Data Processing Agreement

3.1 TrueMart as Controller

TrueMart determines the purposes for which Customer Personal Data is collected (operating the marketplace, enabling purchases, providing customer service) and the general means by which it is processed. TrueMart is responsible for ensuring there is a lawful basis for collecting Customer Personal Data in the first place and for providing customers with appropriate privacy information.

3.2 Vendor as Processor

The Vendor processes Customer Personal Data solely for the purpose of fulfilling orders placed via the TrueMart platform. The Vendor acts only on the documented instructions of TrueMart and has no independent right to use Customer Personal Data for its own purposes.

3.3 Independent Controller Responsibilities

Where a Vendor independently collects personal data from customers through channels outside the TrueMart platform (for example, through their own website, email newsletter, or social media), the Vendor acts as an independent Controller in respect of that data. This DPA does not apply to such independent processing. The Vendor is solely responsible for compliance with Applicable Data Protection Law in respect of any data they independently control.

4.1 Subject Matter

The subject matter of the processing is the fulfilment of customer orders placed on the TrueMart marketplace.

4.2 Nature of Processing

The processing activities carried out by the Vendor include:

1. Receiving customer order details from TrueMart;
2. Reading customer delivery names and addresses to pack and dispatch orders;
3. Printing or generating dispatch labels and invoices;
4. Communicating with customers via TrueMart's messaging system in connection with the order;
5. Retaining order records for the period specified in Section 12.

4.3 Purpose of Processing

The sole purpose of processing is the fulfilment of orders placed via TrueMart. The Vendor must not process Customer Personal Data for any other purpose without the express written consent of TrueMart.

4.4 Categories of Personal Data

The personal data processed under this Agreement includes:

1. Customer full name;
2. Delivery address (including postcode);
3. Order reference number;
4. Product(s) ordered and quantities;
5. Contact telephone number (where provided by the customer);
6. Order value and payment confirmation status (not payment card details — these are never shared with Vendors).

4.5 Categories of Data Subjects

The data subjects are TrueMart customers who have placed orders for products listed by the Vendor on the Platform.

4.6 Special Category Data

TrueMart does not intentionally share special category personal data (as defined in UK GDPR Article 9) with Vendors. If a Vendor inadvertently receives such data, they must notify TrueMart immediately and delete it unless specifically instructed otherwise.

5.1 Instructions Only

Process Customer Personal Data only on documented instructions from TrueMart. The primary instruction is to process data solely for order fulfilment as set out in Section 4. If the Vendor believes any instruction infringes Applicable Data Protection Law, it shall inform TrueMart immediately and must not act on that instruction pending resolution.

5.2 Confidentiality

Ensure that all personnel authorised to process Customer Personal Data are subject to appropriate confidentiality obligations, whether contractual or statutory. Access to Customer Personal Data must be limited to those individuals who need access to fulfil orders.

5.3 Security

Implement and maintain appropriate technical and organisational measures to protect Customer Personal Data against unauthorised access, destruction, loss, alteration, or disclosure, as required by UK GDPR Article 32. See Section 9 for specific security requirements.

5.4 Sub-processors

Not engage any Sub-processor to process Customer Personal Data without complying with the requirements of Section 7. The Vendor remains fully liable to TrueMart for the acts or omissions of any Sub-processor.

5.5 Assistance with Data Subject Rights

Assist TrueMart in fulfilling its obligations to respond to Data Subject rights requests (access, erasure, restriction, portability, objection) by providing TrueMart with all information necessary to respond to such requests within 5 working days of TrueMart's written request.

5.6 Assistance with Compliance

Assist TrueMart in ensuring compliance with UK GDPR Articles 32–36, including security obligations, breach notification, data protection impact assessments, and prior consultation with the ICO.

5.7 No Independent Use

Not use Customer Personal Data for any purpose other than order fulfilment. In particular, the Vendor must not:

1. Use Customer Personal Data for direct marketing without the customer's separate consent;
2. Sell, rent, or transfer Customer Personal Data to any third party;
3. Combine Customer Personal Data with data obtained from other sources to build customer profiles;
4. Retain Customer Personal Data beyond the periods specified in Section 12.

5.8 UK GDPR Compliance Self-Certification

The Vendor confirms that, in processing Customer Personal Data as described in this DPA, it independently complies with all obligations of a Processor under Applicable Data Protection Law. The Vendor shall maintain appropriate records of its processing activities as required by UK GDPR Article 30(2).

7.1 Prior Written Authorisation

The Vendor must not engage any Sub-processor to process Customer Personal Data without the prior written authorisation of TrueMart. This requirement does not apply to standard operational services that do not involve the Vendor actively providing Customer Personal Data to a third party — for example, using a standard shipping carrier to deliver a parcel (where only the delivery label address is shared) is permitted without separate authorisation.

7.2 Sub-processor Requirements

Where a Sub-processor is authorised, the Vendor must impose data protection obligations equivalent to those set out in this DPA on the Sub-processor by way of a written contract. The Vendor shall provide TrueMart with a copy of such contract on request.

7.3 Vendor Remains Liable

The engagement of a Sub-processor does not relieve the Vendor of its obligations under this DPA. The Vendor remains fully liable to TrueMart for the performance of the Sub-processor's data protection obligations.

