Data processing summary
The full Art. 28 GDPR agreement is signed with the service contract.
- Roles. The customer is controller; SiteQuilt is processor for data entered in the platform.
- Instructions. We process data only on the customer's documented instructions and the contract.
- Data categories. Customer staff users (name, email, role, activity logs); operational data (orders, receipts, stock); where applicable, the customer's end clients (e.g. name and phone for delivery).
- Confidentiality. Staff with access are bound by confidentiality.
- Security (Art. 32). Encryption in transit, role-based access, backups, audit logs, tenant data separation.
- Sub-processors. Hosting provider, email provider, payment processor (where applicable). Current list on request; customers are notified before changes and may object. All sub-processors process data in the EU/EEA.
- Assistance. We help with data subject requests, impact assessments and authority enquiries.
- Breaches. We notify the customer without undue delay, at most 48 hours after becoming aware of a personal data breach.
- Audits. We provide information needed to demonstrate compliance; audits with reasonable notice.
- End of contract. Export available for 30 days, then deletion, including from backups within their rotation cycle, except data we must retain by law.