Data Processing Agreement

We must process personal data only on your documented instructions. This includes instructions about international transfers. Your documented instructions are:

• your use of the platform's features,
• the Terms, and
• this DPA.

One exception applies: EU or member-state law may require us to process differently. If it does, we must inform you, unless that law prohibits it. We must also tell you if we believe an instruction infringes the GDPR.

A sub-processor is another company we engage to process personal data on your behalf. You give us general permission to use the sub-processors listed in Annex 3. We must bind each sub-processor to data-protection obligations at least as protective as this DPA. We remain fully liable to you for their work. If we intend to add or replace a sub-processor:

• we must publish the addition or replacement at least 30 days before it takes effect in the published sub-processor list, and
• you may object on reasonable data-protection grounds.

If we must replace a sub-processor urgently to keep the service secure or running, we may act first. We must then notify you promptly, and your right to object still applies.

Data subjects are the people the personal data is about. Under Chapter III of the GDPR, they may ask you to:

• give them access to their data (access),
• correct it (rectification),
• delete it (erasure),
• limit how it is used (restriction),
• hand it over in a portable format (portability), and
• stop certain processing (objection).

We must help you respond to those requests, with appropriate technical and organisational measures, as far as possible. Our help takes account of the nature of the processing. The platform provides self-service data export (Art 20) and a deletion request flow (Art 17). Where self-service is not enough, our support team must assist. If a data subject contacts us directly about your data, we must refer them to you.

You have duties of your own under Articles 32 to 36 of the GDPR. They cover:

• security of processing,
• notifying personal data breaches,
• data-protection impact assessments, and
• prior consultation.

We must help you meet those duties. Our help takes account of the nature of the processing and the information available to us.

Primary processing takes place in the EU. Where a sub-processor in Annex 3 processes personal data outside the EEA, we make the transfer under:

• the European Commission's Standard Contractual Clauses (SCCs), a pre-approved contract for transfers outside the EEA,
• the EU-US Data Privacy Framework, where it applies, and
• any supplementary measures the transfer requires.

Where product research is enabled, PostHog EU receives route templates and fixed action labels through Stockisto's proxy. Without acceptance, each event has a new random identifier and cannot link visits. The proxy removes IP and forwarding headers. No browser storage does not, by itself, make collection exempt from privacy law; the legal assessment of this unlinked collection remains open.

Acceptance permits a browser research identifier and masked session replay. Form values, page text and request bodies are excluded. Marketing and the portals share a consent preference; Find has a separate choice for each market. The Locator has no research tracking or choice switch. GA4 and GTM are dormant in this research setup.

Configured company inference can use locally downloaded IPinfo network-owner data or an evidenced business email domain. A network owner or domain is not proof of a visitor's employer or identity. We assess this limited business inference under legitimate interest; you may object. IP address data is powered by IPinfo. Security IP logs are separate from product research.

You can withdraw acceptance in Cookie choices and request access, export or erasure at privacy@stockisto.com. Withdrawal stops consented browser capture and removes its local research identifier; it does not undo earlier processing. Stockisto's raw discovery events have an enforced 30-day retention limit, are included in tenant export and erased with personal data; de-identified aggregates survive. That limit is not a PostHog retention guarantee. PostHog provider retention, export and erasure need separate verification before collection relying on them is activated. Primary hosting is Azure Sweden Central; PostHog uses EU endpoints. Any third-country access requires the applicable transfer safeguards in the DPA, including SCCs. We do not promise that all processing stays in the EU.

• Subject-matter & duration: processing personal data to provide the Stockisto record of the channel, for the term of the agreement.
• Nature & purpose: hosting, storage, retrieval, structuring, analysis and transmission of data to operate the Locator, Widget, admin apps, Installer Portal and related communications.
• Categories of data subjects: the Customer's account users; retailer business contacts in the Customer's network; installers; and consumers who submit a “reserve & collect” request.
• Categories of personal data: names, work contact details (email, phone), business addresses, roles, authentication identifiers, and consumer reservation details (name, email, phone, free-text notes).
• Special categories: none are required or intended; the platform is not designed to process special-category data (Art 9).

• Encryption in transit: all traffic served over TLS 1.2+ with HSTS; TLS terminated at the edge (Azure Front Door) with a managed web application firewall.
• Encryption at rest: the PostgreSQL database and object storage use Azure-managed storage encryption.
• Tenant isolation: enforced in the data layer via global query filters plus an insert-time guard, and continuously regression-tested by a dedicated cross-tenant test suite in CI.
• Access control: role-based access control with scoped roles; every authorisation decision is enforced server-side.
• Authentication: short-lived JWT access tokens with a rotating refresh token in an HttpOnly, Secure cookie (reuse detection); Google OAuth and single-use magic links.
• Audit logging: privileged tenant actions recorded to an append-first audit log retained for 7 years.
• Secrets management: credentials held in Azure Key Vault; the application fails fast at startup if security-critical configuration is missing.
• Network hardening: restrictive security headers on every response, per-tenant/per-client rate limiting, and automatic abuse blocking.
• Data minimisation in logs: direct identifiers (e.g. email) are kept out of application logs and telemetry; client IPs are not persisted in analytics.
• Backups & resilience: point-in-time backups retained up to 35 days, geo-redundant within the EU, with defined recovery objectives.
• Vulnerability management: dependency scanning and static analysis in CI, and a responsible-disclosure channel at security@stockisto.com.

★ Engaged only when the corresponding feature is enabled and configured.