Solicitor draft - placeholders in [brackets] need confirmation before relying on this page.
DRAFT FOR SOLICITOR REVIEW — NOT LEGAL ADVICE
Prepared as a starting draft for Helix Platforms Ltd (OmniRestock). Do not publish until reviewed by a qualified solicitor. Placeholders in [brackets] need Matt’s input or counsel.
Between
Customer (Controller) — the OmniRestock account holder
and
Helix Platforms Ltd (Processor), company no. 17032196, Unit 2 Lions Barn, Langham Lane, Colchester, CO4 5HY
This DPA forms part of the Terms of Service when the Customer’s use of OmniRestock involves processing personal data on the Customer’s behalf (including Shopify customer personal data and any personal data inside connected order/customer fields).
1. Roles
- Customer is Controller (or a Processor for its own clients — see §8).
- Helix Platforms Ltd is Processor for Customer Personal Data processed to provide the service.
- Helix Platforms Ltd is independent Controller for account admin data, billing metadata and product analytics as described in the Privacy Policy.
2. Processing details
- Subject matter: hosting and processing ecommerce operational data to provide forecasting and replenishment software.
- Duration: term of the service + retention in Privacy Policy.
- Nature: storage, retrieval, analysis, display, export, deletion.
- Purpose: perform the OmniRestock service.
- Types of personal data: names, contact details, addresses, order identifiers and other personal data present in connected platforms’ payloads; staff user accounts.
- Data subjects: Customer’s staff; Customer’s end customers to the extent their data appears in connected systems; clients of 3PLs/agencies where authorised.
3. Processor obligations
Helix Platforms Ltd shall:
- process only on documented instructions (including configuration in-product);
- ensure confidentiality of persons authorised to process;
- implement appropriate technical and organisational measures (encryption in transit/at rest, access control, audit logging, credential segregation);
- not engage subprocessors without notice and ability to object on reasonable grounds — current list in Privacy Policy;
- assist with data subject requests, DPIAs and breach notices;
- delete or return Personal Data after end of service at Customer election, subject to legal retention;
- make available information needed to demonstrate compliance and allow audits [frequency/notice — SOLICITOR TO SET].
4. Security incidents
Notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data, with details reasonably available.
5. International transfers
As in Privacy Policy; Processor ensures lawful transfer mechanisms for subprocessors.
6. Shopify / Amazon
Customer instructs Processor to process data retrieved via Customer’s OAuth connections. Customer is responsible for having a lawful basis and appropriate notices to data subjects. Processor implements Shopify mandatory compliance webhooks when the Shopify app is distributed via the App Store.
7. Liability
Subject to the Limitations in the Terms, as amended by mandatory data-protection law.
8. Agencies and 3PLs (client data)
Where Customer is an agency or 3PL using OmniRestock for end-merchant / brand clients:
- Customer confirms it has authority and a lawful basis (including contracts/notices with those clients) to connect their channel accounts and process their data in OmniRestock.
- Customer remains Controller toward its clients unless a written tripartite arrangement says otherwise.
- Helix Platforms Ltd processes that client data as Processor for Customer.
- Partner users’ access is limited to authorised client accounts; no cross-client data sharing inside OmniRestock.
- PackPro / Helix warehouse operational testing on client data requires each client’s written agreement before use (per product spec).
9. Order of precedence
If conflict: (1) this DPA for data-protection matters, (2) Terms of Service.
Signature blocks: [Customer name, signatory, date] · [Helix Platforms Ltd signatory, date]
Draft ends. Solicitor must replace with firm-standard UK GDPR DPA clauses (or Article 28 schedule) before use.