Data Processing Agreement

This Data Processing Agreement (“DPA“) forms part of the Terms of Service under which Colourmedia Solutions Ltd, a company registered in England and Wales (company number 9703935), whose registered office is at Unit C, Moorhouse Courtyard, Warwick-on-Eden, Carlisle, Cumbria, CA4 8PA (“Colourmedia“, the “Processor“), provides PushWMS to the merchant named in the account (“Merchant“, the “Controller“) (the “Agreement“). It applies whenever Colourmedia processes personal data for the Merchant in providing PushWMS, and meets Article 28 of the UK GDPR and the EU GDPR. If this DPA and the Agreement conflict about personal data, this DPA wins. It takes effect when the Merchant accepts the Agreement; a countersigned copy is available from privacy@pushwms.com.

1. Definitions

“Data Protection Law” means the UK GDPR, the Data Protection Act 2018, PECR and, where it applies to the Merchant, the EU GDPR and national laws implementing it. “Personal data“, “processing“, “controller“, “processor“, “data subject“, “personal data breach” and “supervisory authority” have the meanings in Data Protection Law. “Merchant Personal Data” means personal data processed by Colourmedia for the Merchant under the Agreement, described in Annex 1. “Sub-processor” means a third party Colourmedia engages to process Merchant Personal Data.

2. Roles and instructions

2.1 The Merchant is the controller and Colourmedia the processor of Merchant Personal Data.

2.2 Colourmedia processes Merchant Personal Data only on the Merchant’s documented instructions, including about transfers outside the UK and EEA, unless the law requires otherwise (in which case Colourmedia tells the Merchant first, unless the law forbids it). The Agreement, this DPA, and the Merchant’s use and configuration of PushWMS (connecting channels and couriers, switching on emails or pack video, choosing retention, answering requests on Setup → Privacy) are the Merchant’s complete instructions.

2.3 Colourmedia tells the Merchant straight away if it believes an instruction breaks Data Protection Law.

2.4 The Merchant is responsible for having a lawful basis for the processing, giving its shoppers and staff the information Data Protection Law requires (including before switching on pack desk video), and the accuracy of the data it brings into PushWMS. The Merchant will not put special category data or criminal offence data into PushWMS (for example in order notes or custom fields).

3. Confidentiality

Colourmedia makes sure everyone authorised to process Merchant Personal Data is bound by a duty of confidentiality and has access only as needed for their role.

4. Security

Colourmedia implements and keeps the technical and organisational measures in Annex 2, appropriate to the risk, as Article 32 requires. Colourmedia may update them so long as the overall level of protection does not go down.

5. Personal data breaches

5.1 Colourmedia notifies the Merchant without undue delay, and in any case within 24 hours of becoming aware of a personal data breach affecting Merchant Personal Data, with what it knows at the time: the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences, the measures taken or proposed, and a contact point. It follows with updates as it learns more.

5.2 Colourmedia takes reasonable steps to contain and remedy the breach, and helps the Merchant meet its obligations to notify supervisory authorities and data subjects. Colourmedia does not notify the Merchant’s data subjects or supervisory authority on the Merchant’s behalf unless the Merchant asks or the law requires.

6. Sub-processors

6.1 The Merchant gives general authorisation for Colourmedia to engage sub-processors. The current list is in Annex 3 and in our Privacy Policy.

6.2 Colourmedia tells the Merchant by email at least 30 days before adding or replacing a sub-processor. The Merchant may object in writing within that period on reasonable data protection grounds. The parties will discuss the objection in good faith; if it cannot be resolved, the Merchant may end the affected part of the Agreement without penalty and receive a pro-rata refund of fees paid in advance.

6.3 Colourmedia imposes on each sub-processor, by written contract, data protection obligations no less protective than this DPA, and remains liable to the Merchant for its sub-processors’ performance.

6.4 Sales channels, couriers and accounting software that the Merchant connects to PushWMS are not Colourmedia’s sub-processors. The Merchant instructs Colourmedia to exchange data with them, and the Merchant’s own terms with them govern their processing.

