Data processing agreement

Data processing agreement (UK GDPR Article 28)

This Data Processing Agreement (the "DPA") is between:

1. Design Studio Lab Ltd, a company registered in England and Wales with company number 11222280, whose registered office is at 2 Damara Way, Ashford TN25 7FD, which runs the Tillzy platform at tillzy.co.uk ("Tillzy", "we", "us"); and
2. the shop owner who opened a shop on Tillzy, whose name and address are recorded in their Tillzy account (the "Shop", "you").

It forms part of, and is read with, Tillzy's terms of use for shops (the "Terms"). Accepting the Terms is accepting this DPA.

The Shop is the controller of the personal data of its customers, newsletter subscribers and other people whose data it keeps in Tillzy. Tillzy is the Shop's processor for that data. This DPA sets out the terms Article 28(3) of the UK GDPR requires between a controller and a processor.

1. Words used

• Data Protection Law means the UK GDPR, the Data Protection Act 2018, the Data (Use and Access) Act 2025 (as it is in force from time to time) and the Privacy and Electronic Communications (EC Directive) Regulations 2003 ("PECR"), and any law that replaces or amends them.
• UK GDPR has the meaning in section 3(10) of the Data Protection Act 2018.
• Controller, processor, personal data, processing, data subject, personal data breach and supervisory authority have the meanings in the UK GDPR. The supervisory authority is the Information Commissioner's Office (the "ICO").
• Shop Personal Data means personal data that Tillzy processes on the Shop's behalf in providing the service, as described in Annex 1.
• Service means the Tillzy platform: the back office, the online shop, and the connections to other services that the Shop turns on.
• Sub-processor means another processor that Tillzy engages to process Shop Personal Data. The current list is in Annex 3.
• Restricted Transfer means a transfer of personal data to a person outside the UK that is restricted by Chapter V of the UK GDPR (that is, not covered by UK adequacy regulations or another route in Chapter V).

2. Roles and scope

2.1 For Shop Personal Data, the Shop is the controller and Tillzy is the processor. The Shop decides why and how that data is used. Tillzy processes it only on the Shop's behalf.

2.2 Tillzy is a controller, not a processor, for some data it holds for its own purposes. This DPA does not cover that data. It includes the sign-in details of shop owners and staff, Tillzy's own billing records, messages sent to Tillzy through its website forms and support desk, and security and activity records kept to protect accounts. Tillzy's privacy notice explains how it uses that data.

2.3 Each of us will comply with Data Protection Law in what we do under this DPA.

3. Instructions (Article 28(3)(a))

3.1 Tillzy will process Shop Personal Data only on the Shop's documented instructions, unless the law requires otherwise. If the law requires Tillzy to process the data in another way, Tillzy will tell the Shop first, unless the law stops it doing so.

3.2 The Shop's documented instructions are: this DPA; the Terms; what the Shop and its staff do in the Service (for example, adding a product, sending an email, issuing a refund or asking for an export); and any other written instruction the Shop gives that is consistent with the Terms and this DPA.

3.3 The Shop instructs Tillzy to process Shop Personal Data to provide the Service, to keep it secure, and to meet Tillzy's legal duties.

3.4 If Tillzy thinks an instruction breaks Data Protection Law, it will tell the Shop straight away. Tillzy may pause that instruction until the Shop confirms or changes it.

3.5 An instruction that goes beyond what the Service does may need a change to the Terms or an extra fee. Tillzy will say so before acting on it.

4. Confidentiality of people (Article 28(3)(b))

4.1 Tillzy ensures that anyone it authorises to process Shop Personal Data is bound by confidentiality (by contract or by law) and processes it only as instructed.

4.2 Tillzy limits access to Shop Personal Data to the people who need it to run, support, secure and fix the Service.

5. Security (Article 28(3)(c), Article 32)

5.1 Tillzy will use technical and organisational measures that are appropriate to the risk, as required by Article 32 of the UK GDPR. The measures in place at the date of this DPA are in Annex 2.

5.2 Tillzy may change those measures if the new ones do not give less protection overall. Tillzy will not describe a measure as in place unless it is.