8.1 UK-Only Processing

The Vendor must process Customer Personal Data within the United Kingdom only, unless TrueMart has given prior written authorisation for processing in a specific third country.

8.2 Adequacy Decisions

Where TrueMart authorises processing outside the UK, such processing must be governed by an appropriate transfer mechanism under UK GDPR Chapter V, including an adequacy regulation made by the UK Secretary of State, UK International Data Transfer Agreements (IDTAs), or UK Addendum to EU Standard Contractual Clauses.

8.3 Shipping Carriers

For the avoidance of doubt, sharing a customer's name and delivery address with a UK-based shipping carrier for the purpose of parcel delivery is not an international transfer and does not require prior authorisation under this section, provided the carrier processes data within the UK.

9.1 Access Controls

1. Customer Personal Data must only be accessible to individuals who need it to fulfil orders;
2. Access must be protected by appropriate authentication (password-protected systems at minimum);
3. Shared access to systems containing Customer Personal Data is not permitted without appropriate access controls.

9.2 Data Minimisation

1. Customer Personal Data must not be copied, duplicated, or retained beyond what is necessary for order fulfilment;
2. Physical documents (packing slips, delivery labels) containing personal data must be disposed of securely after the order is fulfilled.

9.3 Device & Network Security

1. Devices used to access order information must be protected with up-to-date security software;
2. Customer Personal Data must not be accessed from public or unsecured Wi-Fi networks without appropriate encryption (VPN or equivalent);
3. Customer Personal Data must not be stored on unencrypted removable media (USB drives, etc.).

9.4 Email & Communication Security

1. Customer Personal Data must not be transmitted via unencrypted email to third parties;
2. All order-related customer communication must be conducted via TrueMart's platform messaging system wherever possible.

10.1 Notification Obligation

The Vendor must notify TrueMart without undue delay, and in any event within 24 hours of becoming aware of any actual or suspected Personal Data Breach involving Customer Personal Data. Notification must be made by email to [email protected] with the subject line "URGENT — Personal Data Breach".

10.2 Breach Notification Content

The notification must include, to the extent known at the time:

1. A description of the nature of the breach, including categories and approximate number of data subjects and records affected;
2. The name and contact details of the Vendor's data protection point of contact;
3. A description of the likely consequences of the breach;
4. A description of measures taken or proposed to address the breach and mitigate its effects.

Where all of the above information cannot be provided in the initial notification, it may be provided in phases without undue further delay.

10.3 Assistance with Regulatory Notification

The Vendor shall provide all reasonable assistance to TrueMart in complying with TrueMart's own obligation to notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of a breach under UK GDPR Article 33. The Vendor must not make any public statement about a breach involving Customer Personal Data without TrueMart's prior written consent.

12.1 Retention Period

Customer Personal Data must be retained by the Vendor only for as long as necessary for the purpose for which it was processed. The Vendor must delete or anonymise Customer Personal Data relating to a specific order no later than 7 years after the date of that order, to comply with HMRC record-keeping obligations under the Taxes Management Act 1970.

12.2 Deletion on Instruction

The Vendor must delete Customer Personal Data (or return it to TrueMart) promptly on TrueMart's written instruction, unless the Vendor is required to retain it by applicable law, in which case the Vendor must notify TrueMart of that legal obligation and the period for which retention is required.

12.3 Deletion on Termination

On termination of the Vendor's account with TrueMart for any reason, the Vendor must delete all Customer Personal Data received from TrueMart (other than data retained under legal obligation) within 30 days of termination, and confirm such deletion to TrueMart in writing.

13.1 Records

The Vendor must maintain sufficient records of its processing activities under this DPA to demonstrate compliance with Applicable Data Protection Law, as required by UK GDPR Article 30(2).

13.2 Information & Audit Rights

The Vendor must make available to TrueMart all information necessary to demonstrate compliance with UK GDPR Article 28 and this DPA. The Vendor must allow for and contribute to audits, including inspections, conducted by TrueMart or an auditor mandated by TrueMart, on reasonable written notice of not less than 14 days, provided that such audits are conducted no more than once per 12-month period unless TrueMart has reasonable grounds to believe a breach has occurred.

13.3 Certifications

The Vendor may satisfy the audit requirements of Section 13.2 by submitting relevant third-party certifications or audit reports (such as ISO 27001 or Cyber Essentials) to TrueMart, where TrueMart agrees that such certifications provide sufficient evidence of compliance.

14.1 Vendor Liability

The Vendor shall be liable to TrueMart for any loss, damage, costs, or expenses (including regulatory fines and reasonable legal fees) suffered by TrueMart arising from the Vendor's breach of this DPA or Applicable Data Protection Law.

14.2 Regulatory Fines

Where TrueMart incurs a regulatory fine from the ICO that is attributable wholly or partly to the Vendor's breach of this DPA, TrueMart may recover from the Vendor the proportion of such fine attributable to the Vendor's breach.

14.3 Mutual Indemnity

Each party shall indemnify the other against any third-party claims brought by Data Subjects arising from that party's breach of Applicable Data Protection Law in connection with this DPA, to the extent the claim is attributable to that party's breach.