Data Processing Agreement

• The Customer is the controller: it decides what personal data is processed in Ops2Sell and why.
• GIETO Group LTD, registered in England and Wales, company number 12065876, registered office 2 Provident Place, Empson Road, Peterborough PE1 5UU, United Kingdom is the processor: it processes the data only on the Customer's behalf and instructions.

This agreement forms part of the Terms of Service. It applies for as long as we provide the Service and until the data is deleted after the agreement ends. A signed copy is available on request.

We process personal data only to provide the Ops2Sell service: to receive orders from the Customer's sales channels, manage stock and the warehouse, prepare shipments, invoices and reports, and provide support.

• The Customer's buyers: names, delivery and billing addresses, e-mail addresses, phone numbers, order contents and history, invoice details (including company and VAT numbers where given), buyer notes.
• The Customer's staff and other users: names, e-mail addresses, roles, sign-in and activity logs.
• Contacts at the Customer's suppliers and partners: names, e-mail addresses, phone numbers.

We do not process special category data (such as health data) — please do not put it into the system.

We:

• process data only on the Customer's documented instructions — this agreement and the Customer's actions in the system (such as connecting a sales channel or carrier) — and tell the Customer straight away if we believe an instruction breaks data protection law;
• make sure staff who process the data are bound by confidentiality;
• apply the security measures below;
• help the Customer respond to data subject requests — most can be handled directly in the system (search, export, correction);
• help the Customer meet its obligations under Articles 32–36 (security, breach notification, data protection impact assessments);
• delete or return the data when the agreement ends, as described below;
• provide the information needed to show compliance with this agreement and allow for audits — arranged in advance, no more than once a year and at the Customer's cost.

• All connections to the system are encrypted (HTTPS/TLS).
• Sales channel and carrier credentials (API keys, passwords) are encrypted at rest with AES-256-GCM.
• Each customer's data is kept separate — a customer sees only its own data.
• Two-factor sign-in (authenticator app) available to every user, made mandatory for a customer's administrators once they have set it up; roles and permissions for every user.
• An audit log of who changed what, and when.
• Daily database backups, kept for 7 days.
• The database and files are stored in London (UK).

The Customer gives general authorisation for the sub-processors listed below. Each is bound by its data processing terms, with data protection obligations no less protective than those in this agreement.

We give at least 30 days' notice by e-mail of a new or replacement sub-processor. The Customer may object on reasonable grounds; if we cannot agree, the Customer may end the agreement before the change.

Systems you connect yourself (such as marketplaces, WooCommerce, carriers or accounting software) are not our sub-processors: data goes to them on your instruction and under your own agreements with them.

• GIETO Group LTD is based in the United Kingdom and the database and files are stored in London. For customers in the EU, the European Commission has recognised the UK as providing adequate protection (adequacy decision renewed to December 2031).
• Where a provider processes data in the United States (for example, Google's sign-in service), transfers rely, where applicable, on the EU–US Data Privacy Framework and its UK Extension, or on standard contractual clauses / the UK International Data Transfer Addendum.

If we become aware of a breach affecting Customer data, we notify the Customer without undue delay, and in any event within 72 hours. The notice says what happened, which data is affected, the likely consequences and what we have done about it.

The Customer can export its data at any time. After the agreement ends, the data is deleted after 30 days unless the Customer asks for earlier deletion. It leaves backups within 7 days. We keep only what the law requires us to keep.

Liability under this agreement follows the Terms of Service, except where data protection law says otherwise.

Data protection questions: privacy@ops2sell.com.