Restora Data Processing Terms
Last updated: [date]
These terms form part of the Restora Terms of Service. They cover personal data we process on your behalf, as GDPR Article 28 requires.
1. Roles
- For data in your Square item library: you're the controller and we're the processor. Item data is mostly not personal data, but it can include some, such as a name in an item description or a sole trader's business name.
- For your account, billing and contact details: we're the controller, and the Privacy Policy applies.
2. What we process
| Subject matter | Backing up, showing and restoring your Square item library |
| Duration | While you're subscribed, plus 30 days |
| Nature | Collecting, storing, comparing and, when you ask, writing back to Square |
| Data | Item library data as listed in the Privacy Policy, section 2 |
| Data subjects | People named in your item library, if any |
3. Our commitments
We will: - process the data only to provide Restora, or on your documented instructions - make sure anyone with access is bound by confidentiality - keep the security measures below in place - help you respond to data subject requests, where they concern data we hold - tell you without undue delay, and within 48 hours of finding out, about any personal data breach affecting your data - delete your data 30 days after your subscription ends - give you the information you reasonably need to check we're meeting these terms
4. Security measures
- Square access tokens are encrypted before storage.
- Each shop's data is kept separate, and no shop can access another's.
- Stored files are private.
- All data in transit uses HTTPS.
- Messages from Square and Stripe are signature-checked.
- Access to production systems is limited to B-Side Apps.
- Automated daily checks report errors and missed backups.
5. Sub-processors
You authorise us to use:
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase Inc. | Database, storage and server functions | EU (Ireland) |
| Resend | Email delivery | EU (Ireland), with transfers to the United States |
| Cloudflare, Inc. | Hosting the website and dashboard | Global |
We'll email you at least 30 days before adding or replacing a sub-processor. If you object, you can cancel, and we'll refund the unused part of any prepaid period. Each sub-processor is bound by data protection terms at least as protective as these.
6. Transfers outside the EU
Where a sub-processor processes data outside the EU, the transfer relies on Standard Contractual Clauses or another lawful safeguard.