Data Processing Addendum

For personal data that a business puts into Intersink or collects through its channels about its own customers, users, staff and contacts ("customer personal data"), the business is the controller and Intersink is its processor. Where a business is itself a processor for someone else, Intersink is its sub-processor and this addendum applies with the necessary changes.

Intersink is a controller for the data it needs to run the platform itself: accounts, security, billing, fraud prevention and safety decisions (see the Privacy Notice).

We process customer personal data only on the business’s documented instructions: the Terms, this addendum, the settings chosen in the panel, and API calls made with the business’s approved projects. If we believe an instruction breaks data protection law, we tell the business. We do not process it for our own purposes, except to keep Intersink secure and to meet our legal obligations.

• Subject matter and duration: providing Intersink for as long as the business uses it, plus the deletion period below.
• Nature and purpose: hosting, storing, organising, displaying, transmitting and otherwise processing data to provide the features the business uses (shop, orders, CRM, content, messaging, files, payments).
• Data subjects: the business’s customers, users of its channels, contacts, staff and suppliers.
• Categories of data: identity and contact details, order and payment data (card data is handled by our payment processors, not stored by us), communications, content, usage data; special category data only where the business chooses to put it in and has a lawful basis.

• Everyone with access is bound by confidentiality.
• Appropriate technical and organisational security measures (summarised below), reviewed regularly.
• We use sub-processors only as set out below and remain responsible for them.
• We help the business answer data subject requests, including through export, correction and deletion tools and the legal-requests inbox, and with data protection impact assessments and consultations with regulators.
• We notify the business of a personal data breach affecting its data without undue delay and in any case within 48 hours of becoming aware, with the information it needs to meet its own deadlines.
• At the end of the service we delete or return customer personal data, at the business’s choice, within 30 days (copies in backups expire within a further 35 days), unless the law requires us to keep it.
• We make available the information needed to show compliance, and allow audits by the business or an auditor it appoints, with reasonable notice, at most once a year unless a breach or a regulator requires otherwise. Our independent security reports can be used first.

• Encryption in transit (TLS) and at rest; secrets and keys in managed key stores.
• Strong sign-in (passkeys, two-step verification), least-privilege access for staff, and logging of administrative access to customer data.
• Separation of each business’s data by design; API keys bound to approved projects, scopes, channels and domains.
• Backups, disaster recovery and tested restore; vulnerability management and external testing.

The business authorises the sub-processors on our list. We give at least 30 days’ notice of a new one; the business may object on reasonable data protection grounds, and if we cannot resolve the objection it may end the affected service and get a pro-rata refund of prepaid fees. Each sub-processor is bound by data protection terms no less protective than these.

Where customer personal data leaves the UK or EEA, the UK International Data Transfer Agreement or Addendum and the EU Standard Contractual Clauses (module 2 or 3, as applicable) are incorporated by reference, with supplementary measures where needed.

For data subject to the California Consumer Privacy Act (as amended by the CPRA) and similar state laws, Intersink is a "service provider" or "processor". We do not sell or share customer personal data, do not retain, use or disclose it outside the direct business relationship or for any purpose other than providing Intersink, do not combine it with other data except as those laws allow, and will tell the business if we can no longer meet these obligations.

Each party’s liability under this addendum is subject to the limits in the Terms, except where the law does not allow it. If this addendum and the Terms conflict on data protection, this addendum wins; if the incorporated transfer clauses conflict with either, the transfer clauses win.