Merchant Data Processing Addendum
1. Scope roles and instructions
This Addendum forms part of the Merchant’s agreement with Ofdast Network. For Merchant-controlled customer data, the Merchant is controller and LokalFlow is processor. Processing lasts for the service period and necessary return, deletion or lawful retention. Its subject matter is storefront and order administration, communications, payment and delivery integration, support and enabled AI functions. Operations include collection, storage, organisation, transmission, retrieval and deletion. Data subjects are customers, recipients and Merchant personnel; data categories include contacts, addresses, order contents, payment/shipping references and support communications. Process only on documented lawful instructions, including configured features, except where law requires otherwise. Notify the Merchant if an instruction appears unlawful and pause the affected operation where appropriate. Independently controlled platform records are covered by the Privacy Notice, not disguised as processor activity.
2. Security and confidentiality
LokalFlow will impose confidentiality on authorised personnel, limit access to the work required, and maintain reasonable technical and organisational safeguards proportionate to the data and risks. These include authentication, access separation, secure transmission, backup and recovery procedures, patch management and incident response. Security documentation will describe measures actually implemented; this Addendum is not a claim of certification. Both parties must protect access credentials, avoid unnecessary sensitive data and promptly address known weaknesses within their control. LokalFlow’s direct statutory processor duties remain applicable.
3. Subprocessors and transfers
The Merchant authorises necessary subprocessors disclosed in the provider register supplied with this Addendum. Before this Addendum takes effect, that register must identify the actual providers, services, locations and relevant safeguards. LokalFlow must bind subprocessors to suitable data-protection obligations and remains responsible for their performance of delegated processing. Give at least 14 days’ notice of a material addition or replacement, except a necessary urgent security replacement with prompt subsequent notice. The Merchant may raise a reasonable data-protection objection; seek an alternative, and if unresolved allow termination of the affected service with an appropriate unused-period refund. Overseas transfers require an applicable section 129 condition and safeguards; Merchant authorisation alone does not establish legality. Independent payment or courier controllers are identified separately, not automatically treated as subprocessors.
4. Requests incidents and cooperation
Assist reasonably with access, correction, portability and other lawful requests, impact assessments and regulatory enquiries relevant to the processing. Inform the Merchant without undue delay after becoming aware of a personal-data breach affecting its data; do not wait for a complete investigation. Provide available facts about data, affected persons, likely consequences, containment and contact details, and update as facts develop. The Merchant makes controller notifications unless law requires LokalFlow to act or the parties lawfully agree assistance. Neither party may delay mandatory notifications while allocating blame or costs. Disclose confidential data to authorities only on a verified lawful basis and inform the Merchant where permitted.
5. Audit return and deletion
Provide information reasonably necessary to demonstrate compliance. Prefer documentation or an independent assurance report; allow a proportionate confidential audit on reasonable notice where evidence is insufficient or law requires it, without exposing other tenants or compromising security. On termination, offer a reasonable opportunity to retrieve Merchant data through available export or assisted transfer. Thereafter delete or return processor-held data under the agreed retention schedule, except records lawfully required to be retained. Restrict retained data, expire backup copies under a documented schedule and confirm completion on reasonable request. Do not promise instantaneous deletion from every backup. Statutory duties and non-excludable liability prevail over contractual limits.