultation with a regulator, we will help where it is reasonable. If a data subject contacts us directly about your data, we will pass the request to you.
8. Personal data breaches
If we become aware of a breach affecting personal data in your workspace, we will tell you without undue delay and in any case within 48 hours. We will tell you what happened, what data and people are likely to be affected, what we are doing about it and who to contact, and keep you updated as we learn more.
9. International transfers
Where personal data is transferred outside the UK or the European Economic Area to a country without an adequacy decision, the European Commission's Standard Contractual Clauses (module two or three as relevant) and the UK International Data Transfer Addendum are incorporated into this DPA by reference, or we rely on the recipient's certification under the EU-US Data Privacy Framework and its UK Extension.
10. Deletion and return
You can export your data at any time. When your subscription ends you can still sign in and export for 30 days. After that we delete the workspace, its database, its files and its encryption key within 30 days, except where the law requires us to keep something. Copies in encrypted backups are overwritten in the normal backup cycle.
11. Information and audits
We will give you the information you reasonably need to show that this DPA is being followed. If that is not enough, you may audit us, or have an independent auditor bound by confidentiality do so, once a year with at least 30 days' notice, during business hours and at your cost, in a way that does not put other customers' data at risk.
12. General
Liability under this DPA is subject to the limits in the Terms of Service, except where the law does not allow it. This DPA ends when we have deleted your data. The governing law is the same as in the Terms of Service, unless data protection law requires the law of the UK or an EU member state for the Standard Contractual Clauses.
Annex 1 is section 2 above. Annex 2 is our security page. Annex 3 is our sub-processors page.
Questions about this page? Email privacy@merchvio.com or write to WaveSync NY LLC.