Data processing

For personal information about your shoppers, you are the controller and we are the processor. You decide what is collected and why; we process it to provide the platform, on your instructions.

For personal information about you as a merchant, we are the controller — see the privacy policy.

• To process shopper personal information only to provide the service, and on your documented instructions, unless the law requires otherwise.
• To keep it confidential and to bind our staff and contractors to confidentiality.
• To apply appropriate technical and organisational security measures.
• To engage sub-processors only under equivalent obligations, and to keep the list below current.
• To assist you, so far as is reasonable, with responding to individuals exercising their rights.
• To notify you without undue delay after becoming aware of a personal data breach affecting your shoppers.
• To delete or return the information at the end of the agreement, subject to retention the law requires.

These are the third parties that may process personal information in the course of running the platform. We will give notice before adding one that materially changes the position.

Not every merchant’s shop engages every provider. Blockchain-related providers are involved only where a shop uses those features.

The providers above process data outside Australia. Where personal information originating in the European Economic Area or the United Kingdom is transferred, it is done under the relevant standard contractual clauses or an equivalent lawful mechanism.

If your own compliance requires a countersigned agreement, email legal@stashed.one and we will arrange one.