DRAFT: lawyer review required before launch. This text is a starting point, not legal advice.
Data Processing Agreement
Version 2026-10-25 · Questions: support@getbuzzfree.com
Roles
For customer order data the business is the controller and we are the processor. We process it only to provide the service and on the business's documented instructions.
What we process
Order numbers and status, optional first names or items entered by staff, a random tracking link, and alert subscription addresses for customers who switch alerts on.
Our promises
We keep the data confidential, limit access to people who need it, stop customer links after 12 hours and delete alert addresses, phone links and receipt checks about an hour after an order is collected, cancelled or expires (always within 24 hours), help the business answer privacy requests, tell the business without undue delay if we learn of a breach (see our incident process), and delete or return data when the account closes. Individual order records are deleted automatically after 30 days or the period the business chose in its dashboard (7 days to 1 year); a daily summary per branch without personal data is kept for the business's reports.
Security
Encryption in transit and at rest, access limited by business and role, secrets kept out of code and logs, an audit log of administrator and staff actions, and regular dependency checks. See the security page.
Sub-processors
The business agrees to the providers listed on our sub-processors page and we will tell it before adding or replacing one.
Transfers
Data is stored in the European Union. Transfers outside it are covered by standard contractual protections.
Audits
On reasonable request we provide the information needed to show we follow this agreement.