Data Processing Agreement (DPA)

Roles of the parties

Your shop is the data controller and decides why and how the vendor sales data is processed. BoothSettle is the data processor and processes that data only on your documented instructions, which include your use of the tool and these documents. BoothSettle does not process the data for its own purposes.

Subject matter and duration

The subject matter is the processing needed to generate per-vendor statements from your Square export. Processing lasts for as long as your account is active. It ends when you delete your account or the service agreement terminates, after which the deletion terms below apply.

Nature and purpose of processing

We collect, store, organize, calculate, and present sales figures so that you can produce monthly statements for your vendors. We store only the processed summary of your latest upload, and each new upload overwrites the previous one.

Types of data and categories of data subjects

• Data subjects: the vendors, boothholders, and consignors who sell through your shop, and your own account user.
• Types of data: vendor or booth identifiers, sales amounts, fees and commission figures derived from your Square export, and account data (email, email verification status, and hashed password). We do not intend to process special categories of personal data.

The anonymous usage events collected through the service are tied only to a random session identifier and contain no personal data, so they fall outside the scope of this DPA.

Security measures

We apply appropriate technical and organizational measures, including encryption in transit, password hashing with PBKDF2, access controls, data minimization (only the latest upload summary is retained), and hosting on infrastructure with recognized security practices. We regularly review these measures.

Sub-processors

You authorize us to use the following sub-processors: Cloudflare, to host and run the service (Workers, Pages, and a D1 database located in the European Union) and to store your account data and latest upload summary; and Resend, to send transactional email such as address verification and account notifications, which involves processing account email addresses. Each sub-processor is bound by data protection obligations consistent with this DPA. We will inform you of any intended change to our sub-processors so you can object. Payment processing is not active today; if we add a payment provider in the future, it will be added as a sub-processor and this DPA will be updated accordingly.

Confidentiality

Anyone we authorize to process the data is bound by confidentiality obligations and processes the data only as needed to provide the service.

Assistance and data subject requests

Taking into account the nature of the processing, we will provide reasonable assistance to help you respond to data subject requests and to meet your security, breach notification, and impact assessment obligations. If we become aware of a personal data breach, we will notify you without undue delay.

Return and deletion of data

When you delete your account or when the agreement ends, we will delete the account data and upload summary within a reasonable period, subject to short-lived backups and any retention required by law. On request, we will confirm deletion.

Contact

For DPA or data protection matters, email privacy@boothsettle.com or use our contact page.