5.3 The Shop is responsible for how it uses the Service. In particular, the Shop will keep its sign-in details and its staff's sign-in details safe, use two-step sign-in, give staff only the roles they need, remove access when someone leaves, and keep its own devices secure.

6. Sub-processors (Article 28(2), (3)(d) and (4))

6.1 General authorisation. The Shop gives Tillzy general written authorisation to use Sub-processors. It agrees to the Sub-processors in Annex 3 now.

6.2 Notice of changes. Tillzy will tell the Shop before it adds or replaces a Sub-processor that will process Shop Personal Data, giving at least 30 days' notice by email to the Shop's owner and by updating the sub-processor list in the Trust centre. The notice will give the Sub-processor's name, what it will do and what data it will receive.

6.3 Right to object. The Shop may object in writing within 14 days of the notice, on reasonable grounds relating to the protection of personal data. Tillzy will then work with the Shop in good faith to find a solution. If none is found in a reasonable time, the Shop may close its shop under the Terms, and Tillzy will refund plan fees the Shop has paid in advance for the time after closing.

6.4 Flow-down and responsibility. Tillzy will have a written contract with each Sub-processor that puts on it data protection duties that are the same as those in this DPA, as far as they apply to what that Sub-processor does. Tillzy stays fully responsible to the Shop for what its Sub-processors do.

6.5 Services the Shop connects itself. Couriers, marketplaces and similar services that the Shop connects to its own account (for example Royal Mail, Parcel2Go, Etsy or eBay) are the Shop's choice. They are not Tillzy's Sub-processors. The Shop deals with them under its own agreement with them, and Tillzy sends them data only because the Shop has told it to.

7. Helping with data subjects' rights (Article 28(3)(e))

7.1 Tillzy will, taking into account the nature of the processing, help the Shop respond to requests from people to use their rights under Data Protection Law (to see their data, correct it, delete it, limit or object to its use, or take a copy). The Service includes exports of products, customers and orders from the back office, and Tillzy will help with anything the Shop cannot do itself in the Service.

7.2 If a person asks Tillzy directly about Shop Personal Data, Tillzy will pass the request to the Shop without undue delay and will not answer it itself, unless the law requires it to. Tillzy's privacy notice already tells people to ask the shop first.

7.3 The Shop is responsible for answering requests and complaints from its customers, including any complaints procedure the Data (Use and Access) Act 2025 requires of controllers. Tillzy will help the Shop with complaints so far as they relate to Tillzy's processing.

7.4 Tillzy may charge a reasonable fee for help that goes beyond what the Service does and is not needed because of a breach by Tillzy, if it tells the Shop the fee first.

8. Helping with Articles 32 to 36 (Article 28(3)(f))

8.1 Taking into account the nature of the processing and the information it has, Tillzy will help the Shop to meet its duties under Articles 32 to 36 of the UK GDPR. That means:

• Security (Article 32): by keeping the measures in Annex 2 and telling the Shop how the Service protects data.
• Telling the ICO and people about a breach (Articles 33 and 34): as set out in clause 9.
• Data protection impact assessments (Article 35): by giving the Shop the information it reasonably needs about how the Service works, if the Shop has to carry out an assessment.
• Consulting the ICO first (Article 36): by giving the Shop reasonable help if the ICO has to be consulted.

9. Personal data breaches (Article 33(2))

9.1 If Tillzy becomes aware of a personal data breach affecting Shop Personal Data, it will tell the Shop without undue delay. Tillzy's target is to tell the Shop within 48 hours of becoming aware.

9.2 The notice will go by email to the Shop owner's address. It will say, as far as Tillzy then knows: what happened; the categories and approximate numbers of people and records affected; the likely effects; and what Tillzy has done and what it recommends the Shop does. Tillzy will send more information as it learns it.

9.3 Tillzy will take reasonable steps to contain and fix the breach, to find out what happened, and to help the Shop with its own investigation.

9.4 The Shop decides whether to report the breach to the ICO (which a controller must do within 72 hours of becoming aware, unless it is unlikely to risk people's rights and freedoms) and whether to tell the people affected. Tillzy will give reasonable help with both. Tillzy will not tell the ICO or anyone else about a breach of Shop Personal Data on the Shop's behalf unless the Shop asks it to or the law requires it. Where Tillzy is itself required to report to the ICO as a controller of its own data, it will do so.

