Skip to content

Data processing agreement

How Elara One processes personal data on behalf of its customers, as UK GDPR Article 28 requires. Part of the customer terms.

Last updated

Draft — under legal review. This is a working draft. It may change before it takes effect, and the values marked in brackets are still to be confirmed.

In short

When your store holds personal data about your shoppers, leads and contacts, you are the controller and we are your processor.

This agreement sets out what we may do with that data (only what you instruct), how we protect it, who helps us and how we help you meet your own obligations.

It forms part of our customer terms automatically. You do not need to sign anything separately.

About this agreement

Elara One is a trading name of Elara Labs Ltd, a company registered in England and Wales with company number 17541993, whose registered office is at 128 City Road, London, United Kingdom, EC1V 2NX.

This data processing agreement ("DPA") forms part of the customer terms between Elara Labs Ltd and the customer. It applies whenever we process personal data on the customer's behalf, and meets the requirements of Article 28 of the UK GDPR and the Data Protection Act 2018. Where the EU GDPR applies to the customer's processing, references to the UK GDPR include the matching provisions of the EU GDPR.

Customer personal data
Personal data in customer data that we process on the customer's behalf.
Data protection law
The UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 and, where applicable, the EU GDPR.
Sub-processor
A third party we engage to process customer personal data.
Personal data breach, controller, processor, data subject
Have the meanings given in the UK GDPR.

Roles

The customer is the controller of customer personal data and we are its processor. The customer is responsible for having a lawful basis for the processing, for the notices it gives data subjects, and for the instructions it gives us.

We are a controller, not a processor, for the personal data we need to run our own business, such as account, billing and sign-in security data. Our privacy notice covers that.

Processing on instructions

  • We process customer personal data only on the customer's documented instructions, including with regard to transfers outside the UK, unless the law requires otherwise; if so, we will tell the customer first unless the law forbids it.
  • The customer's instructions are these terms, this DPA, and the customer's configuration and use of the service, including the services it connects.
  • We will tell the customer promptly if we believe an instruction infringes data protection law.
  • Everyone we authorise to process customer personal data is bound by a duty of confidentiality.

Security

We implement appropriate technical and organisational measures to protect customer personal data, taking into account the state of the art, the cost, and the nature and risks of the processing, as Article 32 of the UK GDPR requires. The measures in place today are listed in Annex 2. We may improve them over time, but will not reduce the overall level of protection.

Sub-processors

  • The customer gives us general authorisation to engage sub-processors. The current list is on our sub-processors page.
  • We will give at least [30 days] notice before a new sub-processor starts processing customer personal data, by updating that page and emailing customers who have asked to be told (email [email protected]).
  • The customer may object on reasonable data protection grounds within that notice period. We will then discuss it in good faith; if we cannot resolve it, the customer may end the affected part of the service and receive a refund of any prepaid fees for the period after it ends.
  • Each sub-processor is bound by a written contract with data protection obligations no less protective than this DPA. We remain responsible to the customer for each sub-processor's performance.

International transfers

The application and live databases run in London, UK. Nightly encrypted backups are kept in the EU, which the UK recognises as giving adequate protection. Where a sub-processor processes customer personal data in a country without UK adequacy regulations, we make sure an appropriate safeguard is in place, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the UK–US data bridge where the recipient is certified.

Helping you meet your obligations

Data subject requests

The service includes tools for the most common requests: finding a person's data, exporting it, correcting it, adding them to a do-not-contact list, and erasing them. If we receive a request directly, we will pass it to the customer without undue delay and will not answer it ourselves unless the customer asks us to. Where the tools are not enough, we will help further, as far as reasonably possible.

Impact assessments and the regulator

We will give reasonable help with data protection impact assessments and prior consultations with the ICO, taking into account the nature of the processing and the information available to us.

Personal data breaches

We will notify the customer without undue delay, and in any event within [48 hours — confirm] of becoming aware of a personal data breach affecting customer personal data. The notice will describe, as far as we know at the time, what happened, the data and data subjects involved, the likely consequences, and what we have done and recommend. We will add details as we learn them, and take reasonable steps to contain the breach and reduce its effects.

