Data processing agreement

1. Subject matter and duration

Growstall processes personal data of the Controller's marketplace customers so the Controller can read and answer customer conversations, track response times, and understand where its customer contact comes from. Processing lasts for the term of the service and ends when the workspace is deleted or the marketplace is disconnected.

2. Nature and purpose

Reading conversations and orders from the Controller's marketplace accounts through the marketplace's API; storing the fields listed in Annex 1; computing SLA deadlines; classifying, translating and drafting text with an AI model on redacted content; sending replies and acknowledgements that the Controller writes or enables; producing aggregate reports for the Controller. No processing for Growstall's own purposes beyond running, securing and improving the service in aggregate.

3. Controller's instructions

Growstall processes personal data only on the Controller's documented instructions: these terms, the settings the Controller chooses in the product, and any written instruction sent to hello@growstall.com. If an instruction would in Growstall's view breach data protection law, Growstall tells the Controller before acting. The Controller confirms it is entitled to connect the marketplace accounts it connects and that it has a lawful basis for the processing.

4. Confidentiality and personnel

Only personnel who need access to provide the service have it, under a duty of confidentiality, and only through the product or audited administrative tools. There is no routine human review of conversation content.

5. Security

Growstall implements the measures in Annex 2 and keeps them at least at that level, updating them as the state of the art moves.

6. Sub-processors

The Controller authorises the sub-processors listed on the sub-processors page (Annex 3), each bound by written terms at least as protective as this agreement. Growstall gives 30 days' notice by email before adding or replacing one; the Controller may object on reasonable data protection grounds, in which case the parties work in good faith on a solution and, failing one, the Controller may terminate the affected part of the service without penalty.

7. International transfers

Data is stored and processed in the United Kingdom. Where a sub-processor processes data outside the UK or the EEA (today: Google and TypeSafe in the United States for AI features on redacted text; Postmark in the United States for inbound e-mail on the Amazon and OTTO channels; Stripe, Resend and Ship24 as listed on the sub-processors page), the transfer relies on the European Commission's standard contractual clauses and the UK International Data Transfer Addendum incorporated in that sub-processor's terms, together with the redaction described in Annex 2. The Controller may disable AI features at any time, which ends that transfer.

8. Assistance

Growstall helps the Controller respond to data subject requests: on request it locates, exports or deletes a customer's conversations and orders within 30 days, and provides the information in Annex 1 for the Controller's records of processing, data protection impact assessments and consultations with a supervisory authority.

9. Personal data breach

Growstall notifies the Controller without undue delay and no later than 48 hours after becoming aware of a personal data breach affecting the Controller's data, with the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Growstall keeps the Controller updated as facts develop.

10. Deletion and return

Data is deleted automatically at the end of the Controller's retention window. On disconnection of a marketplace, all data imported from it is deleted immediately. On termination, the workspace is deleted within 30 days and backups expire within a further 30 days. Before deletion the Controller may export its data on request in a machine-readable format.

11. Audit

Once a year, or after a breach, the Controller may ask for the information needed to demonstrate compliance with this agreement, including current security documentation and sub-processor terms, and may carry out an audit, by itself or a mandated auditor bound by confidentiality, at reasonable notice, during business hours, without disrupting the service and at its own cost.

12. Liability

Each party's liability under this agreement is subject to the limitations in the terms of service, except where data protection law does not permit a limitation.

Annex 1: Details of processing

Annex 2: Technical and organisational measures

• Encryption in transit (TLS 1.2+) and at rest (provider-managed disk encryption); marketplace API keys additionally encrypted with AES-256-GCM under a key held only in the application environment.
• Tenant isolation enforced in the database by row-level security on every table; service credentials used only by the sync worker and server actions, never exposed to browsers.
• Data minimisation at ingestion: raw marketplace payloads are discarded; only the fields in Annex 1 are stored. Attachments are streamed, not stored.
• Redaction before any AI call: email addresses, phone numbers, IBANs, UK and EU postcodes, street lines and known names are replaced with placeholders; order context limited to status, carrier and item names.
• Automated deletion by retention window; cascade deletion on disconnection or workspace deletion.
• Outbound automation gated by conservative rules and a per-run circuit breaker; every send is logged on the conversation.
• Least-privilege infrastructure accounts, no shared credentials, dependency and platform updates applied regularly, provider-side backups with limited retention.

Annex 3: Sub-processors

The current list, with locations and purposes, is maintained on the sub-processors page.