Data Processing Addendum
The processor agreement covering end-customer personal data a tenant loads into litecommerce.
Draft scaffold — not a legal document
This page is a placeholder. It has not been reviewed by counsel, it is not in effect, and it creates no rights or obligations for anyone. It lists what the Data Processing Addendum will need to cover — the operative language is deliberately absent.
Nothing here may be relied on, quoted, or presented to a customer as litecommerce's terms.
litecommerce's role
litecommerce is the processor. The tenant is the controller of its own customers' personal data.
Sections this document must cover
Scope only. These describe what each section has to establish, not what it will say.
1. Roles and subject matter
Controller/processor split, categories of data subjects, categories of personal data, and duration of processing.
2. Processing instructions
Processing only on documented controller instructions, and what happens if an instruction appears unlawful.
3. Confidentiality and personnel
Who may access controller data and under what obligations.
4. Security measures
Technical and organisational measures. Must describe controls that actually exist — tenant-scoped row-level isolation, audit logging, credential handling — and must not claim certifications litecommerce does not hold.
5. Subprocessors
The list below, the authorisation model, and the change-notice commitment with an objection window.
6. Data-subject request assistance
How litecommerce assists the controller in responding, and within what timeframe.
7. Personal data breach notification
Notification trigger, timeframe, and content. GDPR Art. 33 timing is strict; the commitment must be one operations can actually meet.
8. Deletion and return on termination
What is returned, what is deleted, and on what schedule.
9. Audit and information rights
What the controller may request and how often.
10. International transfers
Standard Contractual Clauses or equivalent, once subprocessor regions are confirmed.
Subprocessors
These are factual — the services the platform actually runs on. Hosting regions are unverified and marked as such rather than guessed.
| Subprocessor | Purpose | Data | Region |
|---|---|---|---|
| Supabase | Managed Postgres, authentication, and object storage for tenant and platform data. | Tenant account data, merchant-loaded end-customer personal data, uploaded media, and authentication identifiers and session material. | TO BE CONFIRMED |
| Stripe | Payment processing for tenant sales (tenant-owned connected accounts) and platform SaaS subscription billing. | Cardholder data, billing contact name and email address, billing addresses, and tax location. | TO BE CONFIRMED |
| Resend | Transactional email delivery. | Recipient email addresses, message content. | TO BE CONFIRMED |
| Vercel | Application hosting, edge routing, and CDN for the API and every Next.js application. | Full request and response payloads for the API and applications it hosts — including tenant account data and end-customer personal data such as profiles, addresses, and orders — plus request metadata, IP addresses, and logs. | TO BE CONFIRMED |
| Sentry | Error monitoring and sampled performance tracing for the API, admin, and platform-admin applications. | Error events and stack traces, sampled request metadata, IP addresses. Redaction is NOT uniform across applications: the API scrubs auth-hook bodies and sensitive request data before send; the admin application scrubs only its billing-return route; the platform-admin application has no scrubbing hook configured. | TO BE CONFIRMED |
| Cloudflare | Turnstile bot protection on the public contact and signup forms. | Request metadata and challenge tokens from form visitors, for abuse prevention. | TO BE CONFIRMED |
Open questions for counsel
- This is a contract litecommerce offers to SIGN, not a notice it publishes. It carries the most risk of any document here and should be reviewed last, after Terms and Privacy are settled.
- GDPR Art. 28 requires this to be in place BEFORE processing a controller's personal data — it gates the first external tenant, not the first enterprise deal.
- Security measures must be verified against the implementation. An overstated control is a misrepresentation in a signed contract. This is not hypothetical: the Sentry row in the subprocessor list below originally claimed uniform request scrubbing, and only the API implements it — the platform-admin application has no scrubbing hook at all. Assume every control statement needs the same check.
- Subprocessor regions are unconfirmed in this placeholder and must be verified per provider.
Tracked by issue #1828. Tenant storefront policies are a separate thing entirely — each tenant publishes its own shopper-facing policies, which are not covered by any document here.