Last updated: 15 September 2026
This Data Processing Addendum ("DPA") forms part of the Terms of Service between you and MyShopRender Ltd, a company registered in England and Wales (Company No. 17225592), registered with the UK Information Commissioner’s Office under reference ZC234505.
It applies automatically, with no separate signature, whenever we process personal data on your behalf in the course of providing the service. It takes effect when you accept the Terms and continues for as long as we process personal data for you.
Terms such as controller, processor, personal data, processing, data subject and personal data breach have the meanings given to them in the UK GDPR and the Data Protection Act 2018 (together, Data Protection Law).
If you require a countersigned copy of this DPA for your own records, contact us at [email protected] and we will provide one.
We want to be straightforward about this rather than describe the whole service as processing on your behalf, because it is not.
We are the controller of the personal data that arises from your relationship with us: your email address, your subscription and billing status, your usage counts, the listing copy we generate for you, your marketplace connection tokens, and the limited technical data described in our Privacy Policy. For all of that, our Privacy Policy governs, not this DPA.
We are your processor only in respect of personal data belonging to third parties that you put into the service, which in practice means personal data that happens to appear in the product photographs you upload. A person visible in a photograph, a name or address on a label or packet in shot, or similar incidental content. This DPA governs that processing.
We do not receive, store, or have access to your buyers’ names, addresses, order details, messages, or payment information. Nothing in the service is designed to process your customer records, and you should not upload them.
Where we act as your processor, we will:
You give us general written authorisation to engage subprocessors. Our current subprocessors are:
We will give you at least 30 days’ notice by email before adding or replacing a subprocessor that processes personal data under this DPA. You may object on reasonable data protection grounds within that period. If we cannot offer a reasonable alternative, you may terminate your subscription and we will refund any unused portion of your current billing period.
We remain liable to you for the performance of each subprocessor’s obligations.
Our infrastructure and AI providers are in the United States, so personal data processed under this DPA is transferred outside the United Kingdom. Those transfers are made under the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or under the EU-US or Swiss-US Data Privacy Framework where the recipient is certified, or under the EU Standard Contractual Clauses.
We will not transfer personal data to a jurisdiction without an adequacy decision unless an appropriate safeguard under Chapter V of the UK GDPR is in place.
We maintain technical and organisational measures appropriate to the risk, including:
We may update these measures over time, provided the level of security is not reduced.
We will notify you without undue delay, and in any event within 72 hours, of becoming aware of a personal data breach affecting personal data we process on your behalf. Our notification will describe the nature of the breach, the likely consequences, and the measures taken or proposed, to the extent that information is available to us.
We will cooperate with you and take the steps you reasonably request to assist your own investigation and your notification obligations. Our notifying you is not an acknowledgement of fault or liability.
Uploaded photographs are not retained by us. They are processed in memory and discarded once your listing copy is returned.
On termination of your subscription, or at your written request at any time, we will delete the personal data we hold in connection with your account. Deleting your account erases your seller record, your marketplace connections, and your listing history. We will confirm deletion on request.
We may retain personal data where required by law, in which case we will continue to protect it and process it only for that purpose.
On reasonable written request, and no more than once in any twelve month period unless required by a supervisory authority, we will provide the information reasonably necessary to demonstrate our compliance with this DPA. Where that information is not sufficient, we will allow an audit by you or an independent auditor appointed by you, on reasonable notice, during business hours, subject to confidentiality, and in a manner that does not unreasonably disrupt our operations. You bear the cost of any audit you commission.
You are the controller of any third party personal data you put into the service. You are responsible for having a lawful basis for that processing, for the accuracy and legality of what you upload, and for giving whatever privacy information your own data subjects are entitled to.
You must not upload special category data, criminal offence data, children’s personal data, or your own customer records. If you do, you are responsible for the consequences and you will indemnify us in accordance with the Terms.
Claims under this DPA are subject to the exclusions and limitations in the Terms of Service, including the limitation of liability in section 10 of those Terms.
Where this DPA conflicts with the Terms or our Privacy Policy, this DPA prevails in respect of the processing it governs. Where it conflicts with Standard Contractual Clauses entered into between us, those Clauses prevail.
This DPA is governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction.
Data protection enquiries, data subject requests, and audit requests should go to [email protected]. We aim to respond within 5 business days.
MyShopRender Ltd, Lytchett House, 13 Freeland Park, Wareham Road, Poole, Dorset, BH16 6FA, England, United Kingdom. Company No. 17225592. ICO registration ZC234505.