This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Wintry Ltd (“Wintry”) and the business that uses the Wintry service (the “Customer”). It applies whenever Wintry processes personal data in Store Data on the Customer’s behalf. It is incorporated into the Terms of Service and does not need to be signed separately. If it conflicts with the Terms of Service on a data protection matter, this DPA prevails.

1. Definitions

• “Data Protection Law” means all laws that apply to the processing of personal data under this DPA, including the UK GDPR and the Data Protection Act 2018, the EU GDPR where it applies, Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), Australia’s Privacy Act 1988 and the Australian Privacy Principles, and US state privacy laws.

• “Service”, “Store Data”, “Account Data”, “Plan” and “Billing Period” have the meanings given in the Terms of Service.

• “Sub-processor” means a third party that Wintry engages to process Store Data.

• “Controller”, “processor”, “personal data”, “data subject”, “processing” and “personal data breach” have the meanings given in the UK GDPR, and equivalent terms in other Data Protection Law are read accordingly.

2. Roles

The Customer is the controller of Store Data, and Wintry is its processor. If the Customer is itself a processor for another controller, Wintry acts as its sub-processor, and the Customer confirms that it has that controller’s authority to enter into this DPA.

For the Account Data it collects about the Customer’s own users, Wintry is an independent controller, and its Privacy Notice applies. That data is outside this DPA.

3. Instructions

Wintry processes Store Data only on the Customer’s documented instructions, including with regard to transfers to other countries, unless the law requires otherwise. In that case, Wintry will tell the Customer before processing, unless the law prohibits it.

The Customer’s instructions are the Terms of Service, this DPA, the settings the Customer chooses in the Service, each backup the Customer starts, each restore the Customer confirms (including the related objects the restore writes, as the Terms of Service describe) and each export the Customer requests. Wintry will immediately tell the Customer if, in its opinion, an instruction infringes Data Protection Law.

4. Wintry’s obligations

Wintry will:

• ensure that everyone it authorises to process Store Data is bound by a duty of confidentiality;

• implement the technical and organisational measures in Annex 2, keep them at least as protective while this DPA applies, and in any event take the measures required by Article 32 of the UK GDPR;

• engage Sub-processors only in accordance with section 6;

• assist the Customer with data subject requests and complaints, as section 7 describes;

• assist the Customer in meeting its obligations on security, breach notification, data protection impact assessments and prior consultation with authorities, taking into account the nature of the processing and the information available to Wintry;

• delete or return Store Data at the end of the Service, as section 9 describes;

• make available the information needed to demonstrate compliance with this DPA, and allow audits, as section 10 describes; and

• not sell Store Data, share it for advertising, combine it with data from other sources except as needed to provide the Service, or use it to train or improve machine-learning or AI models.

5. The Customer’s obligations

The Customer is responsible for the lawfulness of the Store Data in its Square account and of its instructions to Wintry. In particular, the Customer will ensure that it has a lawful basis for that personal data, and that it has given the people concerned the information Data Protection Law requires, including that their data is processed by a service provider in the United States.

The Customer will not instruct Wintry to process special category data, data about criminal offences or protected health information under HIPAA, except special category data that appears incidentally in free-text fields such as notes.

The Customer decides what to restore. A restore can recreate a customer whose marketing preferences have changed since the backup. Wintry warns the Customer about this before each restore, and respecting the customer’s preference afterwards is the Customer’s responsibility.

6. Sub-processors

The Customer gives Wintry general authorisation to engage Sub-processors. The current Sub-processors are listed in Annex 3.

Wintry will email the Customer at least 30 days before adding or replacing a Sub-processor. Where an urgent replacement is needed for security or continuity, Wintry will instead notify the Customer as soon as practicable. The Customer may object on reasonable data protection grounds before the change takes effect. Wintry will then try to resolve the objection. If it cannot, the Customer may end its Plan, and Wintry will refund the unused part of its current Billing Period.

Wintry imposes data protection obligations on each Sub-processor that are no less protective than those in this DPA, and remains responsible to the Customer for each Sub-processor’s performance of them.

