This Data Processing Addendum ("DPA") is part of the Terms of Service between the store owner (the "Controller") and Tocler (the "Processor"), operated by Tocler, an individual developer (not a registered company), for personal data of the Controller's store customers that Tocler processes to provide the Service.

1. Scope

• Subject matter: hosting and running the Controller's stores and Dashboard.
• Data subjects: the Controller's customers and visitors; the Controller's team members.
• Data: account data (email, username), order and delivery data, support tickets, refund requests, store credit, technical and security data (IP address, browser).
• Duration: while the Controller uses the Service, plus the deletion period below.

Processing that Tocler performs for itself — security, fraud and abuse prevention, report handling, payments that go through Tocler, accounting and legal obligations — is covered by the Privacy Policy.

2. Tocler's obligations

Tocler will:

1. process the data only on the Controller's documented instructions — given through the Terms and the use of the Dashboard — unless the law requires otherwise;
2. bind its staff to confidentiality and give access only through roles, 2-step login and logged actions;
3. apply appropriate security: encryption of keys and secrets at rest, HTTPS, password hashing, tenant isolation between stores, masked customer data with logged reveals, rate limiting and monitoring;
4. use sub-processors (hosting, database, caching, image storage, email delivery, bot protection) under written terms offering the same protection, and inform the Controller of changes on request or via this page;
5. help the Controller respond to data subject requests (the Dashboard and the buyer's own "Your data" tools support this);
6. notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data;
7. help with data protection impact assessments where reasonably required;
8. at the end of the Service, delete the Controller's customer data within 90 days, except records the law or Tocler's own obligations require keeping;
9. make available information needed to show compliance, and allow reasonable audits with notice, at most once a year unless required by an authority.

3. Controller's obligations

The Controller has a lawful basis to collect and use its customers' data, gives its customers any required notices (including about its own payment providers), only sends marketing to customers who agreed, and uses the Service's settings in line with its obligations.

4. International transfers

Where data is transferred internationally, Tocler relies on appropriate safeguards such as standard contractual clauses.

Contact for data protection: support@tocler.com.