Data Processing Agreement

1. Scope & roles

This Data Processing Agreement ("DPA") applies whenever Customer Data processed by Huup Ltd ("Huup") on behalf of a customer ("Customer") includes personal data as defined in the UK GDPR and/or Regulation (EU) 2016/679 ("EU GDPR"), whichever applies to the Customer. For that processing the Customer is the controller and Huup is the processor within the meaning of Article 28 UK GDPR and Article 28 EU GDPR. This DPA is incorporated into the Huup Terms of Service; accepting the Terms constitutes acceptance of this DPA and satisfies the Customer's obligation to conclude a written processor agreement. For personal data Huup collects for its own purposes (account, billing, marketing site), Huup is the controller and the Privacy Policy applies instead.

2. Details of processing

Subject matter & duration: the multi-channel commerce services described in the Terms, for the term of the Customer's subscription plus the deletion period in section 9.

Nature & purpose: synchronising the Customer's marketplace orders and listings; producing shipping labels; processing returns; routing and answering end-customer messages (including AI-assisted reply drafting); reporting.

Categories of data subjects: the Customer's end-customers (buyers) on connected sales channels; the Customer's staff users.

Categories of personal data: buyer name, delivery address, email address (marketplace alias where provided by the channel), phone number; order contents and identifiers; message content. No special-category data is required or intended to be processed. Payment card data is not processed — payments remain on the marketplace or payment provider.

3. Documented instructions

Huup processes personal data only on the Customer's documented instructions, including with regard to international transfers, unless required to do otherwise by law (in which case Huup informs the Customer before processing, unless the law prohibits this). The Customer's complete documented instructions consist of: (a) the Terms and this DPA; (b) the Customer's configuration choices in the Huup dashboard (connected channels, shipping carriers, enabled features); and (c) the Customer's use of platform functions (for example, requesting a shipping label instructs Huup to disclose the recipient's details to the selected carrier for that order). Huup will inform the Customer if, in its opinion, an instruction infringes applicable data protection law.

4. Confidentiality

Persons authorised by Huup to process personal data are bound by contractual or statutory obligations of confidentiality.

5. Security

Huup implements appropriate technical and organisational measures under Article 32, including: TLS 1.2+ encryption in transit; AES-256 encryption at rest with AWS-managed keys; physically separate databases per customer (database-per-tenant); named administrative accounts with enforced multi-factor authentication; role-based access control; audit logging; separation of test and production data; regular backups; and a maintained information security policy and incident response plan. A current summary is published on the Security page.

6. Sub-processors

The Customer generally authorises Huup to engage sub-processors. Current sub-processors: Amazon Web Services (cloud hosting — UK/EU regions) and Anthropic (AI inference for optional AI features; buyer-authored text is masked of contact-detail shapes before submission, and Anthropic may not train models on this data). Shipping carriers (for example FedEx, DPD, Evri, Royal Mail) receive recipient details on the Customer's per-order instruction and act as independent controllers, not sub-processors. Huup will give at least 30 days' notice before adding a sub-processor that processes Customer personal data; the Customer may object on reasonable data-protection grounds. Huup imposes data-protection obligations on each sub-processor equivalent to those in this DPA and remains liable for their performance.

7. Data subject rights

Taking into account the nature of the processing, Huup assists the Customer with appropriate technical and organisational measures to fulfil data subject requests (access, rectification, erasure, restriction, portability, objection). Requests received directly by Huup that concern the Customer's data are forwarded to the Customer without undue delay.

8. Personal data breach

Huup notifies the Customer without undue delay after becoming aware of a personal data breach affecting the Customer's personal data, and provides the information reasonably required for the Customer's own notification obligations under Articles 33 and 34. Huup maintains an incident response plan and cooperates with the Customer's investigation.

9. Retention, deletion & return

Buyer personal data obtained from a connected marketplace is retained no longer than that marketplace's data-protection rules allow — for Amazon Selling Partner API data, buyer personal data is deleted 28 days after the order date, and channel-specific windows are applied where a channel imposes shorter ones. Upon termination of the Services, Huup deletes the Customer's personal data (or returns it at the Customer's choice) and deletes existing copies, unless applicable law requires continued storage; non-personal order and financial records may be retained for statutory accounting periods.

10. International transfers

Customer Data is hosted in AWS UK/EU regions by default. Transfers of personal data from the EEA to the United Kingdom are covered by the European Commission's adequacy decisions for the United Kingdom, renewed on 19 December 2025 and valid until 27 December 2031. Where processing necessarily involves a transfer outside the UK and EEA (for example a marketplace API endpoint or a sub-processor in the United States), Huup relies on appropriate safeguards: EU Standard Contractual Clauses (2021), the UK International Data Transfer Agreement or Addendum, and supplementary measures including encryption in transit and at rest.

11. Audit & information

Huup makes available the information reasonably necessary to demonstrate compliance with Article 28 — including its Record of Processing Activities, security policies and third-party assessment records — and allows for and contributes to audits conducted by the Customer or its mandated auditor, subject to reasonable notice, confidentiality and at most once per 12 months unless required by a supervisory authority or following a breach.

12. Marketplace-specific terms

Connected channels impose their own data-protection terms which flow through to the Customer's use of Huup. In particular, for Amazon Selling Partner API data the Customer expressly instructs Huup to retrieve and process order and buyer information solely to provide the Services (order management, shipping-label production, returns) in accordance with the Amazon Data Protection Policy — including its retention, deletion and non-disclosure requirements. Equivalent channel requirements apply to other connected marketplaces. Huup does not use marketplace buyer data for advertising, profiling unrelated to the Services, or model training, and does not sell it.

13. Precedence, liability & law

In the event of conflict regarding the processing of personal data, this DPA prevails over the Terms. Liability under this DPA is subject to the limitations of liability in the Terms. This DPA is governed by the laws of England & Wales. Where the Customer is established in the EEA, this DPA is without prejudice to the mandatory provisions of the EU GDPR, which prevail over any conflicting term.

14. Contact

Data-protection enquiries about this DPA: