Data Processing Agreement.

1. Parties and scope

This Data Processing Agreement ("DPA") is between Sorted. (the "Processor", "we") and the business that has accepted our Terms of Service (the "Customer", "you"). It forms part of the Terms and applies whenever we process Customer Personal Data in providing the Service. It takes effect when you accept the Terms and needs no separate signature.

If this DPA conflicts with the Terms on a data protection matter, this DPA prevails.

2. Definitions

Data Protection Laws

The UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, and, where they apply to the processing, the EU GDPR and laws implementing it, each as amended or replaced.

Customer Personal Data

Personal data within Customer Data (as defined in the Terms) that we process on your behalf.

Personal Data Breach

A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.

Sub-processor

A third party we engage to process Customer Personal Data.

Restricted Transfer

A transfer of Customer Personal Data to a country without an adequacy decision or regulations under the Data Protection Laws.

Other terms (such as "controller", "processor", "data subject" and "processing") have the meanings given in the Data Protection Laws.

3. Roles

For Customer Personal Data, you are the controller and we are your processor. You are responsible for the lawfulness of the processing you instruct, including having a lawful basis, giving your customers appropriate information (including about AI-assisted processing), and the accuracy of the data you provide. Where you act as a processor for someone else, you confirm you have their authority, and we act as your sub-processor.

4. Details of the processing

5. Our obligations as processor

We will:

• process Customer Personal Data only on your documented instructions, which are the Terms, this DPA and the settings and actions you and your Users choose in the Service, unless the law requires otherwise (in which case we'll tell you first, unless the law prohibits that);
• tell you promptly if we believe an instruction infringes the Data Protection Laws;
• not sell Customer Personal Data, not use it for our own purposes, and not use it, or allow it to be used, to train AI models;
• ensure that everyone we authorise to process it is bound by a duty of confidentiality and only accesses it as needed to provide or support the Service;
• implement and maintain the security measures described in section 6 and the Annex;
• keep records of our processing activities as required by Article 30(2) of the UK GDPR;
• taking into account the nature of the processing and the information available to us, help you meet your obligations on security, breach notification, data protection impact assessments and prior consultation with the regulator.

6. Security

We implement appropriate technical and organisational measures to protect Customer Personal Data against Personal Data Breaches, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as required by Article 32 of the UK GDPR. The current measures are listed in the Annex. We may update them, but will not reduce the overall level of protection.

7. Sub-processors

You give us general authorisation to engage Sub-processors. Our current Sub-processors are:

• Changes. We will give you at least 14 days' notice before adding or replacing a Sub-processor, by email to your Account's administrators and by updating this page.
• Your right to object. You may object on reasonable data protection grounds by emailing hello@sortedinbox.app within that notice period. We will work with you in good faith to address the objection. If we cannot, you may terminate the affected part of the Service by notice, and we will refund any fees you have prepaid for the period after termination.
• Flow-down. We impose data protection obligations on each Sub-processor that are no less protective than those in this DPA, and we remain liable to you for their performance of those obligations.
• Services you connect. Services you choose to connect (such as your email provider or Shopify) are not our Sub-processors; your relationship with them is governed by your own terms with them.

8. International transfers

You authorise us and our Sub-processors to transfer Customer Personal Data outside the UK where needed to provide the Service, as shown in the table above. We will only make a Restricted Transfer where it is covered by an adequacy decision or regulations (including the UK-US data bridge for certified recipients), or by appropriate safeguards: the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum, supported by a transfer risk assessment. Where the EU GDPR applies, we will use the EU Standard Contractual Clauses (module 3, processor to processor, where we transfer to a Sub-processor). We will provide copies of the relevant safeguards on request.

9. Personal data breaches

If we become aware of a Personal Data Breach affecting Customer Personal Data, we will notify you without undue delay and in any event within 48 hours of becoming aware of it. Our notice will describe, as far as we then know: the nature of the breach, including the categories and approximate numbers of data subjects and records concerned; the likely consequences; the measures taken or proposed to address it and mitigate its effects; and a contact point for more information. Where information isn't yet available, we will provide it in phases as it becomes so.

We will take reasonable steps to contain and investigate the breach, and cooperate with you so you can meet any obligation to notify the regulator or affected individuals. Notifying you is not an admission of fault or liability.

10. Data subject requests

The Service gives you tools to find, correct, export and delete Customer Personal Data. If we receive a request from one of your customers or Users to exercise their rights, we will not respond to it ourselves (other than to tell them we have passed it on), and will forward it to you promptly. Taking into account the nature of the processing, we will help you respond to such requests by appropriate technical and organisational measures, so far as possible.

11. Return and deletion

When your Account closes, you have 30 days to ask us for an export of Customer Personal Data in a commonly used, machine-readable format. After that, we will delete Customer Personal Data from the live Service, normally within a further 30 days, and it will be removed from our rolling backups within 35 days after that. We may retain Customer Personal Data only where the law requires us to, and we will keep it protected and process it only for that purpose. On request, we will confirm in writing that deletion has taken place.

You can also delete individual tickets, attachments and other records yourself at any time while your Account is open.

12. Audits and information

We will make available to you the information reasonably necessary to demonstrate our compliance with this DPA and Article 28 of the UK GDPR, including by answering reasonable security and data protection questionnaires, and providing summaries of relevant independent assessments where we have them.

Where that information is not sufficient, or a regulator requires it, you (or an independent auditor you appoint, bound by confidentiality) may audit our compliance, no more than once a year unless following a Personal Data Breach, on at least 30 days' written notice, during normal business hours, in a way that minimises disruption and does not compromise other customers' data or our security. Each party bears its own costs, unless the audit reveals a material breach of this DPA by us.

13. Liability

Each party's liability under or in connection with this DPA is subject to the limitations and exclusions in the Terms, except where the Data Protection Laws do not allow that.

14. Governing law

This DPA is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction, except where the Data Protection Laws or transfer safeguards require otherwise.

Annex: security measures

Access control

• Each company's data is logically separated, and every request is scoped to the signed-in user's company.
• Users sign in with individual accounts; passwords are stored only as salted hashes; two-factor authentication is supported and can be required.
• Role-based permissions within each company, so setup, team and billing are limited to administrators.
• Our staff access production systems only when needed to provide or support the Service, using individual, multi-factor-protected accounts on a least-privilege basis.

Encryption

• All traffic to and from the Service is encrypted in transit with TLS.
• Credentials for connected services (mailbox, store and API keys) are encrypted at rest with application-level encryption.
• Data sent to our AI sub-processor is transmitted over encrypted connections.

Resilience and recovery

• Regular, automated backups, kept on a rolling basis.
• Monitoring of errors and background job queues.

Application and infrastructure security

• Protection against common web vulnerabilities, including CSRF protection, input validation, output escaping and rate limiting on public forms and AI features.
• Prompt application of security updates to our framework, dependencies and servers.
• Signed, expiring links for sensitive actions such as invitations and rating links.
• Logging of security-relevant events, retained for investigation.

Organisational measures

• Confidentiality obligations for everyone with access to personal data.
• Due diligence on, and written data protection terms with, every Sub-processor.
• An incident response process covering containment, investigation, notification and lessons learned.
• Data minimisation: we process only what is needed to provide the Service, and AI processing is limited to the context needed for each task.

Questions about this document? Email hello@sortedinbox.app and a person will reply.