Data Processing Addendum

The seller determines the purposes and means of processing customer personal data entered into their storefront. SnapCatalog processes that data only to provide the service, on the seller's documented instructions, which include use of the product features as configured.

• Subject matter: hosting a catalog and processing orders.
• Duration: for as long as the seller's account is active, plus the retention periods in our Privacy Policy.
• Categories of data subjects: the seller's customers and the seller's own staff users.
• Categories of data: name, phone number, delivery address, order notes, order contents and totals, payment method and reference, technical/log data.
• No special-category data or payment card numbers are to be entered into free-text fields.

• Process only on the controller's instructions and not for our own unrelated purposes.
• Impose confidentiality obligations on personnel with access.
• Implement appropriate technical and organisational security measures (section 5).
• Assist the controller with data subject requests, DPIAs and regulator enquiries, at the controller's reasonable cost where the effort is substantial.
• Notify the controller without undue delay, and in any case within 72 hours of becoming aware, of a personal data breach affecting their data.

The seller authorises our use of sub-processors for hosting/database, transactional email and — where enabled — payment processing. We remain responsible for their performance and bind them to equivalent obligations. We will give reasonable notice before adding a new category of sub-processor, and the seller may object on reasonable data-protection grounds by terminating the affected service.

• Encryption in transit via TLS; encryption at rest at the storage layer.
• Row-level access rules so each seller can only access their own records.
• Password hashing, optional two-factor authentication and session revocation.
• Least-privilege service credentials and server-side verification of privileged actions.
• Logging and error monitoring, with access restricted to authorised personnel.

Where personal data is transferred out of the EEA, UK or another restricted region, the transfer relies on Standard Contractual Clauses or another lawful safeguard, which are deemed incorporated into this addendum.

On reasonable written request, and no more than once a year unless required by a regulator, we will provide information about our security practices sufficient to demonstrate compliance.

On termination we delete or anonymise customer personal data within 90 days, except where retention is required by law. Sellers can export their order data as CSV before closing an account. See the Privacy Policy for retention detail.