Data Processing Agreement

Introduction

This Data Processing Agreement ("DPA") is entered into between Shawcando Consulting (Data Processor) and the registered shop operator (Data Controller) when you register a shop on Snapdrop. It governs how Shawcando Consulting processes personal data on your behalf and is required under Article 28 of the GDPR.

What data we process on your behalf

When your customers send photos through your Snapdrop upload page, we process on your behalf:

• Customer name and phone number (phone is optional and only collected if the customer provides it)
• Any notes or instructions the customer enters for the order
• Uploaded photos
• IP addresses and submission timestamps

We do not collect a customer's email address, and the upload page sets no cookies and uses no browser storage — see our Privacy Policy for more detail.

How long we keep it

We apply strict automatic deletion on your behalf:

• Photos and order details are deleted according to your plan's retention period — 48 hours on the Free plan, 90 days on Pro — counted from when the order is finalised
• Sessions that are started but never finalised are deleted automatically after a short period of inactivity
• You can also delete an order yourself at any time from your dashboard, which deletes it immediately

Security measures

We protect the data we process on your behalf with: TLS encryption in transit, access-controlled file storage, two-factor authentication and device-trust for account access, and automatic file deletion schedules.

Sub-processors

We use the following sub-processors:

• A2 Hosting, LLC (trading as hosting.com) — Wilmington, Delaware, USA — for server hosting, database, and file storage
• Resend — for transactional email delivery (account verification, sign-in codes, security alerts)

We will notify you at least 14 days before adding any new sub-processor.

Stripe processes payment for your own Pro subscription (billing details, payment method) — not listed above since, unlike Resend and our hosting provider, it never processes your customers' personal data, which is what this DPA covers. See our Privacy Policy, Section 6, for what Stripe holds and retains regarding your own subscription.

Data subject rights

If one of your customers exercises a GDPR right (access, erasure, portability, etc.), we will assist you in fulfilling that request. You remain responsible as data controller for responding within the GDPR's 30-day timeframe.

Breach notification

In the event of a personal data breach affecting data we process on your behalf, we will notify you within 48 hours with sufficient information for you to fulfil your obligations to the Data Protection Commission.

Termination

On termination of your account, all personal data processed on your behalf will be deleted within 30 days. We will provide written confirmation on request.

Governing law

This DPA is governed by the laws of Ireland. Disputes are subject to the jurisdiction of the Irish courts.

Contact

For DPA queries or breach notifications, contact support@shawcando.com with subject line "DPA — [your shop name]".

Shawcando Consulting
Ardbaun, Thurles, County Tipperary, Ireland