Data processing terms

These Data processing terms ("DPA") are part of the Terms of Service between Company legal name ("RepairDoc") and the shop ("you"). They apply when RepairDoc processes personal data on your behalf in providing the Service ("Shop Personal Data"). You are the controller (or "business") and RepairDoc is your processor (or "service provider"/"contractor").

If this DPA and the Terms conflict about personal data, this DPA wins. Where the EU or UK GDPR applies, the Standard Contractual Clauses described below win over both.

RepairDoc processes Shop Personal Data only to provide, secure and support the Service, as described in Annex 1, and on your documented instructions. Your use and configuration of the Service (for example turning on texts, connecting a payment provider or an AI app) are your instructions. If we think an instruction breaks the law we'll tell you.

Under US state privacy laws, RepairDoc will not: sell or share Shop Personal Data; retain, use or disclose it outside our direct business relationship with you or for any purpose other than the business purposes in these terms; or combine it with personal data from other sources except as those laws permit. We'll tell you if we can no longer meet these obligations, and you may take reasonable steps to stop unauthorized use.

You're responsible for having a lawful basis for the data you collect, giving people the notices the law requires (RepairDoc gives you a customer privacy notice and per-shop text terms to start from), getting consent for texts, and keeping your account's roles and permissions appropriate.

Everyone at RepairDoc who can access Shop Personal Data is bound by confidentiality and has access only as needed for their job. Support access is read-only, needs two-factor sign-in, and is logged.

RepairDoc maintains the technical and organisational measures in Annex 2, and may improve them over time but won't materially weaken them.

You authorise RepairDoc to use the sub-processors in Annex 3. Each is bound by written terms that protect the data at least as well as this DPA, and RepairDoc remains responsible for them.

We'll give at least 30 days' notice (in the app or by email) before adding or replacing a sub-processor. If you object on reasonable data protection grounds, we'll work with you on an alternative; if we can't find one, you may end the affected part of the Service and get a refund of prepaid fees for it.

Providers you choose to connect yourself (Stripe, Square, outside AI apps) act under your own agreements with them and are not our sub-processors for that data.

RepairDoc gives you tools to find, export, correct and delete customer and staff records, and to stop texts. If someone contacts us directly about their data in your shop, we'll pass the request on to you and not answer it ourselves unless you ask. We'll also give reasonable help with data protection impact assessments and regulator questions.

If RepairDoc becomes aware of a breach affecting Shop Personal Data, we'll notify you without undue delay, and where feasible within 72 hours, with what we know about what happened, the data and people affected, and what we're doing about it. We'll update you as we learn more. Notifying a breach isn't an admission of fault.

You can export your data at any time. When your account closes, we keep Shop Personal Data for 30 days so you can export it, then delete it, except where the law requires us to keep it. Backups are overwritten within 35 days.

On written request, no more than once a year (or after a breach or at a regulator's request), we'll give you information needed to show compliance with this DPA, such as answers to a security questionnaire and any third-party audit reports we have. If that isn't enough, you may audit us at your cost with 30 days' notice, under confidentiality, in a way that doesn't disrupt our other customers.

RepairDoc and its sub-processors may process data in the United States and other countries. For transfers out of the EU/EEA, the Standard Contractual Clauses (Module 2, controller to processor, and Module 3 where you are a processor) are incorporated by reference, with the UK Addendum for UK data and the Swiss amendments for Swiss data. Lawyer: complete SCC options (docking clause, Clause 9 option, Clause 17 law, Clause 18 courts).

• Tenant isolation: every query is scoped to the signed-in business; ids from the browser are checked against it.
• Access control: owner-editable roles and permissions; read-only, logged support access; two-factor sign-in for the RepairDoc team.
• Credentials: passwords and PINs stored with salted hashing; payment provider keys encrypted at rest (AES-GCM).
• Encryption in transit (HTTPS/TLS) everywhere; encryption at rest per hosting provider.
• Connected apps: OAuth 2.1 with PKCE, short-lived rotating tokens, revocable connections, confirmation before any write, rate limits, activity log.
• Payments: card data handled only by the payment provider; webhooks verified and applied once.
• Logging and monitoring of admin actions in an audit log; backups, restore testing, incident response plan, vulnerability management.