Data Processing Addendum

Purpose

This Data Processing Addendum explains how Manage Repairs processes personal data on behalf of a shop when that shop uses the platform for customer records, repairs, sales, inventory, website orders, communications and related workflows.

Controller and processor

The shop is normally the controller for its customer, staff, repair, order and inventory records. Manage Repairs is normally the processor for that shop data and processes it to provide, secure, maintain, support and improve the service.

Documented instructions

The shop instructs Manage Repairs to process shop data through the subscription, account settings, support requests, product use and these published terms. We will not use shop customer data for unrelated purposes.

Scope of processing

Processing may include hosting, storing, retrieving, displaying, searching, backing up, transmitting, exporting, deleting and supporting shop data as needed for the platform and related services.

Categories of data subjects

Data subjects may include shop owners, staff, customers, suppliers, website visitors, repair customers, used-device sellers, order recipients and people who contact the shop through its public website.

Categories of personal data

Shop data may include names, contact details, device or item details, service notes, images, invoice and order information, payment status, communication history, staff roles and operational records chosen by the shop.

Confidentiality

People authorised to access shop data for support, maintenance, security or legal reasons should be under confidentiality obligations and should only access the information needed for the task.

Security measures

Manage Repairs applies appropriate technical and organisational measures such as authenticated access, tenant separation, password hashing, selected encryption, HTTPS on the live service, backups, audit-style records and restricted administration access.

Sub-processors

Manage Repairs may use hosting, email, payment, storage, analytics, AI/support and operational providers. We remain responsible for choosing providers with appropriate confidentiality and security controls for the services they provide.

Sub-processor changes

The service may need to add, replace or remove providers as features, hosting, email, payment, analytics or support needs change. Material provider changes should be reflected in the Sub-processors page or related policy pages.

Assistance with rights requests

Shops are responsible for responding to requests from their own customers. Where technically possible and reasonable, Manage Repairs can assist account owners with export, correction or deletion workflows.

Assistance with compliance

Where reasonable and technically possible, Manage Repairs may provide account exports, deletion workflows, logs, settings or support information that helps shops meet their own data protection responsibilities.

Breach notification

If we become aware of a confirmed personal data breach affecting shop customer data, we will investigate, take reasonable containment steps and notify affected account owners without undue delay so they can meet their own legal duties.

Return or deletion

When an account ends, shop data may be exported or deleted according to available product tools, legal obligations, billing records, dispute needs and normal backup rotation.

International transfers

Some providers may process data outside the UK or EEA. Where required, appropriate safeguards such as contractual commitments or recognised transfer mechanisms should be used.