7. Data subject requests and complaints

If Wintry receives a request or complaint from a data subject about Store Data, it will not respond except to direct the person to the Customer, and it will tell the Customer promptly. The Service lets the Customer view, restore and export Store Data. Where the Customer needs further help to respond to a request or complaint, Wintry will provide reasonable assistance.

8. Personal data breaches

Wintry will notify the Customer without undue delay after becoming aware of a personal data breach affecting Store Data, even if its investigation is not complete. The notification will describe, so far as is known, the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences, and the measures taken or proposed to address it. Wintry will update the Customer as its investigation progresses and will cooperate with the Customer’s notifications to authorities and data subjects. A notification is not an admission of fault.

9. Deletion and return

The Customer can request an export of Store Data at any time, and can view Store Data in the Service for as long as Wintry retains it. When the Customer disconnects its Square account, or its Plan ends or lapses, Wintry stops processing Store Data except to retain it for the 30-day window described in the Terms of Service. During that window the Customer chooses whether to receive an export before deletion, and Wintry will not delete Store Data until it has sent an export the Customer requested in that window.

After that window, Wintry deletes Store Data from its live systems within 120 days, and the recovery copies its storage keeps against accidental loss expire within a further 90 days. Fragments of Store Data in its database provider’s backups, in logs, in records of background jobs and in error reports are not deleted customer by customer. They expire automatically within the same overall period. Two exceptions apply, and the Customer authorises both: a Sub-processor providing AI services may keep content its safety systems flag for longer, under its own terms; and support messages, which contain Store Data only if the Customer includes it, are kept as the Privacy Notice describes.

Wintry keeps a record of each deletion and will confirm deletion in writing on request. Wintry may retain Store Data only where and for as long as the law requires, and will continue to protect it while it does.

10. Audits

On written request, no more than once a year, Wintry will give the Customer the information reasonably needed to demonstrate compliance with this DPA, including a description of its security measures and any third-party reports or certifications it holds. If that information is not enough to meet a legal requirement of the Customer, the Customer or an independent auditor bound by confidentiality may audit Wintry’s relevant systems and records, on reasonable notice, during business hours, without disrupting the Service, and at the Customer’s cost. Audit findings are confidential. These limits do not apply to an audit required by a supervisory authority.

11. International transfers

Wintry processes Store Data in the United States, and the Customer authorises this.

United Kingdom. Transfers of Store Data subject to UK data protection law to Sub-processors in the United States rely on the UK Extension to the EU-US Data Privacy Framework where the Sub-processor is certified under it, and otherwise on the International Data Transfer Addendum to the EU Standard Contractual Clauses issued under UK law. If a certification stops applying, Wintry will rely on the Addendum instead. Transfers to a Sub-processor established in the European Economic Area rely on UK adequacy regulations, and that Sub-processor’s data processing terms govern its onward transfers. Annex 3 states the mechanism for each Sub-processor.

European Union. If the EU GDPR applies to any Store Data, its transfer from the European Economic Area to Wintry in the United Kingdom relies on the European Commission’s adequacy decision for the United Kingdom, and onward transfers are covered by the UK mechanisms above.

Canada. Wintry provides, through this DPA and the measures in Annex 2, a level of protection for Store Data comparable to that required by PIPEDA. The Customer acknowledges that Store Data held in the United States may be subject to lawful access by authorities there.

Australia. The Customer acknowledges that Store Data is disclosed to recipients in the United States. Wintry processes Store Data only on the Customer’s instructions, protects it in accordance with Australian Privacy Principle 11, and will assist the Customer with any assessment or notification under the Notifiable Data Breaches scheme.

12. US state privacy laws

Where a US state privacy law applies to Store Data, Wintry is the Customer’s service provider or processor. Wintry will not sell Store Data or share it for cross-context behavioural advertising; will not retain, use or disclose it for any purpose other than providing the Service, or outside its direct business relationship with the Customer; and will not combine it with personal data from other sources except as the law permits. Wintry will tell the Customer if it can no longer meet these obligations, and the Customer may then take reasonable steps to stop and remedy any unauthorised use. Wintry certifies that it understands these restrictions and will comply with them.