7. Data subject rights

Taking into account the nature of the processing, Colourmedia helps the Merchant respond to requests from data subjects:

(a) PushWMS lets the Merchant find a shopper’s orders, download a copy of their data in a machine-readable format, and remove their details (Setup → Privacy);

(b) Colourmedia passes any request it receives directly to the Merchant within 2 working days and does not answer it except on the Merchant’s instructions;

(c) where the Merchant cannot answer a request using PushWMS, Colourmedia helps within 10 working days of being asked.

8. Assistance

Colourmedia gives the Merchant reasonable help with data protection impact assessments and prior consultation with supervisory authorities about PushWMS, taking into account the information available to it. Colourmedia provides a DPIA template for pack desk video.

9. Transfers

9.1 Colourmedia stores and processes Merchant Personal Data in the United Kingdom (AWS London region). Colourmedia does not transfer Merchant Personal Data outside the UK (or, for a Merchant subject to the EU GDPR, outside the EEA and countries with an EU adequacy decision, which include the UK) except as listed in Annex 3 or on the Merchant’s instructions.

9.2 Where a transfer needs a safeguard, the parties rely on the UK International Data Transfer Agreement or Addendum, or the EU Standard Contractual Clauses (Module 2 or 3 as applicable), which are incorporated by reference for that purpose.

10. Return and deletion

10.1 During the Agreement the Merchant can export its data from PushWMS and remove shoppers’ details itself.

10.2 When the Agreement ends, or on the Merchant’s written request, Colourmedia deletes Merchant Personal Data from PushWMS’s live systems within 30 days and confirms deletion in writing, unless the law requires it to keep it. Before then the Merchant may ask for an export. Data in encrypted backups is deleted as backups expire (at most 12 months) and is not restored except to recover from a disaster, after which deleted data is deleted again.

11. Information and audits

Colourmedia makes available to the Merchant the information needed to show compliance with Article 28, including its policies and answers to reasonable security questionnaires, and allows for and contributes to audits by the Merchant or an auditor it appoints, on at least 30 days’ notice, during business hours, no more than once a year (unless a supervisory authority requires it or after a personal data breach), subject to confidentiality, and at the Merchant’s cost.

12. Liability and term

Each party’s liability under this DPA is subject to the limits in the Agreement, except where Data Protection Law does not allow them. This DPA lasts as long as Colourmedia processes Merchant Personal Data.

13. Law

This DPA is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction, except where the EU Standard Contractual Clauses require the law and courts of an EU member state.

Annex 1: Details of processing

Annex 2: Technical and organisational measures

• Hosting in the UK on AWS (London), in a private network; only the load balancer is reachable from the internet; web application firewall, Amazon GuardDuty threat detection, security alerts to the Security Owner.
• Encryption in transit (TLS 1.2+) and at rest (AWS KMS, AES-256) for the database, backups, files, videos and logs; channel and courier credentials and two-step secrets are additionally envelope-encrypted per merchant.
• Separation of merchants: every table carries the merchant’s id and PostgreSQL row-level security returns only that merchant’s rows; the application’s database role cannot bypass it.
• Access: role-based permissions per area; owners and admins always use two-step sign-in; passwords of at least 12 characters with a symbol, hashed with scrypt, expiring after 365 days; sessions end after 8 hours idle or 24 hours; sign-in rate limits; sign-in log kept 12 months. Colourmedia staff access production only through AWS IAM with multi-factor authentication, on a least-privilege basis.
• Minimisation: only the channel permissions needed; tracking pages show no name, street, email or phone and open only with a random 32-character token; customer email recipients are kept masked; channels’ raw order copies are cut down once processed.
• Retention and deletion as in Annex 1; automatic daily deletion job; shoppers’ details removable on request.
• Resilience: daily and monthly encrypted backups, 35-day point-in-time recovery, and a standby database in a second availability zone.
• Development: code review and automated tests on every change; dependencies kept up to date; infrastructure defined in code.
• People: confidentiality undertakings, annual data protection training, incident response plan tested yearly.

Annex 3: Sub-processors