Data Processing Addendum

This addendum (“DPA”) forms part of the Terms of Service between you (“you”, the customer) and Track Metrics Ltd, trading as MyPrintStreet (“we”, “us”). It sets out how we process personal data on your behalf, as required by Article 28 of the UK GDPR.

Terms such as controller, processor, personal data, processing and personal data breach have the meanings given in UK data protection law, meaning the UK GDPR and the Data Protection Act 2018.

1. Roles

For personal data about your customers, you are the controller and we are your processor. You decide what you sell, what personalisation you offer, and what you collect.

For personal data about you and your staff, for example account details and billing, we are a controller in our own right. That processing is described in our Privacy Notice, not this DPA.

2. Subject matter and duration

We process your customers' personal data to provide the platform: hosting your products and orders, generating print-ready files, and passing what is needed to the party fulfilling each order. Processing lasts for as long as your account is open, plus the limited period described in clause 10.

3. Types of data and data subjects

Data subjects: your customers, and any person whose details your customer includes in a personalisation.

Types of personal data: name and contact details; delivery address; order details; and the content your customer submits to personalise a product, which may include names, dates, messages, photographs and other images.

We do not require special category data. If your customers can upload free-form images or text, such data may be included at their choice, and you remain responsible for the lawfulness of collecting it.

4. Our obligations

We will:

process personal data only on your documented instructions, which include your use of the platform and these terms, unless the law requires otherwise, in which case we will tell you where we can
make sure the people who handle personal data are bound by confidentiality
tell you if, in our opinion, an instruction infringes data protection law
not sell personal data, and not use your customers' personal data for our own marketing

5. Security

We will put in place appropriate technical and organisational measures to protect personal data, taking account of the risk. These include:

encryption of personal data in transit, and at rest
authentication and access controls, with multi-factor authentication available on accounts
segregation of each customer's data from every other's
logging, so access and changes can be traced
restricting staff access to those who need it for their work
regular backups, with restores tested rather than assumed to work

6. Sub-processors

You give us general authorisation to engage sub-processors. We impose data protection obligations on each of them that are no less protective than this DPA, and we remain responsible to you for their performance.

Our current sub-processors are:

Amazon Web Services (EU) — hosting and content delivery.
Formspree (United States) — delivery of website enquiry forms.
Our payment provider — processing card payments for licence fees and order charges.
Fulfilment partners — production and dispatch of orders sent to our network: ReliablePOD (United States), SuperFast POD (United Kingdom), Universal POD (Germany), ExpressPOD (United Kingdom), brandtale (Germany). These are listed on our fulfilment partners page.

We will give you reasonable notice before adding or replacing a sub-processor. If you object on reasonable data protection grounds we will work with you to find an alternative; if we cannot, you may terminate the affected part of the service.

7. International transfers

Some sub-processors are outside the UK, including in the United States. Where personal data is transferred outside the UK we rely on the safeguards permitted by law, such as UK adequacy regulations or the International Data Transfer Addendum to the EU Standard Contractual Clauses, together with any additional measures the transfer requires.

8. Assistance

Taking account of the nature of the processing, we will help you with:

responding to requests from data subjects. If a request comes to us directly we will not respond to it ourselves, except to tell the person to contact you, and we will pass it on promptly
data protection impact assessments and prior consultation with the ICO, so far as the information is available to us
keeping personal data secure, and dealing with breaches

9. Audit

We will make available the information reasonably necessary to show we meet this DPA, and will allow and contribute to audits, including inspections, carried out by you or an auditor you appoint. Audits must be on reasonable notice, during business hours, no more than once a year unless a breach or a regulator requires otherwise, and must not disrupt our operations or compromise other customers' confidentiality.

10. Return and deletion

On the end of the service, and at your choice, we will delete or return your customers' personal data, and delete existing copies, unless the law requires us to keep it. Data held in routine backups is deleted as those backups expire.

11. Breach notification

We will notify you without undue delay after becoming aware of a personal data breach affecting your customers' data, with the information we have at the time so you can meet your own reporting duties, and updates as our investigation progresses.

12. General

If this DPA conflicts with the Terms of Service, this DPA prevails for data protection matters. Liability under this DPA is subject to the limits in the Terms of Service. This DPA is governed by the laws of England and Wales.

Contact

Track Metrics Ltd, Fairfield Mills, Milford St, Huddersfield, HD1 3DX, United Kingdom. ICO registration ZA933719. Email support@myprintstreet.com.