DRAFT for legal review. Not for production use. Replace every
[BRACKETED]placeholder and have qualified counsel approve this document before publishing version 1.0. It is intended to meet UK/EU GDPR Article 28(3).
Livesales Data Processing Agreement
This Data Processing Agreement ("DPA") forms part of the Livesales Terms of Service between [LEGAL ENTITY NAME] ("Processor") and the Customer ("Controller"). It applies when the Processor processes personal data in Customer Data on the Controller's behalf.
1. Details of the processing
| Subject matter and duration | Provision of the Service, for the subscription term plus the deletion period in section 9 |
| Nature and purpose | Hosting, storing, organising, retrieving and transmitting data so that the Controller can run point-of-sale, inventory, purchasing, accounting, reporting and messaging features |
| Categories of data subjects | The Controller's customers, suppliers, employees and drivers, and its Users |
| Types of personal data | Names, contact details (email, phone, address), transaction and order history, employment records entered by the Controller, vehicle and fuel records, and message content sent through integrations |
| Special category data | Not intended. The Controller must not enter special category data unless agreed in writing. |
2. Instructions
The Processor processes personal data only on the Controller's documented instructions. These Terms and the Controller's use and configuration of the Service are those instructions. The Processor will tell the Controller if it believes an instruction breaks data protection law.
3. Confidentiality
Everyone authorised to process the personal data is bound by confidentiality.
4. Security (Article 32)
The Processor maintains appropriate technical and organisational measures, including:
- logical isolation of each Customer's data, enforced on every query;
- encryption in transit (TLS), and at rest for credentials and secrets;
- role-based access control with least privilege;
- multi-factor authentication for platform administrators;
- audit logging without secrets;
- rate limiting;
- backups and tested restoration;
- vulnerability management.
[Attach or reference the full security measures annex.]
5. Sub-processors
The Controller gives general authorisation for the sub-processors listed at /legal/subprocessors. The Processor will give at least [30] days' notice of any new sub-processor, and the Controller may object on reasonable grounds. The Processor imposes data protection terms on each sub-processor that are equivalent to this DPA, and remains liable for them.
6. Data subject rights
Taking into account the nature of the processing, the Processor will help the Controller respond to requests from data subjects (access, rectification, erasure, restriction, portability and objection). It will do this through Service features, such as data export and record deletion, and otherwise on request. Requests the Processor receives directly are forwarded to the Controller without undue delay.
7. Personal data breaches
The Processor will notify the Controller without undue delay, and in any case within [48] hours, after becoming aware of a personal data breach affecting the Controller's data. It will provide the information the Controller reasonably needs to meet its own notification obligations.
8. Assistance and audits
The Processor will help the Controller with data protection impact assessments and prior consultations, where they relate to the Service. It will make available the information needed to demonstrate compliance with this DPA, and will allow and contribute to audits on reasonable notice, at the Controller's cost and no more than once a year unless there is a breach.
9. Return and deletion
At the end of the Service, the Controller can export its data for [30] days. After that, the Processor deletes the personal data, and purges it from backups within [90] days, unless the law requires it to be kept.
10. International transfers
Personal data is transferred outside the UK or EEA only with appropriate safeguards (adequacy, or Standard Contractual Clauses / the UK Addendum), which are incorporated by reference where they apply.
11. Order of precedence
If this DPA conflicts with the Terms on data protection matters, this DPA prevails.