13. Liability

Each party’s liability under this DPA is subject to the limits and exclusions in the Terms of Service. Nothing in this DPA limits either party’s direct liability to data subjects or authorities under Data Protection Law.

14. Term and changes

This DPA applies for as long as Wintry processes Store Data for the Customer. Wintry may update it to reflect changes in law, in guidance from authorities or in the Service, by publishing the new version at wintry.io/legal/dpa and emailing the Customer at least 30 days before it takes effect, unless the law requires the change sooner. Earlier versions remain available.

Annex 1: Details of the processing

Subject matter. Backup, version history, restore and export of the content of the Customer’s Square account.

Duration. From the Customer’s connection of its Square account until Store Data is deleted under section 9.

Nature and purpose. Reading Store Data from Square through Square’s API every day and when the Customer starts a backup; storing the copies encrypted; indexing them so that the Customer can browse and compare versions; writing selected data back to Square when the Customer confirms a restore; producing an export when the Customer requests one; and deleting the copies at the end of the Service.

Categories of data subjects. The Customer’s customers; its employees, contractors and other team members; and its suppliers and vendors.

Types of personal data.

• Customers: name, email address, phone number, postal addresses, birthday, company, notes, customer group and segment membership, custom attributes, invoices, subscriptions, bookings and booking notes, gift card numbers and balances, loyalty balances and history, and marketing preferences.

• Team members: name, email address, phone number, job titles, pay rates, status, and shift and timecard records, including declared tips.

• Vendors: contact name, email address, phone number and address.

Special categories of data. None intended. Special category data may appear incidentally in free-text fields, such as notes, as section 5 describes.

Frequency. Continuous while the Customer’s Square account is connected.

Annex 2: Technical and organisational measures

Encryption. Data is encrypted in transit with TLS between the Customer and Wintry, between Wintry and Square, and between Wintry and its Sub-processors. Backups are encrypted at rest with AES-256 by Google Cloud, and the database is encrypted at rest by its provider. Square access and refresh tokens are additionally encrypted with AES-256-GCM using a key held in a hardware security module in Google Cloud Key Management Service, so that access to the database alone cannot reveal them. Encryption keys and other secrets are never stored in source code.

Access control. Access to production systems is limited to Wintry personnel who need it to operate the Service. Personnel sign in with two-factor authentication, using hardware security keys for administrative access to Google Cloud, where sessions expire and require re-authentication. Service components run under least-privilege service accounts. Store Data is separated by Square merchant, and every read in the Service is limited to the signed-in Customer’s merchant.

Limited Square access. Backups only read Store Data. Restore permissions are a separate grant that the Customer can leave switched off. Each object a restore writes uses its own short-lived access token that carries only the permission that write needs, and is revoked after the write or, if revocation fails, expires on its own. Wintry’s restore client can call only the specific Square endpoints that restores need, and none of them is a delete endpoint.

Integrity and availability. Backups are kept in Google Cloud object storage with soft-delete protection. The database is backed up by its provider. Backup and restore jobs run on a durable workflow engine that retries failures and records each step. Automated checks run throughout the day to detect backups that are out of date, missing or incomplete.

Restore safeguards. Each restore is planned against the Customer’s live Square account. Each object is checked immediately before it is written and read back immediately afterwards. Restores never use Square’s delete functions. Every write is recorded in an audit log before it is sent and again when Square answers. If a check fails unexpectedly, all restores are paused until a person has investigated.

Monitoring and incident response. Errors, failed jobs and integrity alarms are reported to an error monitoring service and alert Wintry’s operators. Wintry investigates incidents, contains them, notifies affected Customers under section 8, and records the outcome.

Development and testing. Releases pass automated type checks, linting and tests. Secrets are kept in a secrets manager. Test environments are separate from production and use Square’s sandbox, not Customer data.

Deletion. Retention and deletion are enforced by automated jobs, and each deletion of Store Data is recorded.

Personnel. Everyone with access to Store Data is bound by confidentiality obligations.

Annex 3: Sub-processors

The current list of Sub-processors, with each one’s legal entity, location and purpose, and the transfer mechanism relied on, is published at wintry.io/legal/sub-processors and forms part of this DPA.