9.5 A notice or help from Tillzy is not an admission of fault or liability.

10. Deletion or return at the end (Article 28(3)(g))

10.1 The Service lets the Shop export its products, customers and orders at any time. When the Shop closes its shop or the Terms end, Tillzy will, at the Shop's choice, return a copy of the Shop Personal Data (in a common format) or delete it.

10.2 The Shop should download what it needs before it asks to close. If the Shop does not ask for a return, Tillzy will delete the Shop Personal Data within 30 days of the shop closing.

10.3 Copies in Tillzy's encrypted backups are not deleted early. They disappear as the backups expire. Tillzy keeps 14 days of nightly backups plus one a month for six months, so deleted data can remain in a backup for up to six months. Until then, Tillzy will keep those copies secure, will not use them for any other purpose, and will not restore them to a live shop unless that is needed to recover from a failure.

10.4 Tillzy may keep Shop Personal Data to the extent the law requires, for as long as it requires. In that case it will keep it secure, use it only for that purpose, and delete it afterwards. Tillzy's own invoices to the Shop (kept six years for tax) are Tillzy's records and are not Shop Personal Data.

10.5 Tillzy will confirm by email when the deletion is done.

11. Information and audits (Article 28(3)(h))

11.1 Tillzy will give the Shop the information it needs to show that Tillzy meets Article 28 and this DPA. Tillzy's Trust centre, information security policy and sub-processor list are the first source.

11.2 Tillzy will allow and contribute to audits, including inspections, by the Shop or an auditor the Shop appoints. To keep other shops' data safe, audits will be done like this: the Shop gives reasonable written notice (at least 30 days) and a plan; the audit is limited to Tillzy's processing of the Shop's own data; it happens during working hours, no more than once a year (unless the ICO requires it, or after a personal data breach affecting the Shop); the auditor signs a confidentiality agreement; and the Shop pays its own costs and Tillzy's reasonable costs. Tillzy may offer written evidence or a questionnaire first.

11.3 Tillzy does not currently hold an independent security certification (such as ISO 27001, SOC 2 or Cyber Essentials) and will not say it does unless it does. Getting Cyber Essentials is planned.

12. Transfers outside the UK

12.1 Tillzy will not make a Restricted Transfer of Shop Personal Data unless it is covered by a lawful route under Chapter V of the UK GDPR as changed by the Data (Use and Access) Act 2025. Those routes are UK adequacy regulations (including the UK-US data bridge for US companies certified to it), or an international data transfer agreement or the ICO's UK Addendum to the EU standard contractual clauses, with a transfer risk assessment where needed.

12.2 Where the Shop sends data to a courier, marketplace or other service it has connected itself, the transfer is the Shop's responsibility.

13. Shops with customers in the EU

13.1 This DPA applies UK law. If the Shop sells to customers in the EU or EEA, EU data protection law may also apply to the Shop. Tillzy will then follow the same terms for that data.

13.2 The UK has EU adequacy decisions that allow personal data to flow from the EU to the UK. If a transfer of EU personal data to Tillzy is ever a restricted transfer under EU law and no adequacy decision covers it, the parties will sign the EU standard contractual clauses (controller to processor, with the ICO's UK Addendum where UK data is also covered). Until then no such clauses apply.

14. What the Shop is responsible for

14.1 The Shop will make sure it has a lawful basis for the data it puts in the Service and for the instructions it gives; has given people the information Articles 13 and 14 require (a privacy policy on its shop, which Tillzy provides a starter for); and has registered with the ICO and paid the data protection fee if the law requires.

14.2 Marketing and PECR. The Shop is the sender of any marketing email it sends through Tillzy. It is responsible for having a valid consent (or the "soft opt-in" where PECR allows it) before it emails anyone, for a clear way to unsubscribe in every marketing email, and for stopping when someone unsubscribes. The Service lets the Shop offer a marketing tick-box at checkout and records whether a customer ticked it and whether they later unsubscribed. Every marketing email the Service sends for the Shop (newsletters, basket reminders and loyalty points emails) includes an unsubscribe link and the headers email apps use for one-click unsubscribe, and the Service stops sending them to anyone who has unsubscribed; back-in-stock emails and occasion reminders carry a one-click link that stops them. The Shop will not use the Service to send marketing to people who have not agreed or who have unsubscribed.

