Data processing agreement

When this applies

This agreement forms part of the terms of service and applies whenever we process personal data on a merchant's behalf. It applies from the day an account is created. A separate signature is not required for these terms to apply.

It is intended to meet the requirements of Article 28 of the UK GDPR and Regulation (EU) 2016/679.

Roles

The merchant is the controller of its customers' personal data and determines the purpose, scope and retention of that processing.

Axicom is the processor. It processes that data on the merchant's instructions to provide catalogue, inventory, order and fulfilment services.

Axicom is the controller for merchant user account data needed to operate and secure the service. This processing is described on the privacy page.

A connected shop or marketplace is not our sub-processor. Connected channels are the merchant's own accounts under the merchant's own agreements, and data moves between them and Channekt on the merchant's instruction.

Processing scope

Subject matter	Providing Channekt: multi-channel catalogue, stock, order and fulfilment management
Duration	For as long as the account is active, plus the deletion window in Deletion and return
Nature of the processing	Collection from connected channels, storage, organisation, retrieval, consultation by the merchant's own staff, use to produce shipping and customs documents, transmission back to connected channels and to carriers, erasure
Purpose	Only to provide the service and to keep it secure and working
Categories of data subject	The merchant's customers, and the merchant's own staff
Categories of personal data	Name, email address, telephone number, billing and shipping address, the channel's own identifier for that person, and what they bought and for how much. For staff: name, email address, role, and their activity in the product
Special category data	Channekt does not request special category data. If a merchant enters it in a free-text field, it is processed under the same controls as other content in that field
Card and payment data	Channekt does not store payment card data. Channel payments are processed by the relevant shop or marketplace, and subscription payments use hosted checkout

Our instructions

We process personal data only on the merchant's documented instructions, including on transfers, unless we are required to do otherwise by law - in which case we tell the merchant before processing, unless the law forbids that on important grounds of public interest.

Product actions constitute instructions. Connecting a channel, importing orders, producing documents, exporting data and enabling features are documented instructions to perform the processing required by those actions. The agreement, terms and merchant-selected settings form part of those instructions.

Merchant data is not sold or used for advertising, unrelated analytics or model training by Axicom or its sub-processors.

If we think an instruction infringes data protection law, we will say so and may pause that instruction until it is resolved.

Confidentiality

Anyone authorised to access personal data is subject to contractual or statutory confidentiality obligations that continue after their involvement ends. Access is limited to personnel who require it to provide support or maintain the security and operation of the service.

Security

We take the measures required by Article 32. They are described on the security page and summarised in Annex II.

Sub-processors

The merchant gives general authorisation for us to engage the sub-processors listed on the sub-processors page, which is the authorised list for the purposes of this agreement.

We will give at least 30 days' notice before a new sub-processor starts handling a merchant's data or an existing one is replaced. A merchant may object within those 30 days on reasonable data protection grounds; we will try to offer a way to carry on without the change, and if there is none, the merchant may end the agreement for the affected part of the service without penalty and be refunded for what was paid and not used.

Every sub-processor is engaged under a written contract imposing obligations no weaker than these. We remain fully liable to the merchant for their performance.

Transfers out of the UK and EU

Core service data is hosted in the United Kingdom and European Union. Where a provider processes personal data outside the UK or EEA, the transfer is protected by an applicable adequacy decision or contractual safeguards, including the UK International Data Transfer Addendum and EU standard contractual clauses where required.

The current providers, purposes and processing areas are listed on the sub-processors page.

Compliance assistance

Requests from data subjects. Merchants can locate, review, export and erase customer data through the service. Requests received directly by Axicom are forwarded to the merchant without undue delay. Reasonable assistance is provided where the service does not support the required action directly.

Erasure. Requests received from supported channels are recorded before processing and automatically retried if incomplete. Identifying fields are removed while non-personal financial and inventory records are retained where required. Personal details are not written to operational logs during erasure.

Assessments. We give reasonable help with data protection impact assessments and prior consultations, taking into account what we know and what a processor can see.

Security and breach. Axicom provides reasonable assistance with obligations under Articles 32 to 36, including relevant access records, audit information and the details described in the next section.

Personal data breaches

We tell the affected merchant without undue delay and in any case within 24 hours of becoming aware of a personal data breach affecting their data. Notification is not delayed until the investigation is complete.

The notice describes, as far as we know it at the time:

• what happened and when, and when we became aware
• the categories and approximate number of people and records concerned
• the likely consequences
• what we have done to contain it and what we are doing next
• who to contact for more, and when the next update will come

Where complete information is not available within 24 hours, an initial notice is provided and supplemented as the investigation progresses.

