Store Sync Data Processing Agreement

Effective date: 24 August 2026

This Store Sync Data Processing Agreement forms part of the Store Sync Terms Schedule between:

The organisation that installs, subscribes to or uses Store Sync, referred to as the Customer or Controller; and
JD Web Services Ltd trading as The Voice Concierge, company number 11453166, referred to as the Company, Processor, we or us.

By accepting the Store Sync Terms Schedule, the parties enter into this DPA. If this DPA conflicts with the Store Sync Terms Schedule about processing personal data, this DPA takes priority for that conflict.

1. Definitions

Terms including controller, processor, personal data, personal-data breach, processing, data subject and supervisory authority have the meanings given in applicable Data Protection Law.

Data Protection Law means the UK GDPR, the Data Protection Act 2018, PECR where applicable, and any replacement or amending UK data-protection legislation.

Customer Personal Data means personal data processed by us on behalf of the Customer through Store Sync.

Subprocessor means another processor appointed by us to process Customer Personal Data.

2. Scope and roles

The Customer is controller and we are processor for Customer Personal Data described in Annex 1.

The Customer determines the purposes and essential means of processing and is responsible for:

Having a lawful basis
Giving required privacy information
Issuing lawful documented instructions
Ensuring Store Sync is appropriate for the intended processing
Handling individual rights as controller
Meeting any controller security, DPIA, records and regulatory duties

We may act as an independent controller for separate information needed for our own account administration, security, fraud prevention, usage billing, tax, legal compliance and legal claims. That processing is governed by the Store Sync Privacy Notice and is outside this DPA except where the same information is also Customer Personal Data.

3. Controller instructions

We will process Customer Personal Data only:

To provide, secure and support Store Sync
As configured or initiated by the Customer’s authorised users, workflows, agents, APIs and connected platforms
As stated in the Store Sync Terms Schedule, Documentation and this DPA
Under other documented instructions agreed by the parties
Where UK law requires processing, in which case we will inform the Customer before processing unless the law prohibits notice

The Customer instructs us to perform the processing described in Annex 1 and to use the approved Subprocessors in Annex 3.

The Customer must ensure instructions comply with Data Protection Law. We are not responsible for deciding the Customer’s lawful basis or whether a particular customer communication is permitted under PECR.

4. Processor obligations

We will:

Process Customer Personal Data only on documented instructions
Ensure authorised personnel process it only as needed for their duties
Apply the measures described in Annex 2
Maintain records required of a processor under Data Protection Law
Assist the Customer as described in this DPA
Notify the Customer if we believe an instruction infringes Data Protection Law
Not sell Customer Personal Data
Not use Customer Personal Data for our independent marketing
Limit processing to what is necessary to supply and protect Store Sync

We may make ordinary technical and organisational decisions about how to deliver the instructed processing, provided they do not change the Customer’s purposes or materially expand processing.

5. Confidentiality

Personnel authorised to process Customer Personal Data must be subject to an appropriate statutory or contractual duty of confidentiality.

We restrict access according to role and operational need. Confidentiality obligations continue after a person’s access or engagement ends.

6. Security

Taking account of the state of the art, implementation cost, nature, scope, context and purposes of processing, and risk to individuals, we will maintain appropriate technical and organisational measures.

Current core measures are summarised in Annex 2. We may update measures to improve security, address threats or reflect technical change, provided the overall level of protection is not materially reduced.

The Customer is responsible for security under its control, including:

HighLevel and WooCommerce accounts
User access and multi-factor authentication
API keys and MCP secrets supplied to the Customer
Customer-selected AI agents, workflows and webhook destinations
Endpoint devices, networks and staff practices
Store, WordPress and plugin security

7. Subprocessors

The Customer gives general written authorisation for the Subprocessors in Annex 3 and for us to appoint replacement or additional Subprocessors needed to provide Store Sync.

We will:

Give reasonable advance notice of a material new Subprocessor where practical
Allow the Customer to object on reasonable data-protection grounds
Require the Subprocessor by contract to provide protections equivalent in substance to those required by Article 28
Remain responsible to the Customer for the Subprocessor’s performance of its data-protection obligations

An objection must be sent promptly and explain the data-protection grounds. The parties will work in good faith to find a reasonable solution. If no solution is reasonably available, either party may terminate the affected Store Sync Service without penalty for future subscription periods. Charges already incurred remain payable.

The Customer separately authorises platforms and destinations that it selects, configures or connects. Where the Customer independently selects an AI provider, MCP client, webhook destination, communications provider or WooCommerce host, that provider may be the Customer’s processor rather than our Subprocessor.

8. International transfers

We will not make a restricted transfer of Customer Personal Data unless:

The destination is covered by UK adequacy regulations
The UK International Data Transfer Agreement applies
The UK Addendum to the EU Standard Contractual Clauses applies
Another lawful transfer mechanism is available

We will implement additional safeguards where required by Data Protection Law and the transfer risk.