14.3 Cookies. The Shop is responsible for the cookie choices on its own storefront, including any analytics or advertising tags it turns on. The storefront shows a cookie banner and loads Google tags only after a shopper accepts.

14.4 Special category data. The Service is not designed for health information, other special category data, or criminal offence data. The Shop will not put that kind of data in the Service on purpose. If a shopper types it into a free-text field (for example a delivery note), it is the Shop's responsibility to deal with it. The Shop will not store card numbers, passwords for other services, or similar secrets in the Service.

14.5 The Shop is responsible for the accuracy of the data it enters.

15. Artificial intelligence tools

15.1 The Service has optional AI tools, for example to draft a reply to a customer's message. A tool runs only when someone in the Shop chooses to use it, and it only drafts or suggests: a person in the Shop approves before anything is published or sent. Only the tools that need customer details send them, and most tools never receive any.

15.2 Tillzy will not use Shop Personal Data to train AI, and it will use only business services from its AI providers. It will make sure its AI providers that receive personal data do not use it to train their AI.

16. Liability

16.1 Each party's liability under this DPA is subject to the limits and exclusions of liability in the Terms.

16.2 Nothing in this DPA limits liability that cannot be limited by law, or either party's liability to a data subject under Data Protection Law.

17. How long this lasts, changes and the law

17.1 This DPA starts when the Shop accepts the Terms (or signs this DPA) and lasts until Tillzy has finished returning or deleting the Shop Personal Data under clause 10. Clauses that by their nature continue (including 10, 11 and 16) continue.

17.2 If this DPA and the Terms conflict about personal data, this DPA comes first.

17.3 Tillzy may change this DPA if the law or a regulator requires it, or if the change does not reduce the protection of Shop Personal Data. It will give the Shop notice in the way the Terms give notice of changes (at least 15 days, usually 30).

17.4 This DPA is governed by the law of England and Wales. The courts of England and Wales have exclusive jurisdiction over any dispute about it.

17.5 Contact for data protection: [email protected].

Accepting this DPA

This DPA is accepted online with the Terms: accepting a version of the Terms that includes it is accepting this DPA, and no separate signature is needed. Tillzy records the version accepted, when, by which owner and from which IP address.

Annex 1: Details of the processing

(Article 28(3) of the UK GDPR: subject matter, duration, nature and purpose, type of personal data, categories of data subjects, and the controller's obligations and rights.)

Annex 2: Security measures

This annex describes what Tillzy does today. It is based on Tillzy's published information security policy and Trust centre and on how the platform is built. It does not describe anything that is only planned, and it does not claim any certification.

1. Keeping each shop's data apart

• Each shop's data is kept in its own separate database. Tillzy's own platform data is kept in a separate main database.
• Shop staff see only their own shop, and only what their role allows. For example, cost prices are hidden from staff without that permission.
• Internal secrets (see 3) are not shown to the browser in full once they are set up.

2. Who can get in, and how

• Two-step sign-in. Everyone on the Tillzy team must use an authenticator app. A code that has been used cannot be used again. Shop owners, and staff whose role can change settings or staff, refund orders, issue invoices and credit notes or see payouts, must use two-step sign-in, with 14 days to set it up. Other staff can switch it on and are asked to. Each person gets ten one-time recovery codes.
• Passwords. At least 12 characters for Tillzy admin and shop staff, and at least 10 for shoppers. Stored only as a one-way hash (bcrypt), so nobody, including Tillzy, can read them. When someone sets a new password, it is checked against the Have I Been Pwned list of leaked passwords without sending the password itself (only the first five characters of a hash are sent).
• Locking. Sign-in attempts are rate-limited. After 10 wrong passwords or 10 wrong codes in 15 minutes, a Tillzy admin or shop staff account is locked for 15 minutes and the account holder is emailed.
• Leavers. When an owner removes a staff member, that person is signed out straight away.
• Tillzy's own settings. Only the company's owners can change platform settings and keys.
• Least access for Tillzy's team. The minimum Tillzy people needed to support a shop can see its data.

