Applies when you run Cutrix for your own customers through a storefront, plugin or the API, and we process their personal data for you.
This summary helps you find your way. The full text below is what applies.
This agreement applies to personal data of your customers that Cutrix processes when they quote or order through your storefront, WordPress or Wix plugin, or an integration built on the Cutrix API. You are the controller and Cutrix is the processor, as defined in UK GDPR.
| Item | Detail |
|---|---|
| Subject matter | Providing quoting, ordering, production and delivery services |
| Duration | For as long as you use Cutrix, plus the deletion period in section 9 |
| Data subjects | Your customers and their staff |
| Personal data | Names, business names, email, phone, billing and delivery addresses, order history, files they upload |
| Special category data | None expected. Don’t ask customers to provide it. |
We process your customers’ data only on your documented instructions, which are these terms and your configuration of the service. If we think an instruction breaks data protection law, we will tell you.
Everyone at Cutrix who can access the data is bound by confidentiality, and access is limited to people who need it for their role.
You authorise us to use the subprocessors on our subprocessor list. We give at least 30 days’ notice by email before adding or replacing one, and you can object on reasonable data protection grounds. We remain responsible for our subprocessors.
We will help you respond to requests from your customers to exercise their rights, and with data protection impact assessments and consultations with the ICO, taking into account the information available to us.
We will notify you without undue delay, and within 48 hours, of becoming aware of a breach affecting your customers’ data. We will tell you what happened, what data is affected and what we are doing about it.
When you close your account you can export your customers’ data for 30 days. We then delete it within a further 60 days, except where the law requires us to keep it.
We will make available the information you need to show compliance with this agreement, and allow audits by you or an independent auditor once a year with 30 days’ notice, at your cost.
We only transfer your customers’ data outside the UK under UK adequacy regulations or the ICO’s International Data Transfer Agreement or Addendum.