The Customer is responsible for transfers to its own selected recipients, including AI agents, MCP clients, workflows and webhook destinations.

9. Individual-rights requests

If we receive a request from an individual concerning Customer Personal Data, we will normally direct the person to the Customer unless prohibited by law.

Taking account of the nature of processing, we will provide reasonable assistance through available technical and organisational measures so the Customer can respond to requests concerning:

Access
Rectification
Erasure
Restriction
Objection
Portability
Automated decision-making rights

The Customer must provide enough information for us to identify the relevant tenant and data. We will not disclose another tenant’s information.

Reasonable standard assistance is included in the Service. Extensive custom work may be charged at an agreed rate where permitted by law.

10. Security incidents and personal-data breaches

We will notify the Customer without undue delay after becoming aware of a personal-data breach affecting Customer Personal Data.

As information becomes available, the notice will include where reasonably possible:

The nature of the breach
Categories and approximate number of affected individuals and records
Likely consequences
Measures taken or proposed
A contact for follow-up

Information may be provided in stages where it cannot be supplied at the same time.

We will take reasonable steps to contain, investigate and mitigate the breach and assist the Customer with its notification obligations.

Notification is not an admission of fault or liability. The Customer is responsible for deciding whether to notify the ICO, another regulator or affected individuals where it is controller.

11. DPIAs and regulatory consultation

Taking account of the processing and information available to us, we will provide reasonable assistance with:

Data protection impact assessments
Prior consultation with the ICO
Security and risk information relevant to Store Sync

The Customer remains responsible for completing its assessment and consulting the regulator where required.

12. Deletion or return

When Store Sync processing ends, the Customer may request return or deletion of Customer Personal Data.

Where Store Sync was included with a managed service, the included entitlement ending does not automatically transfer Store Sync data to a new agency, installation or subscription.

If the Customer purchases Store Sync separately after leaving our agency, any migration or continued use of existing Store Sync data will depend on technical availability, verified authority and a valid Store Sync installation. We do not guarantee that plan credits, usage history, billing status, credentials or agency-specific entitlements can be transferred.

We will delete or return Customer Personal Data within a reasonable period, subject to:

The Customer’s documented instructions
Published Store Sync operational retention periods
Secure backup cycles
Legal, accounting, security and claim-retention requirements
Information we hold separately as controller
The need to protect other tenants and platform security

Where we retain billing, credit transaction, wallet reconciliation or related financial records as an independent controller, our standard retention period is six years from the applicable billing period or final resolution of the transaction. Withdrawal records retained for our own legal obligations or the establishment, exercise or defence of legal claims may also be retained for up to six years from resolution.

Longer retention may apply where a dispute, reconciliation, legal claim or legal hold remains unresolved. These controller retention periods do not automatically apply to all Customer Personal Data processed on behalf of the Customer.

Where immediate backup deletion is not technically practical, the data will remain protected and beyond ordinary use until the relevant deletion or overwrite cycle completes.

Disconnecting WooCommerce, uninstalling Store Sync, ending an included agency entitlement and cancelling a paid Marketplace subscription are separate actions. The Customer must complete the applicable actions described in the Store Sync Terms Schedule.

13. Compliance information and audits

We will make available information reasonably necessary to demonstrate compliance with Article 28.

The Customer must first review available documentation, security information and audit reports. If those materials are not sufficient, the Customer may request an audit.

Audits must:

Be limited to Store Sync processing for the requesting Customer
Be conducted by an independent qualified auditor bound by confidentiality
Be arranged on at least 30 days’ notice, unless a material breach or regulator requires a shorter period
Occur no more than once in any 12-month period, unless there is a material incident or regulator requirement
Take place during normal business hours
Avoid access to another customer’s data, our secrets or information that would weaken security
Avoid unreasonable disruption

The Customer pays its audit costs and our reasonable assistance costs, unless the audit identifies our material breach of this DPA.

Nothing in this section restricts the lawful powers of the ICO.

14. Unlawful instructions

If we reasonably believe an instruction infringes Data Protection Law, we will inform the Customer and may suspend the affected processing until the instruction is changed, withdrawn or confirmed as lawful.

We may refuse an instruction that would compromise another tenant, disclose protected security information or require us to break the law.

15. Liability

The liability provisions and limitations in the main Terms and Store Sync Terms Schedule apply to this DPA as part of the same agreement.

Nothing limits liability that cannot lawfully be limited under Data Protection Law.

16. Duration and termination

This DPA begins when the Customer accepts the Store Sync Terms Schedule and continues while we process Customer Personal Data.

Obligations concerning confidentiality, security, deletion, audit evidence and liability continue for as long as relevant Customer Personal Data remains in our possession or control.

17. Governing law

This DPA is governed by the law of England and Wales. The courts of England and Wales have exclusive jurisdiction, subject to the regulatory powers of the ICO and other competent authorities.

