This Data Processing Agreement (DPA) applies where Plaza Store processes customer personal data on your behalf. The merchant is generally the controller for its store customers and Plaza is its processor, except where Plaza processes data for its own independent purposes as described in the Privacy Policy.
1. Definitions
Controller: the customer (you). Processor: Plaza Store. Personal Data: any information relating to an identified or identifiable person processed in connection with the service.
2. Processing Instructions
Plaza Store processes personal data only on documented instructions from the controller. These instructions are defined by your configuration of the service.
3. Sub-processors
Plaza may appoint subprocessors to provide infrastructure, communications, payments, support, security, and analytics functions. Plaza remains responsible for imposing appropriate data-protection obligations on subprocessors. The current subprocessor list and the method for receiving material-change notices will be published or provided on request; this agreement does not name a provider that is not actually used in production.
4. Security Measures
We maintain technical and organisational measures appropriate to the risk, including transport encryption, access control, tenant-scoped authorization, logging, backups, vulnerability management, and incident response. Specific contractual security commitments, certifications, or data-residency arrangements apply only when documented in the applicable service order.
5. Data Subject Rights
Taking into account the nature of the processing, we provide reasonable assistance with valid data-subject requests and regulatory obligations. Response timing depends on the request, applicable statutory deadline, and information reasonably available to Plaza.
6. Breach Notification
We will notify the affected merchant without undue delay after becoming aware of a confirmed personal-data breach involving that merchant's customer data, and provide available information needed for the merchant to meet applicable notification duties.
7. Data Transfers
Customer data may be processed in countries where Plaza and its authorized subprocessors operate. Plaza will use a lawful transfer mechanism where applicable law requires one. A particular hosting region or residency commitment applies only when confirmed in a signed service order.
Questions about this document? Contact our legal team