The merchant remains responsible for notifying its customers and supervisory authority. Axicom provides the information reasonably required for those notifications and the applicable 72-hour deadline. The full procedure, including severity levels and the review that follows, is on the security page.

Deletion and return

At the end of the service, the merchant may request return or deletion of its data. A merchant can export its catalogue, orders and customers from the product at any time, including after cancellation and before the deletion window closes.

Unless the merchant asks otherwise, data is deleted 30 days after the account ends. Backups are not surgically edited: a deleted account's data remains inside encrypted database backups until those backups age out on their normal schedule, which is within 35 days. Deleted tenant data is not restored selectively from backups.

Records required by law are retained only for the applicable period and remain subject to this agreement.

Audits and information

We make available the information needed to show that these obligations are met. In the first instance that is this page, the security page, the sub-processors page and written answers to questions, including a completed security questionnaire.

A merchant, or an auditor they appoint who is not a competitor of ours, may audit us once in any twelve months, on 30 days' written notice, during working hours, without unreasonable disruption, and under confidentiality. More often if a regulator requires it or after a breach affecting their data. Each side bears its own costs for the first such audit in a year; we may charge reasonably for time spent on further ones.

Audits do not provide access to another merchant's data, staff personal data or information that would compromise the security of the service.

Liability and precedence

The limits of liability in the terms of service apply to this agreement except where data protection law requires otherwise.

If this agreement and the terms disagree about the processing of personal data, this agreement prevails. Mandatory data protection law prevails over both documents. If any provision is unenforceable, the remaining provisions continue in effect.

We tell merchants before this agreement changes in a way that reduces their protection, and the version and date are at the top of this page. Previous versions are available on request.

Annex I: the processing

The parties

Controller	The merchant: the organisation named on the Channekt account, at the address and contact given in its billing details
Processor	Axicom. Contact for data protection: support@channekt.com

Description of the processing

As set out in What we process, and why: the subject matter, duration, nature, purpose, categories of data subject and categories of personal data are all there rather than repeated here in smaller type.

Frequency

Continuous, for as long as the account is active. Orders arrive from connected channels as they are placed, and stock and catalogue changes are sent back as they happen.

Retention

For the life of the account, then deleted as described in Deletion and return. The record of who looked at personal data is kept twelve months.

Competent supervisory authority

For merchants established in the United Kingdom, the Information Commissioner's Office. For merchants established in the European Union, the authority of the member state in which the merchant is established. For Axicom as processor, the Romanian National Supervisory Authority for Personal Data Processing.

Annex II: security measures

The measures below are the summary. Each one is described properly, with where it is enforced, on the security page.

Measure	What it is
Separation of tenants	Forced row-level security in the database, tenant context set per transaction, tenant-scoped data access and isolation tests across protected routes and services
Access control	Role-based permissions from one shared catalogue, enforced at the route and again in the service, with a test covering every role and permission
Encryption in transit	HTTPS everywhere, including between our own services
Encryption at rest	Whole-database encryption from the host, plus per-field sealing of every credential with keys derived per purpose from a master key held outside the database
Authentication	argon2id password hashing with parameter upgrade on sign-in, breach checking through the k-anonymity range API, ten-minute access tokens, rotating refresh tokens with family revocation on replay
Logging and accountability	Access to customer details through the order workflow recorded as pointers, without search terms, and retained for twelve months; a separate audit trail for key changes; secret redaction on application logs
Resilience and recovery	Provider-managed daily backups with point-in-time recovery, documented recovery procedures and restore verification
Secure development	Repeatable type, lint, test and tenant-isolation checks; automated build, migration and release controls; secret scanning and dependency vulnerability checks
Minimisation	Only what an order carries and a parcel needs; no card data; no personal data sent to the assistant; erasure by tombstoning that preserves the financial record
Incident response	A written procedure with severity levels, a one-hour containment start, and merchant notification within 24 hours of becoming aware

Annex III: sub-processors

The authorised list, with what each one does, where it is, and whether it sees personal data, is at channekt.com/sub-processors. It is a live page rather than a snapshot, and the date at the top of it is the date something on it last changed.

Getting a signed copy

Write to support@channekt.com with the organisation's legal name and registered address and we will return a countersigned copy, or complete yours if your process needs your own paper. We do not require a signature for these obligations to apply.

Axicom · support@channekt.com