18. Annex 1, processing details

Subject matter

Processing needed to provide Store Sync, an authorised integration between WooCommerce, HighLevel, compatible MCP clients, customer workflows and related Store Sync functions.

Duration

For the Store Sync customer relationship and the retention periods described in the Store Sync Privacy Notice, unless law or a documented Customer instruction requires otherwise.

Nature and purpose

Connecting authorised HighLevel and WooCommerce accounts
Retrieving and storing product and variation information
Processing price and stock updates
Retrieving synchronised product and stock information from the Store Sync catalogue, including updates received through authorised WooCommerce synchronisation and webhooks.
Building cart and checkout links
Checking and creating authorised coupons
Processing order-confirmed events and order lookups
Delivering workflow actions, triggers and internal webhooks
Registering back-in-stock interest
Processing withdrawal or cancellation requests
Providing authenticated MCP and products API access
Checking and recording setup assets
Providing support, reliability, audit and security functions

Types of personal data

Merchant and authorised-user names and business contact details
HighLevel location and contact identifiers
OAuth, API and webhook credentials
Shopper billing name, email address and telephone number
WooCommerce order ID, number, status, total, currency and date paid
Order line items, quantities, product names and totals
Payment method name and coupon codes
Back-in-stock product and contact relationship
Withdrawal or cancellation-request information
Workflow, MCP, API and support data
IP-derived, device, log, audit and security information

Store Sync does not require card numbers, card security codes or banking passwords.

Categories of data subjects

Customer owners, administrators and authorised users
WooCommerce shoppers and customers
HighLevel contacts
People requesting back-in-stock information
People submitting withdrawal or cancellation requests
Customer staff, contractors and agents whose activity is recorded

Processing operations

Collection, receipt, retrieval, organisation, storage, comparison, updating, encryption, decryption, transmission, display, logging, restriction and deletion.

Special-category data

Special-category and criminal-offence data is not required or intended for normal Store Sync operation. The Customer must not submit it unless the parties have expressly agreed the processing and safeguards in writing.

19. Annex 2, security measures

Current Store Sync measures include:

Access and tenant separation

Tenant-scoped application queries
Database Row Level Security
Separate connection credentials per tenant
Restricted administrator and customer access
Permission and plan checks before actions
Individually issued, profile-bound MCP credentials with independent rotation and revocation.
Credential-version verification and access restrictions based on tenant, subscription plan and permitted tools.

Encryption and secrets

TLS for data in transit
AES-256-GCM encryption for stored platform credentials and tokens
Protected API and MCP secret storage
Short-lived signed MCP access tokens
Server-side handling of OAuth and WooCommerce secrets

Webhook and request security

HighLevel webhook-signature verification
Per-connection WooCommerce webhook signatures
Replay and idempotency controls
Pre-authentication and authenticated rate limits
Validation of outbound webhook destinations

Logging and monitoring

System, audit, MCP and trigger logs
Secret and personal-data redaction
Authentication-failure and rate-limit records
Tenant-isolation security events
Billing and credit audit records
Pseudonymised IP identifiers and reduced network information for MCP security monitoring.
Separation of infrastructure verification failures from genuine authentication failures.
Defined security-log retention and scheduled cleanup controls.

Availability and recovery

Managed cloud infrastructure
Controlled deployment and testing
Retry and stale-job recovery for supported operations
Backup and recovery measures appropriate to the service
Incident-response processes

Development and governance

Restricted production secrets
Automated security and tenant-isolation tests
Dependency and configuration review
Data minimisation and retention controls
Subprocessor contracts and access restriction

20. Annex 3, approved subprocessors

The following providers or categories may process Customer Personal Data for Store Sync, depending on configuration:

Provider or category	Location or transfer position	Purpose
HighLevel and LeadConnector	Provider locations, subject to applicable transfer safeguards	Marketplace installation, OAuth, CRM, workflows, messaging and usage billing
Supabase	Selected managed cloud region and provider infrastructure	Store Sync database, authentication and server-side functions
Lovable	Provider infrastructure, subject to applicable transfer safeguards	Store Sync frontend application hosting and development services
Communications providers	Depends on Customer configuration	Email, SMS or conversation delivery for enabled workflows
Monitoring and support providers	Provider locations, subject to safeguards	Reliability, security alerts and customer support

The following are commonly Customer-selected independent providers rather than our Subprocessors:

Provider	Customer-controlled role
WooCommerce and WordPress host	The Customer selects and controls the commerce platform and hosting environment
AI agent or MCP client	The Customer selects the agent, prompts, permissions and retention
Internal webhook destination	The Customer selects and controls the receiving system

The latest subprocessor information is published through the GDPR and Data Processing page or supplied on request.

21. Contact

JD Web Services Ltd trading as The Voice Concierge
104 High Street, Mold, Flintshire, CH7 1BH
Company number: 11453166
Email: [email protected]

Store Sync