Data processing agreement

Last updated 3 November 2026

When a shop uses OmniSync Retail, it puts in personal data about its staff, suppliers and sometimes shoppers. The shop is the controller of that data and Versifyd is its processor. This agreement sets out how we handle that data, as required by Article 28 of the EU and UK General Data Protection Regulation (GDPR).

It forms part of our terms and conditions and applies automatically to every OmniSync Retail account. There is nothing to sign. If you need a signed copy for your records, email [email protected] and we will send one.

Contents: Parties and roles · Details of processing · Instructions · Confidentiality · Security · Sub-processors · International transfers · Assistance · Breaches · Deletion and return · Audits · Liability and term

1. Parties and roles

• Customer (controller): the business that holds the OmniSync Retail account.
• Versifyd (processor): provides OmniSync Retail. Contact: [email protected].

Words such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meanings given in the GDPR. If the customer is itself a processor for someone else, Versifyd acts as its sub-processor on the same terms.

2. Details of the processing

3. Processing only on instructions

• Versifyd processes personal data only on the customer's documented instructions. The terms, this agreement, and the customer's use and settings of the service are those instructions.
• We will not use the data for our own purposes, sell it, or combine it with other customers' data.
• If the law requires us to process the data in another way, we will tell the customer first, unless the law forbids it.
• If we think an instruction breaks data protection law, we will tell the customer straight away.
• The customer is responsible for having a lawful basis for the data it puts in and for giving its staff and suppliers the information the law requires.

4. Confidentiality

Only people who need access to provide or support the service can reach customer data. Everyone at Versifyd with access is bound by a duty of confidentiality. We look at a customer's data only when needed to run the service, fix a problem, answer a support request, or meet the law.

5. Security

Versifyd keeps appropriate technical and organisational measures in place to protect personal data, as required by Article 32 of the GDPR. They are described on our data security page, which forms Annex 2 of this agreement. We may improve these measures over time, but never lower the overall level of protection.

6. Sub-processors

The customer gives general authorisation for Versifyd to use sub-processors. Those in use today are:

Paddle.com Market Ltd sells subscriptions as merchant of record and acts as an independent controller for payment data, so it is not a sub-processor for customer data in the app.

• We put a written contract in place with each sub-processor that protects data at least as well as this agreement.
• We will update this list and email account owners at least 30 days before adding or replacing a sub-processor.
• The customer may object on reasonable data protection grounds within that time. We will then try to find a solution. If we can't, the customer may end the affected service and get a refund of the unused part of any prepaid period.
• Versifyd stays responsible to the customer for its sub-processors' work.

7. International transfers

• Customer data is stored on servers in Europe.
• Versifyd's team is based in Pakistan and accesses the data from there to run and support the service. Pakistan has no EU adequacy decision.
• For customers in the EEA, this transfer is covered by the European Commission's Standard Contractual Clauses (Decision 2021/914), Module 2 (controller to processor), which are incorporated into this agreement by reference. For Clause 7 the docking clause applies; for Clause 9 option 2 (general authorisation) applies with the notice in section 6; for Clause 11 the optional wording does not apply; for Clauses 17 and 18 the law and courts of Ireland apply. Annex I is section 2 of this agreement, Annex II is our data security page, and Annex III is the list in section 6.
• For customers in the UK, the UK Information Commissioner's International Data Transfer Addendum applies on top of those clauses. For customers in Switzerland, the clauses apply with references to the Swiss data protection law and authority.
• Where the clauses and this agreement conflict, the clauses win.
• We have assessed the law and practice in Pakistan for these transfers and will help the customer with its own assessment if asked.

8. Helping the customer

• Requests from people: if a staff member, supplier or shopper asks us to see, correct or delete their data, we pass the request to the customer without delay and do not answer it ourselves unless the customer asks us to. The app lets the customer view, edit, export and delete most data itself. For anything it can't, we help.
• Assessments: we give reasonable help with data protection impact assessments and consultations with authorities, as far as they concern our service.
• Information: we give the customer the information it reasonably needs to show it meets Article 28.

9. Personal data breaches

• We tell the customer without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting its data. We email the account owner.
• We include what we know: what happened, what data and how many people are affected, likely consequences, what we have done and will do, and a contact person. If we don't know everything yet, we send updates as we learn more.
• We take reasonable steps at once to contain the breach and reduce harm, and help the customer meet its duty to tell the authority and the people affected.
• Telling the customer about a breach is not an admission of fault.

The full procedure is on the data security page.

10. Deletion and return of data

• While the account is open, the customer can export data from the app, or ask us for a full export in CSV files.
• When the account is closed, the customer may ask for an export within 30 days. We then delete all customer data from the live system within 30 days, and from backups when they are overwritten, within a further 30 days.
• We keep only what the law requires us to keep, such as invoices for our own tax records, and protect it under this agreement until it is deleted.
• We confirm deletion in writing if asked.

11. Audits

• We answer reasonable written questions about our data protection and security, normally within 30 days.
• If those answers aren't enough, or an authority requires it, the customer may audit us once a year, with at least 30 days' notice, during working hours, by itself or an independent auditor bound by confidentiality. Audits must not put other customers' data at risk. Each side bears its own costs, unless the audit finds a material breach of this agreement by us.

12. Liability, order of documents and term

• Each party's liability under this agreement is subject to the limits in the terms, except where the GDPR or the Standard Contractual Clauses do not allow it.
• If this agreement and the terms conflict about personal data, this agreement wins.
• This agreement lasts as long as we process customer personal data, and ends when it has been deleted or returned.
• We may update this agreement to reflect changes in law or in our service. We email account owners at least 30 days before a significant change. Changes will not lower the protection of personal data.