Parties, scope and acceptance
The Merchant is the controller and Astflick Group Limited, company number 05950580, is the processor for personal data handled to provide the Merchant’s Storechestra service. Group operates under licence from Astflick Holdings Ltd. Our registered office and correspondence address is Unit 7, Latham Road Business Park, Latham Road, Huntingdon, Cambridgeshire, PE29 6YE, United Kingdom; contact support@storechestra.co.uk. This addendum supplements the service agreement. Storechestra records authorised owner acceptance with workspace, agreement version and time; publication of a page alone is not represented as a signed acceptance.
Subject matter, duration and processing
Processing provides the multi-store service and enabled modules for the duration of the service, followed by the applicable return, deletion and restricted retention process. Operations include collecting data from connected stores, organising, storing, displaying, using for fulfilment and support, reporting, exporting and deleting it.
People and data
Data subjects include customers and prospective customers, merchant users and staff, suppliers and business contacts. Data may include names, email addresses, phone numbers, shipping and billing addresses, order identifiers and contents, delivery and returns records, customer-service messages, user roles and necessary access or audit records. Do not submit unnecessary special-category information or payment-card data.
Documented instructions
We process only documented instructions in the agreement, authorised configuration and use, including instructions concerning transfers, unless applicable law requires otherwise. Where legally permitted, we will inform the Merchant of that legal requirement before processing. We will inform the Merchant if an instruction appears to infringe applicable data-protection law. The Merchant is responsible for lawful collection, notices and instructions; marketing use must respect the recorded consent and opt-out decisions.
Confidentiality and security
Authorised personnel must be subject to confidentiality obligations. We maintain appropriate technical and organisational measures taking account of risk, including workspace and role controls, encrypted transport and storage, protection of credentials, audit logging and privacy-request controls. Contact us for current security information; no certification is implied by ICO registration.
Sub-processors and transfers
The Merchant generally authorises Cloudflare infrastructure and necessary providers for enabled services, including configured email delivery and selected integrations. We apply equivalent data-protection obligations to sub-processors, remain responsible for their obligations as required by law, and notify merchants of intended additions or replacements with an opportunity to object before the change. Request the current list or raise an objection at support@storechestra.co.uk. Restricted international transfers require an applicable lawful mechanism and safeguards. A Merchant’s independently contracted Shopify, carrier or accounting account remains subject to that provider’s agreement.
Assistance and incidents
Taking account of the nature of processing and information available, we assist the Merchant with individuals’ rights, security duties, breach notifications, impact assessments and prior consultations. We notify the Merchant without undue delay after becoming aware of a personal-data breach affecting its data and provide available information for its response. Any separately agreed charge for additional work does not remove mandatory obligations.
Return, deletion and remaining copies
At the end of processing, we return or delete personal data at the Merchant’s choice and delete remaining copies unless law requires retention. Restricted backup copies expire through the hosting provider’s retention process. The published inactivity rules apply only to accounts that accepted them and include successful warning and a grace period. Retained information is restricted to its lawful purpose. Customer privacy requests include review of shared documents and external-provider dependencies where needed.
Evidence and audits
We make available information necessary to demonstrate these obligations and allow and contribute to reasonable audits or inspections by the Merchant or its mandated auditor. Arrangements must protect other customers and system security, and may begin with existing evidence; they do not remove the Merchant’s legally required audit rights. Contact support@storechestra.co.uk for arrangements, provider details or transfer safeguards.