Data Processing Agreement (DPA)

1. Scope & roles

For account and inventory data relating to your own business, you are typically the Controller and we act as Processor. For account authentication data necessary to operate the Service, we may act as an independent Controller — see our Privacy Policy.

2. Subject matter & duration

Processing covers inventory, sales, orders, imports, settings, and related metadata you store in the Service. Processing continues for the term of your account and until deletion is complete.

3. Processor obligations

• Process personal data only on documented instructions (your use of the Service and these Terms)
• Ensure personnel confidentiality
• Implement appropriate technical and organisational security measures
• Assist with data subject requests where feasible
• Notify you without undue delay of personal data breaches affecting your data
• Delete or return data upon account deletion, subject to legal retention

4. Subprocessors

We use the following key subprocessors:

• Google LLC (Firebase) — authentication, database (Firestore), hosting. EU/US processing with SCCs.
• Vercel Inc. — application hosting (if deployed on Vercel). EU/US processing.

We will inform you of material subprocessor changes where required. Objections may be raised via privacy@couchcardtrading.com.

5. International transfers

Where data is transferred outside the EEA, we rely on Standard Contractual Clauses (SCCs) and supplementary measures as provided by our subprocessors, in particular Google's DPA for Firebase services.

6. Audits

Upon reasonable request, we will provide information necessary to demonstrate compliance, including processor certifications or summaries of security practices, subject to confidentiality.

7. Liability

Liability under this DPA is subject to the limitation of liability in our Terms of Service, except where mandatory GDPR provisions apply.

8. Contact

Data protection inquiries: privacy@couchcardtrading.com