Data processing agreement
When PriceSynergy processes personal data on your behalf, these terms apply. They form part of our terms of service.
Draft for review. This page will be finalised before PriceSynergy opens to new customers.
Last updated 12 October 2026.
1. Roles
You are the controller and TODO: registered company name is the processor of personal data we process for you in providing PriceSynergy ("customer personal data").
2. Details of the processing
| Subject matter | Providing the PriceSynergy service |
| Duration | Your subscription, plus up to 30 days for export and deletion |
| Nature and purpose | Collecting, storing, analysing and displaying marketplace data read with your API keys |
| Data subjects | Your staff who use the app, and any of your marketplace customers identifiable from data the marketplace provides |
| Personal data | Your users' names and work emails. From marketplace orders we store order and line references, products, quantities, prices and dates, not shoppers' names or addresses |
| Special category data | None intended |
3. Our obligations
- We process customer personal data only on your documented instructions, which are these terms and your use of the service, unless the law requires otherwise.
- Everyone who can access it is bound by confidentiality.
- We apply appropriate technical and organisational security measures, including UK hosting, encryption in transit, encrypted API keys, access controls and audit logging.
- We help you respond to data subject requests and meet your obligations on security, breach notification and impact assessments.
- We tell you without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting your data.
- At the end of the service we delete customer personal data within 30 days, unless the law requires us to keep it.
- We make available the information needed to show compliance, and allow reasonable audits on 30 days' notice, no more than once a year.
4. Sub-processors
You authorise these sub-processors. We'll give you at least 30 days' notice of a new one, and you may object on reasonable grounds.
| Sub-processor | Purpose | Location |
|---|---|---|
| Microsoft (Azure) | Hosting, databases, storage and sending email | UK |
| Stripe | Card payments and invoices | UK, EU and US |
| GoCardless | Direct Debit payments | UK and EU |
| HubSpot | Website analytics (with consent), demo requests and customer relationship management | EU and US |
| Sign in with Google (when you choose it) | Global | |
| Anthropic | Answering questions typed into the Ask feature. Only the question and field names are sent, never product data | US |
5. International transfers
Customer marketplace data is hosted in the UK. Where a sub-processor transfers personal data outside the UK, we use UK adequacy regulations or the UK International Data Transfer Agreement or Addendum.
6. Signed copy
Need a countersigned copy for your records? Email privacy@pricesynergy.io.