Data Processing Agreement

This Data Processing Agreement applies when a seamstress or boutique ("you") uses LaceLink to store or manage personal information about your own clients and brides ("Client Data"), and LaceLink handles that Client Data for you.

For that Client Data, you are generally the controller and LaceLink is the processor. This agreement is part of the LaceLink Terms for that processing. It does not make LaceLink the owner of your Client Data.

LaceLink remains the controller of information about LaceLink accounts and about running the service. That information is described in the Privacy Policy, not in this agreement.

• Subject matter: Providing LaceLink to you, including storage and display of Client Data you enter
• Duration: While you use LaceLink, and for a reasonable period afterwards so we can delete or return Client Data. We do not set a fixed number of days in this agreement
• Nature and purpose: Hosting, storing, and showing the records you keep, sending messages and emails you ask the product to send, and syncing those records to the devices you use
• Types of personal information: Names, email addresses, telephone numbers, measurements, fittings, alteration notes, dress details, photographs, messages, invoices and payment records you enter, signatures, and booking details
• People the information is about: Your clients and brides, and other people whose details you choose to type in

We process Client Data to provide the LaceLink features you use, as described in the product, the Terms, and this agreement. Those are your documented instructions.

If you need us to do something else with Client Data, email support@lacelink.co.uk. We will follow a written instruction when we can carry it out in the product. We will tell you if we believe an instruction would break UK data-protection law.

You are responsible for having a proper reason to collect and use your clients' information, and for telling them about that use. Suggested wording is in the Privacy Policy. It does not replace your own notice.

People who can see Client Data are limited to those who need it to run LaceLink, and they must keep it confidential.

The measures we actually use are:

• HTTPS between the apps, the website, and our database host
• Passwords stored by the sign-in service in a protected form, not as plain text in the app
• Database row-level security policies that control which signed-in user can read or change a record
• Security updates to the app and its dependencies

We do not claim a security certification. No method of storage is completely secure.

Organisations that process personal information on our instructions are listed on the subprocessors page. We will update that page before we add a new organisation that handles Client Data on our instructions, where we can do so in advance.

Stripe is described separately on that page. When a client pays by card, Stripe may act as its own controller for the payment. This agreement does not treat Stripe as LaceLink's processor for everything Stripe does with a payment.

If one of your clients asks for access, correction, deletion, or another right that you must answer as controller, we will help you with the Client Data we hold for you, where the product does not already let you do it yourself.

If we become aware of a security incident that affects Client Data, we will tell you without undue delay, so that you can meet your own duties. We do not promise a fixed number of hours.

We will also give you information you reasonably need for a data protection assessment or a consultation with the Information Commissioner's Office, where that assessment concerns Client Data we process for you.

When you close your account, or when you ask us to, we will delete or return the Client Data we process for you, except where the law requires us to keep it, or where another person still needs a copy they hold in their own account, such as a message.

Deleted information may remain in our hosting provider's backups for a period set by that provider. We do not publish a backup period.

We will give you the information reasonably needed to show that we are following this agreement.

You may ask to inspect that information on reasonable written notice, no more than once a year, unless a regulator requires an inspection or there has been a security incident affecting your Client Data. An inspection must not expose another customer's information. We will usually answer by providing information rather than by opening our systems.

Questions about this agreement: support@lacelink.co.uk.