Data processing agreement

Last updated 29 October 2026

About this agreement

This data processing agreement ("DPA") is between you, the merchant, and Northstar Ridge Ltd (company number [COMPANY NUMBER], registered in England and Wales, at [REGISTERED ADDRESS]), which runs Merchella.

It forms part of our Terms of service and applies automatically when you use the service. It covers personal data we handle for you about your shoppers and other people your shop deals with.

It is written in plain English but is meant to meet the requirements of Article 28 of the UK GDPR. If there is a conflict between this DPA and the Terms of service on data protection, this DPA applies.

1. Who does what

You (controller): You decide why and how your shoppers' personal data is used. You are responsible for having a lawful basis and for telling shoppers how their data is used.
Us (processor): We process that data only to provide the service to you, and only on your instructions.
Sub-processor: Another company we use to help provide the service, which may process the data on our behalf.

Words such as "personal data", "processing", "controller", "processor" and "personal data breach" have the meanings given in the UK GDPR.

2. Details of the processing

Subject matter: Providing the Merchella hosted shop platform and related features to you.
Duration: For as long as you use the service, and then until the data is deleted or returned as set out in section 10.
Nature and purpose: Hosting, storing, organising, displaying and sending data so your shop works: taking orders, sending them to your warehouse, sending emails, showing reviews, live view, reporting, and sending data to services you connect.
Types of personal data: Names, postal and delivery addresses, email addresses, phone numbers, order and basket details, delivery and tracking information, messages, reviews and photos, marketing preferences, IP addresses, device and browsing data in your shop, and where a visit came from.
Categories of people: Your shoppers, people who visit your shop, people who contact you, people who leave reviews, newsletter subscribers, and your team members.
Special category data: The service is not designed for special category data such as health data. Do not collect it through your shop unless you have a lawful basis and have checked it is appropriate.

3. Your instructions

We will only process personal data on your documented instructions. Your instructions are this DPA, the Terms of service, and the settings and choices you make in the Command admin area.
When you connect a service, such as a warehouse or an advertising account, or switch on a feature, such as review requests or AI writing help, that is an instruction to send the relevant data to it.
If we think an instruction breaks data protection law, we will tell you.
If the law requires us to process data in another way, we will tell you first unless the law forbids it.

4. Your responsibilities

Have a lawful basis for everything you ask us to do with personal data.
Give shoppers a clear privacy notice and, where needed, get their consent, for example for marketing emails or advertising cookies.
Only upload or import personal data you are allowed to use.
Control who on your team can see what, and keep sign-in details secure.
Respond to your shoppers' data protection requests.

5. Confidentiality

We make sure everyone at our company who can access your personal data is bound by a duty of confidentiality, and only accesses it when they need to, for example to provide support you have asked for or to keep the service secure.

6. Security

We take appropriate technical and organisational measures to protect personal data, taking into account the risks. These include:

encrypted connections to the Command admin area and to shops;
2-step sign-in for everyone who signs in to Command;
team permissions, so you control what each person sees;
limiting our own staff's access to those who need it;
using reputable hosting with security controls; and
keeping our software up to date and reviewing our security as the service changes.

You are responsible for the security of your own devices, sign-in details and the services you connect.

7. Sub-processors

You give us general permission to use sub-processors. Our current sub-processors fall into these categories:

Hosting: Sevalla, which hosts the service and its databases.
Payments: PayPal, for checkout under your own PayPal account.
Email delivery: A provider that sends order, account and marketing emails.
AI writing help: An AI provider, used only when you or your team use the AI writing button.

Before we add or replace a sub-processor, we will tell you, for example by email or a notice in Command, and give you a reasonable chance to object.
If you object on reasonable data protection grounds and we cannot resolve it, you may cancel the affected service.
We put a written contract in place with each sub-processor that gives data at least the same level of protection as this DPA.
We remain responsible to you for our sub-processors' work.

Services you choose to connect yourself, such as your PayPal account, your warehouse, Google or Microsoft advertising, are your own suppliers. Your arrangement with them is between you and them.

8. International transfers

If we or a sub-processor transfer personal data outside the UK, we will make sure an appropriate safeguard is in place, such as a UK adequacy decision, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.

9. Helping you

Taking into account what we do and the information available to us, we will reasonably help you to:

respond to requests from shoppers using their rights, such as access or deletion. Many of these you can handle yourself in Command. If a shopper contacts us directly, we will pass the request to you and not answer it ourselves unless you ask us to;
keep personal data secure;
deal with personal data breaches;
carry out data protection impact assessments where needed; and
consult the ICO where required.

We may charge a reasonable fee for help that goes beyond what is normally part of the service.

10. Personal data breaches

If we become aware of a personal data breach affecting your data, we will tell you without undue delay.
We will give you the information we have to help you meet your own duties, including whether to report it to the ICO within 72 hours and whether to tell affected shoppers.
We will take reasonable steps to contain the breach and limit harm, and keep you updated as we learn more.
Telling you about a breach is not an admission of fault.

11. Deleting or returning data

While your account is open, you can export your data from Command and delete individual records.
When your account closes, we keep the data for a limited time so you can return or ask for an export.
After that, we delete the personal data, including from our live systems, and from backups as they are routinely replaced.
We may keep data where the law requires us to, and will keep it protected while we do.

12. Audits and information

We will make available the information reasonably needed to show we meet our obligations under Article 28, for example by answering reasonable written questions about our security.
If that is not enough, or a regulator requires it, you may ask for an audit or inspection. You must give us reasonable notice, keep what you learn confidential, avoid disrupting our business or other customers' data, and pay your own costs.
We will not normally agree to more than one audit a year unless there has been a breach or a regulator requires it.

13. Liability and duration

The limits on liability in our Terms of service apply to this DPA, except where the law does not allow them to. This DPA lasts for as long as we process personal data for you.

Contact

For questions about this DPA, or to request information, email privacy@merchella.com.