Data Processing Agreement
Last updated: October 3, 2026
This Data Processing Agreement ("DPA") forms part of the Terms of Service between you, the customer ("Controller"), and ProfitClerk ("Processor"), and applies where we process personal data on your behalf in providing ProfitClerk. It is intended to meet Article 28 of the EU GDPR and the UK GDPR. By accepting the Terms you accept this DPA; no signature is needed.
1. Details of the processing
- Subject matter and duration: providing the Service, for as long as your account exists and until the data is deleted as described below.
- Nature and purpose: hosting, storing, syncing, calculating and displaying your sales, stock and accounting data, and sending summaries to services you connect.
- Personal data: names, delivery addresses, eBay user names, order details and returns (the reason and the buyer's comments) of your buyers; names and email addresses of your team members; any personal data you enter in notes, expenses or mileage.
- Data subjects: your buyers, your team members, and other people whose data you add.
- No special categories of personal data are intended to be processed.
2. Our obligations
We will:
- process the personal data only on your documented instructions, which are the Terms, this DPA and your use of the Service's features, unless the law requires otherwise (in which case we will tell you, unless the law forbids it);
- make sure everyone authorised to process the data is bound by confidentiality;
- keep appropriate technical and organisational security measures, including encryption in transit, encrypted storage of access tokens, hashed passwords, access controls, two-step sign-in, backups and logging;
- help you, as far as reasonably possible, to respond to requests from data subjects and to meet your obligations on security, breach notification, impact assessments and consultations with authorities;
- tell you without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting your data, with the information you need to meet your own obligations;
- at the end of the Service, delete the personal data (you can export it first), unless the law requires us to keep it;
- make available the information needed to show we meet this DPA and allow for reasonable audits, normally by providing documentation and answers to your questions, with at least 30 days' notice for anything more.
3. Sub-processors
You authorise us to use the sub-processors listed in section 4 of our Privacy Policy. We bind each of them to data protection terms at least as protective as this DPA and remain responsible for them. We will update that list before adding or replacing a sub-processor; if you object on reasonable data protection grounds, you may end the affected part of the Service and receive a refund of any prepaid, unused period.
4. International transfers
Where personal data is transferred outside the UK or the European Economic Area, we make sure it is protected by an adequacy decision or the Standard Contractual Clauses (with the UK Addendum where relevant), which are incorporated into this DPA by reference.
5. Your obligations
You are responsible for having a lawful basis to collect the personal data and share it with us, for giving data subjects the information the law requires, and for the instructions you give us.
6. Liability and order of precedence
The limits of liability in the Terms apply to this DPA. If this DPA and the Terms conflict on data protection, this DPA prevails.
7. Contact
ProfitClerk, . · Data protection: [email protected]