Data Processing Agreement
This Data Processing Agreement (“DPA”) is between you, the merchant who uses Skurail Cloud (“you”, the controller), and Bek Service Ltd, a company registered in England and Wales, company number 12590587 (“we”, “us”, the processor). It forms part of the Terms of Service and applies whenever we process personal data on your behalf. It sets out the terms required by Article 28 of the UK GDPR and, where it applies, the EU GDPR. If this DPA and the Terms of Service conflict on data protection, this DPA wins.
In short: we use your store and buyer data only to run Skurail for you; we keep it safe and confidential; we tell you before we add a provider that handles it; we help you answer your buyers’ requests and tell you quickly about a breach; and when you leave, you can download your data and we delete it within 30 days.
1. Subject matter and duration
We process personal data to provide Skurail Cloud: listing your products on the marketplaces you connect, keeping stock and prices in step, and bringing marketplace orders into your WooCommerce store. We do so for as long as your account is open, and afterwards only for the time needed to return and delete the data under section 10.
2. Nature and purpose of the processing
Collecting, storing, transforming and transmitting data between your store and the marketplaces; creating marketplace orders in your store; adjusting stock after sales; and keeping the records needed for sync history and billing. We process the data only for these purposes, never for marketing, never to sell it, and never to train AI models.
3. Types of personal data and data subjects
| Data subjects | Personal data |
|---|---|
| Your buyers on the marketplaces | Name, delivery address, the items bought, prices and amounts paid, order and shipment references |
| Your staff who use Skurail | Name, email address, sign-in and activity records |
We do not copy buyers’ email addresses or phone numbers into your store and do not create customer accounts from marketplace orders. We do not intend to process special-category data; please do not put any into product data or order notes.
Your own account and billing data is not covered by this DPA: for that data we are the controller, as the Privacy Policy explains.
4. Your instructions
We process the data only on your documented instructions. Your instructions are the Terms of Service, this DPA, and the settings and actions you choose in Skurail and in the plugin. If we are required by law to process the data otherwise, we will tell you first unless the law forbids it. If we believe an instruction breaks data-protection law, we will tell you.
5. Confidentiality
Everyone we allow to handle the data is bound by a duty of confidentiality, and access is limited to the people who need it to run and support the service.
6. Security
We keep technical and organisational measures appropriate to the risk, as Article 32 requires. They include:
- HTTPS for all traffic, and every request between your store and Skurail Cloud signed with your store’s own key;
- marketplace access held as revocable tokens, never as passwords;
- secrets and buyer details encrypted at rest, with each merchant’s data kept apart in the database;
- sign-in protected against automated attacks, and staff access limited and logged;
- backups and a tested restore procedure.
7. Sub-processors
You authorise us to use the sub-processors below. Each is bound by written terms that protect the data at least as well as this DPA, and we remain responsible to you for their work.
| Sub-processor | What for | Where |
|---|---|---|
| Cloudflare, Inc. | Network security, protection against attacks, and delivering traffic to our servers | Global network; may process data outside the UK |
Skurail Cloud and its database run on servers operated by Bek Service Ltd in the United Kingdom. Stripe handles our billing of you, as a controller in its own right; eBay and Amazon receive data because you connect them, under their own terms, and are not our sub-processors.
Changes. Before we add or replace a sub-processor that handles your data, we will update this list and email paying customers at least 30 days in advance. You can object by email within that time on reasonable data-protection grounds; if we cannot meet the objection, you may cancel the affected service before the change takes effect.
8. International transfers
Where a sub-processor processes data outside the UK, the transfer is covered by UK adequacy regulations or by the UK’s approved safeguards (the International Data Transfer Agreement or the Addendum to the EU standard contractual clauses).
9. Assistance, breaches and audits
- Buyers’ requests. We help you answer requests to see, correct, export or erase data, with tools in Skurail and the plugin’s support for WordPress’s own export and erasure tools. If a buyer writes to us directly, we pass the request to you.
- Breaches. If we become aware of a personal-data breach affecting your data, we tell you without undue delay, with what we know and what we are doing, so you can meet your own reporting duties.
- Assessments. We give you the information you reasonably need for a data protection impact assessment or a consultation with a regulator.
- Audits. We make available the information needed to show we comply with this DPA and answer reasonable written questions. Where that is not enough, you may audit us once a year, at your cost, with 30 days’ notice and under confidentiality.
10. Return and deletion at the end
When you close your account, you can download your catalogue, mappings and orders as one export file. We then disconnect your marketplaces and delete your store and buyer data 30 days after closing, including the keys that protect any copy left in a backup. We keep only what the law requires us to keep, such as billing records for six years.
While your account is open, buyers’ names and addresses are removed from Skurail Cloud no later than 30 days after the order is delivered, and server and security logs are kept for up to 90 days.
11. Liability and changes
Each party’s liability under this DPA is subject to the limits in the Terms of Service. We may update this DPA to reflect changes in the law or in the service; we will email account holders before a change that reduces your protection takes effect.
12. Contact
Bek Service Ltd, a company registered in England and Wales, company number 12590587. Registered office: 20-22 Wenlock Road, London N1 7GU, United Kingdom. Email [email protected]. If you need a countersigned copy of this DPA, write to us.