Data Processing Agreement

You are the controller (or a processor acting for another controller) of personal data you submit to the service; we are your processor. For our own account data (your login, billing, and usage records) we act as an independent controller as described in the Privacy Policy.

• Subject matter: operation of the ARC resale management platform.
• Duration: the term of your subscription plus the deletion window below.
• Nature and purpose: hosting, storing, and displaying your business records; syncing listings and orders with connected marketplaces; sending emails you initiate; payment processing; workforce time tracking and payroll calculation.
• Categories of data: customer and buyer contact details (name, email, phone, shipping address), order and payment metadata (no full card numbers — those go directly to Stripe), consignor details and payout records, worker names and shift records.
• Data subjects: your buyers, customers, consignors, workers, and end users.

We will:

• Process personal data only on your documented instructions (your use of the service's features constitutes those instructions), unless required by law;
• Ensure personnel with access are bound by confidentiality;
• Implement appropriate technical and organizational measures — encryption in transit (TLS) and at rest, row-level security scoping every record to your account, role-based access, and audit logging;
• Assist you, taking into account the nature of processing, with data subject requests (access, correction, deletion, export) and with your obligations regarding security and breach notification;
• Notify you without undue delay after becoming aware of a personal data breach affecting your data;
• Delete or return personal data at the end of the engagement, per Section 6.

You authorize the subprocessors below. We will notify you of intended additions or replacements (via email or an in-app notice) and you may object on reasonable data protection grounds within 14 days; if we cannot accommodate the objection, you may cancel your subscription.

Marketplaces you connect yourself (eBay, Shopify, Etsy, Whatnot) are independent controllers, not our subprocessors.

Data is hosted in the United States. Where personal data protected by GDPR or UK GDPR is transferred to us, the parties rely on the applicable Standard Contractual Clauses (Module 2, Controller-to-Processor), which are incorporated by reference into this DPA, with you as data exporter and us as data importer.

You can export your data at any time by emailing eli@arcautomation.app. After account closure we delete personal data processed on your behalf within 90 days, except where retention is required by law (for example, financial records), in which case it is isolated and retained only as required.

On written request (no more than once per year), we will make available information reasonably necessary to demonstrate compliance with this DPA, including summaries of third-party security reviews of our subprocessors.

Each party's liability under this DPA is subject to the limitations of liability in the Terms of Service. If this DPA conflicts with the Terms of Service regarding personal data processing, this DPA controls.

Data protection questions or requests: eli@arcautomation.app