Data Processing Agreement

1. Definitions

“Data protection law” means the UK GDPR, the UK Data Protection Act 2018, the EU GDPR and any other data protection law that applies to the processing. “Personal data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach” have the meanings in that law. “Service” has the meaning in the Terms.

2. What this DPA covers

This DPA does not cover data we use for our own purposes, such as account data, billing, fraud prevention and order records we keep for the law. We are the controller of that data, and the Privacy Policy explains it.

3. Your responsibilities

• You decide why your visitors’ data is processed, and you make sure you have a legal basis for it.
• You tell your visitors and buyers how you use their data, for example in your own privacy notice linked from your page.
• You get consent where the law needs it, for example before you connect Meta’s Conversions API, if the law where your visitors are requires consent for it.
• You give us only lawful instructions. Your settings in the Service are your instructions.

4. Our responsibilities

• We process the personal data only on your documented instructions, which are these Terms, this DPA and your settings, unless the law requires otherwise. If we think an instruction breaks the law, we tell you.
• Everyone at LoadFocus LTD who can access the data is bound to keep it confidential.
• We protect the data with the measures in section 5.
• We use sub-processors only as section 6 says.
• We help you answer requests from data subjects (section 7) and with your duties on security, breach notices and impact assessments, as far as the nature of the processing allows.
• We delete or return the data at the end of the Service (section 9).
• We give you the information you need to show that we meet Article 28, and we allow audits as section 10 says.

5. Security measures

• Encryption in transit: pages, the app and our APIs are served over HTTPS.
• Access: the database and session store accept connections only from our own servers and require a password. Only staff who need it for their work can reach production systems.
• Secrets: keys and passwords are kept in AWS Systems Manager Parameter Store, never in our code.
• Accounts: sign-in through Google; any stored password is hashed with bcrypt; sessions use secure, HTTP-only cookies.
• Abuse protection: rate limits on sign-in and sign-up, and checks that requests come from our own site.
• Data minimisation: buyer IP addresses are stored only as a shortened one-way hash; failed-payment card identifiers are kept for up to 48 hours.

We review these measures when the Service changes. The Security page explains how to report a vulnerability.

6. Sub-processors

You allow us to use these sub-processors for the data this DPA covers:

Each sub-processor is bound by a written contract with data protection terms at least as protective as this DPA. We stay responsible for them.

We tell you about a new sub-processor by email at least 30 days before it starts. You can object by email within that time, with your reasons. If we cannot address your objection, you can close your account and we refund any prepaid fees for the time you did not use.

7. Requests from data subjects

If a visitor or buyer asks us to access, correct or delete their data, we pass the request to you without delay and do not answer it ourselves, unless the law requires us to. You can email hello@more.you and we help you find, export or delete that person’s data.

8. Personal data breaches

If we become aware of a personal data breach affecting data under this DPA, we tell you without undue delay, and in any case within 48 hours. We tell you what happened, what data and how many people it affects, what we are doing about it and who you can contact. We send more details as we learn them.

9. Deletion at the end

When you close your account, your pages come down and we stop processing the data for you. We delete it within 90 days, unless the law requires us to keep it. Before you close your account, you can ask us at hello@more.you for a copy of your analytics and orders.

10. Information and audits

On request, we answer reasonable written questions about how we protect the data. If those answers are not enough to show that we meet this DPA, or a regulator asks for it, you can audit us once a year, with 30 days’ notice, during business hours, through an independent auditor bound by confidentiality. You pay for the audit.

11. International transfers

We are in the United Kingdom, and our servers are in the United States. When personal data from the UK or the European Economic Area goes to a country without an adequacy decision, we use a transfer mechanism the law recognises: the UK Extension to the EU–US Data Privacy Framework where the recipient is certified, or the EU standard contractual clauses with the UK Addendum.

Where you are in the European Economic Area and we receive personal data from you, the EU standard contractual clauses (module 2, controller to processor, or module 3 where you are yourself a processor) apply between you and us and form part of this DPA. Clause 7 does not apply, option 2 of clause 9 applies with the notice period in section 6, the optional wording in clause 11 does not apply, and clauses 17 and 18 choose the law and courts of Ireland. The annexes are sections 2, 5 and 6 of this DPA.

12. Liability, order of documents and law

The liability limits in the Terms apply to this DPA, except where data protection law does not allow them. If this DPA and the Terms disagree about personal data, this DPA applies. If the standard contractual clauses and this DPA disagree, the clauses apply.

This DPA is governed by the same law as the Terms, except where section 11 or data protection law says otherwise. We may update it to follow the law or changes to the Service, and we tell you by email before a change that reduces your protection.

13. Contact

Questions about this DPA: hello@more.you.