Notifying a breach is not an admission of fault.

Deletion at the end

When the customer terms end, the customer may export its data for [30 days]. We then delete customer personal data from the live service. It ages out of nightly backups within 14 days and of the point-in-time recovery copy within 22 days, and is not restored into use in the meantime. We keep only what the law requires us to keep.

If a store is restored from a backup at any time, every erasure, unsubscribe and withdrawal of consent made since that backup was taken is carried out again before the store reopens.

Information and audits

We will make available the information reasonably needed to show compliance with this DPA, starting with our security page, this agreement and written answers to reasonable security questionnaires. If that is not enough, the customer, or an independent auditor bound by confidentiality, may audit our compliance once a year on at least [30 days] written notice, during business hours, in a way that does not disrupt the service or expose other customers' data. The customer bears its own costs. Audits required by a regulator are not limited to once a year.

Term and liability

This DPA lasts as long as we process customer personal data. Each party's liability under it is subject to the limits in the customer terms, except where data protection law does not allow them to apply. If this DPA conflicts with the customer terms, this DPA prevails on data protection matters.

Annex 1: Details of the processing

Item
Subject matter
Details
Providing the Elara One service: commerce, CRM, forms, automation, inbox and related features.
Item
Duration
Details
The term of the customer terms, plus the export and deletion periods in this DPA.
Item
Nature and purpose
Details
Hosting, storing, organising, retrieving, sending and deleting customer personal data so the customer can run its store, capture and manage leads, process orders, and communicate with its customers, as configured by the customer.
Item
Data subjects
Details
The customer's shoppers and customers, leads and contacts, people who submit its forms or message it, people at companies in its CRM, and the customer's own staff and users.
Item
Categories of data
Details
Names and contact details; delivery and billing addresses; orders, baskets and payment status (never full card numbers, which stay with Stripe or PayPal); messages, form answers and notes; marketing preferences, unsubscribes and consent records; activity log entries; and, where the customer enables analytics, pseudonymous browsing events.
Item
Special category data
Details
Not intended. The customer should not collect special category or criminal offence data through the service unless it has a lawful basis and has assessed the risk.

Annex 2: Security measures

Area
Separation of customers
Measures
Every store has its own database. Search indexes, cache keys and media paths are also kept apart per store.
Area
Users' access
Measures
Two-step sign-in is required for every staff account. Passkeys and recovery codes are supported. "Remember this device" lasts at most 30 days and each store can shorten it or switch it off. New-device emails include a "This wasn't me" link. Roles and permissions control what each user can do.
Area
Our staff's access
Measures
Our own operators use two-step sign-in with passkeys. Access is limited to what the job needs. Support cannot switch on email tracking for a store.
Area
Accountability
Measures
An activity log records staff actions in each store and is kept for 730 days.
Area
Encryption
Measures
All connections to the admin and the API use TLS. Backups are encrypted on our servers before they leave them, with a key that never leaves our servers.
Area
Backups and recovery
Measures
Nightly backups of every store's database, kept 14 days in EU storage, plus a point-in-time recovery copy in UK storage. A restore replays every erasure, unsubscribe and consent withdrawal made since the backup before the store reopens.
Area
API security
Measures
Storefront API keys work only from websites the store registers, server calls must carry a secret, cross-origin access is set per store and never open to all, and keys can be rotated with an overlap period. Merchant API keys carry scoped permissions. Outgoing webhooks are signed (HMAC-SHA256).
Area
Payments
Measures
Card data is entered with Stripe or PayPal and never reaches our servers.
Area
Data minimisation
Measures
No third-party tracking pixels by default. Email open and click tracking is off until the customer confirms a lawful basis; order and account emails are never tracked. Application logs exclude query strings and visitors' IP addresses and are kept 14 days.
Area
Abuse prevention
Measures
Spam checks (honeypot and Cloudflare Turnstile) on forms; rate limits on the API and on marketing email.
Area
Vulnerability handling
Measures
Security reports to [email protected], published in our security.txt. [Patch and vulnerability management cadence — confirm]

Annex 3: Sub-processors

The authorised sub-processors, with what each does and where, are listed on our sub-processors page, which forms part of this annex.