Data processing agreement

How we handle your customers' data

This agreement covers the personal data we process for you when you use MarginVAT, as UK GDPR Article 28 requires. It forms part of our terms. Last updated 14 October 2026.

1. Who's who

  • Controller: the business that installs MarginVAT ("you").
  • Processor: L. Broad, a sole trader in the United Kingdom trading as MarginVAT ("we"). Contact: support@marginvat.com.
  • This agreement covers personal data we process for you to provide MarginVAT ("your customer data"). Where we decide how data is used, for example for your own contact details, our privacy policy applies instead.
  • If this agreement and our terms ever disagree about personal data, this agreement wins.

2. The processing

  • What it's for: producing margin scheme invoices, credit notes, the stock book and VAT figures for your Shopify store.
  • How long: while MarginVAT is installed, then until it's deleted as section 9 describes.
  • What we do with it: receive order and refund data from Shopify, store it, calculate figures and produce documents.
  • Whose data: your customers (buyers) and the people you buy stock from (sellers).
  • What data: buyers' names and billing addresses, sellers' names, and the order and item details linked to them. No special category data.

3. What we promise

We will:

  • process your customer data only on your documented instructions, which are these terms and your use of the app, including where the data may be transferred (section 5). If the law requires other processing, we'll tell you first, unless the law forbids that;
  • tell you straight away if we think an instruction from you breaks data protection law;
  • make sure anyone authorised to process your customer data is bound by confidentiality;
  • keep it secure with the measures in the annex below;
  • use other processors only as section 4 allows;
  • help you answer requests from the people whose data it is (Shopify's customers/redact and customers/data_request requests are handled as the annex describes);
  • help you with security, breach notification, impact assessments and consultations with the regulator, as far as the processing and the information we hold allow;
  • let you download your records at any time, and delete your customer data when the service ends (section 9);
  • keep a record of the processing we carry out for you;
  • give you the information you need to show compliance, and allow a reasonable audit by an independent auditor on 30 days' notice, no more than once a year unless there's been a breach.

4. Our sub-processors

You authorise us to use:

  • Railway Corporation: runs the app and its database, in the European Union (the Netherlands).
  • Cloudflare, Inc.: our domain's DNS and forwarding of mail sent to support@marginvat.com.

We'll tell you, in the app or by email, at least 30 days before adding or replacing a sub-processor, and keep this list up to date. If you object on reasonable data protection grounds, you can end the service. Each sub-processor is bound by a written data processing agreement that meets UK GDPR's requirements, and we remain responsible to you for what they do.

Please don't email us your customers' personal data: we never need it to help you, and our support inbox isn't part of this service. Shopify isn't our sub-processor either: you use Shopify directly, under your own agreement with Shopify.

5. International transfers

The app's database is stored in the European Union (the Netherlands), which the UK recognises as giving adequate protection. Our sub-processors are based in the United States and may access data from there. Where they do, the transfer is covered by the UK Extension to the EU–US Data Privacy Framework or by the UK's International Data Transfer Addendum to the EU standard contractual clauses, as set out in their data processing agreements.

6. If something goes wrong

If a breach affects your customer data, we'll tell you without undue delay and within 48 hours of finding out. We'll say what happened, the likely effects, what we're doing about it and who to contact, so you can meet your own 72-hour duty to report to the ICO where needed.

7. Your part

You confirm you have a lawful basis to give us your customer data, and that your own privacy notice tells your customers about it (for example, that their name and address appear on VAT invoices).

8. Liability

Liability under this agreement is subject to the limits in our terms, except where the law doesn't allow it.

9. When processing ends

You can download your stock book, invoices and VAT records at any time, and you may need to keep them for VAT. When you uninstall MarginVAT, Shopify sends us a shop/redact request 48 hours later, and we delete all of your shop's data, unless you've reinstalled MarginVAT by then. Copies in our database backups are deleted automatically as the backups expire, within 90 days. If the law requires us to keep any data longer, we'll keep protecting it and use it for nothing else.

Annex: how we keep your customer data safe

  • Access: only the people who run MarginVAT can reach production systems. Their accounts use strong, unique passwords and two-factor authentication. Secrets are held in the hosting platform's settings, never in code. We don't look at your customers' personal data unless you ask us to, to help you.
  • Encryption: all connections use HTTPS. Names, addresses and the buyer details inside invoices and credit notes are encrypted by the app (AES-256-GCM) before they're stored, and the key is kept separately from the database.
  • Only what's needed: a buyer's name and billing address, and nothing else about them: no email, phone number, payment details or tracking.
  • Logging: every download of a record that holds personal data (an invoice, a credit note or the stock book) is logged, with no personal data in the log.
  • Testing: we build and test on separate systems with made-up data, and never use real customer data for testing.
  • Backups: the database is backed up automatically, and each backup expires on a fixed schedule (no more than 90 days).
  • Deletion: a customers/redact request removes that buyer's name and address from sales, invoices and credit notes. A shop/redact request deletes all of the shop's data.
  • Incidents: a written process (detect, contain, assess, notify, learn) with the timings in section 6.
  • Software: dependency versions are locked, known vulnerabilities are reviewed before each release, and changes are tested before they're deployed.