Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the PluckyCart Terms of Service (the “Terms”) between Brian James Thompson, trading as PluckyCart (ABN 51 371 573 935), 41 Wynwood Road, Sprent, TAS 7315, Australia (“PluckyCart”, “we”) and the merchant using PluckyCart to run an online store (the “Merchant”, “you”). It applies to Personal Data that PluckyCart processes on your behalf in providing the service. If this DPA conflicts with the Terms, this DPA wins for data-protection matters.

1. Definitions

“Data Protection Law” means all laws that apply to the processing of Personal Data under the Terms, including the EU GDPR, the UK GDPR and Data Protection Act 2018, the Australian Privacy Act 1988 (Cth), and US state privacy laws, each as applicable. “Personal Data”, “Controller”, “Processor”, “Data Subject”, “Processing” and “Personal Data Breach” have the meanings given in the GDPR. “Shopper Data” means Personal Data about your shoppers and other visitors that we process for you. “Sub-processor” means a third party we engage to process Shopper Data.

2. Roles

You are the Controller of Shopper Data; PluckyCart is your Processor. PluckyCart is a separate controller of the account data you give us about yourself and your team (name, email, billing), which our Privacy Policy covers.

3. Processing on your instructions

We process Shopper Data only to provide the service and on your documented instructions. Your instructions are: the Terms, this DPA, and the settings and features you choose in your store (for example, connecting a supplier, enabling live chat or Google Customer Reviews, or sending an email campaign). We will tell you if we believe an instruction breaks Data Protection Law. Annex I describes the processing.

4. Confidentiality

Everyone at PluckyCart who can access Shopper Data is bound by confidentiality, and access is limited to what they need to run, support and secure the service.

5. Security

We implement and maintain the technical and organisational measures in Annex II, appropriate to the risk. We may update them as long as the overall level of protection doesn’t decrease.

6. Sub-processors

You authorise the Sub-processors listed in Annex III. We impose data-protection terms on each that are at least as protective as this DPA, and we remain responsible for them. We’ll give you at least 30 days’ notice of a new Sub-processor by email to your account email address, and by updating the list on this page. If you object on reasonable data-protection grounds and we can’t resolve it, you may cancel the affected service without penalty.

Services you choose to connect — for example a supplier or dropshipping account, a live-chat provider, or Google Merchant Center — are not our Sub-processors: they act under your own agreement with them, and we pass data to them on your instruction.

7. Helping with Data Subject requests

The service includes tools to export and delete a shopper’s data. Where you can’t fulfil a request with those tools, we’ll provide reasonable help. If a shopper contacts us directly about their data in your store, we’ll refer them to you.

8. Personal Data Breaches

We’ll notify you without undue delay, and in any case within 48 hours, after becoming aware of a Personal Data Breach affecting your Shopper Data. We’ll tell you what we know at the time — the nature of the breach, the data and approximate number of people affected, likely consequences, and what we’re doing about it — and update you as we learn more, so you can meet your own notification duties (for example the GDPR’s 72-hour notice to regulators, or Australia’s Notifiable Data Breaches scheme). Notice is not an admission of fault.

9. Impact assessments and consultations

We’ll give reasonable help with any data protection impact assessment or regulator consultation you need to carry out about the service, using information available to us.

10. International transfers

Our Sub-processors may process Shopper Data outside your country, including in Japan and the United States (see Annex III). Where Data Protection Law requires a transfer mechanism, the parties agree to the EU Standard Contractual Clauses (Module Two: controller to processor) and the UK International Data Transfer Addendum, which are incorporated by reference, and we rely on equivalent safeguards with our Sub-processors. For the EU Standard Contractual Clauses, the governing law (Clause 17) is the law of Ireland and disputes go to the courts of Ireland (Clause 18).

11. Deletion or return at the end

When your account closes, you can export your store data for 30 days (Terms §10). After that we delete Shopper Data from the live service within 30 days, and it ages out of backups within a further 30 days, unless the law requires us to keep it.

12. Audits

We’ll make available the information reasonably needed to show compliance with this DPA, including our Sub-processors’ security certifications (for example SOC 2 / ISO 27001 reports where they provide them). If that isn’t enough to meet a regulator’s request or your legal obligations, you may request an audit on reasonable notice, at your cost, no more than once a year, under confidentiality.

13. US state privacy laws

Where US state law applies (for example the CCPA/CPRA), PluckyCart acts as your service provider: we won’t sell or share Shopper Data, retain, use or disclose it outside our direct business relationship with you or for any purpose other than providing the service, or combine it with other data except as the law permits.

14. Liability

Each party’s liability under this DPA is subject to the limitations in the Terms, except where the law doesn’t allow them to be limited.

Annex I — Details of processing

Annex II — Security measures

• Tenant isolation: every store’s data is separated by database row-level security (deny-by-default), verified by automated cross-tenant tests on every code change.
• Encryption: TLS for all traffic; data encrypted at rest by our database and hosting providers; supplier credentials additionally sealed at the application layer.
• Access control: merchant accounts support two-step verification (TOTP); team roles separate owner and staff permissions; administrative actions are recorded in an append-only audit log.
• Payments: card data never touches our servers (Stripe).
• Secure development: type-checked builds, automated tests (including cross-tenant isolation) and a dependency vulnerability audit before release; rate limiting on sensitive endpoints.
• Resilience: daily automated database backups; per-store data export.
• Incident response: a documented breach-response procedure.
• Data minimisation: cookie-less analytics; only essential cookies by default; web fonts self-hosted (no visitor IP sent to font providers).

Annex III — Sub-processors

Contact

Questions? Contact the platform operator at support@pluckycart.com.