3. Encryption and secrets

• In transit. Pages and sign-ins are sent over HTTPS all the way: between the visitor's browser and Cloudflare, which carries Tillzy's traffic, and from Cloudflare to Tillzy's server. Tillzy's connections to Stripe and PayPal use HTTPS.
• Secrets at rest. Payment, courier and Google keys, access tokens and two-step secrets are stored in encrypted database columns (AES-256). By design, they are never written to logs or activity records.
• Ordinary shop data at rest. Names, addresses and orders are protected by the access controls above and by the separate databases. They are not separately encrypted column by column.
• Payments. Card payments are handled by Stripe and PayPal. Shoppers type card details on Stripe's or PayPal's own pages, so Tillzy never sees or stores card numbers. Stripe payment confirmations are checked with a signature, and the amount and currency must match the basket.

4. Backups

• Every night, Tillzy backs up its main database and every shop's database. Each is dumped, compressed, and encrypted with AES-256-GCM on Tillzy's server before it leaves it. The encrypted copy is stored in private Cloudflare R2 storage.
• Tillzy keeps the 14 newest days of backups, plus the first backup of each of the six newest months. Older ones are deleted, but only after a night when every database was backed up.
• If nightly backups fail and none has worked for 36 hours, the company's owners are emailed.
• Tillzy checks by hand that a backup can be opened, and its admin Health page flags it if that has not been done for 30 days. Full test restores into a spare database are planned and are not yet done.

5. Records that cannot be rewritten

• Issued invoices and credit notes, stock movements, ledger entries, the Tillzy admin audit log, and each shop's activity log can only be added to, never edited. A correction is a new entry.
• The audit log and activity logs record who changed what, and sign-ins, failed sign-ins and failed two-step codes. They do not record passwords, keys or card numbers.

6. Application and website protection

• Every page, including the back office, the admin and shop storefronts, sends browser security headers: nosniff, a referrer policy, a permissions policy and framing protection.
• The back office and admin send a Content Security Policy in report-only mode. It reports problems but does not block anything yet.
• Public forms have spam and abuse protection.
• The support desk hides anything that looks like a card number, password or key before a message is saved.
• AI tools run only when a person in the shop chooses to use them. Only tools that need customer details are sent any.

7. Incident response

• The company director leads the response to any security incident. Tillzy contains the problem, finds out which shops and data were affected, fixes the cause, and tells affected shops without undue delay (target 48 hours: see clause 9). It writes down what went wrong.
• Tillzy reviews its information security policy at least once a year.

8. People

• Tillzy's commitment that everyone it authorises to process Shop Personal Data is bound by confidentiality is in clause 4.

9. Not in place yet

To avoid doubt, these are not yet done and Tillzy does not rely on them in this DPA:

• HTTP Strict Transport Security (HSTS);
• an enforced (blocking) Content Security Policy;
• uptime monitoring and error alerts;
• full test restores of backups;
• confirmed two-step sign-in on every outside account used to run Tillzy (such as hosting, code, domain, payment and email accounts);
• a confirmed check of disk encryption, screen locks and automatic updates on the devices used to run Tillzy;
• Cyber Essentials certification; and
• an independent accessibility or security audit.

Annex 3: Sub-processors

The Shop agrees to these Sub-processors under clause 6.1. This is Tillzy's live sub-processor list, the same one the Trust centre and the privacy notice show.

Notes:

• The list has no column for where each company is located.
• Services the Shop connects itself (couriers, marketplaces and similar) are not on this list. See clause 6.5.
• Some companies above are outside the UK, mainly in the US, as the Trust centre says.

This template was prepared and made publicly available by General Legal, PC ("General Legal"). It is provided for general reference purposes only and does not constitute, and should not be construed as, legal advice, or an endorsement or review of any particular transaction in which it is used. Use of this template does not create an attorney-client relationship with General Legal. General Legal has not reviewed, and takes no position on, any modifications made to this document or the deal terms it is used to document.

(Adapted for the UK by Tillzy from General Legal's Data Processing Addendum (Global), CC0 1.0. General Legal has not reviewed this adaptation.)