Legal notice: This document requires review by qualified counsel before public launch.

UK Data Processing Agreement

Last updated: 1 November 2026

1. Who This Is Between

This agreement is part of the CogsHelper Terms of Service and applies when a shop in the United Kingdom uses CogsHelper. Accepting the terms accepts this agreement.

Controller: the shop's business, as named in its CogsHelper account.
Processor: 1134 Digital LLC, a Florida limited liability company, trading as CogsHelper. Contact: [email protected].

The shop decides what it records about its customers and staff and why. It is responsible for collecting that data lawfully, telling people about it and getting any permissions it needs, such as for marketing.

2. What We Process

Purpose and nature: providing the CogsHelper features the shop uses: till, inventory, customer accounts, staff sign-in and hours, receipts, loyalty points, store credit, gift cards, connected sales channels and support. We store, organise, look up, use, send, export and delete data to do this.
People: the shop's customers, online buyers, people who sell records to the shop, staff and shop contacts.
Data: names, contact details and addresses, purchases and refunds, payment references and the card type, last four digits and cardholder name a card payment returns, points and balances, gift cards, staff PIN codes (stored scrambled), hours and till actions, marketing permissions and opt-outs, device and security details, and notes and photos the shop enters.
Special category data: none. The shop should not put health, religion or other special category data, or criminal offence data, into CogsHelper.
Duration: while the shop uses CogsHelper, then until the records are returned and deleted under section 7.

CogsHelper's own records about the shop's account and subscription are covered by our Privacy Policy, not this agreement.

3. What We Promise

We process the shop's records only on its documented instructions, including for transfers outside the UK. These terms, this agreement, the features the shop uses and its written requests to support are those instructions. If UK law requires us to do otherwise, we tell the shop first, unless that law forbids telling it on important grounds of public interest. We tell the shop at once if we think an instruction breaks UK data protection law.
Everyone we allow to handle the records is bound to keep them confidential, and sees only what their work needs.
We take all the security measures that UK GDPR Article 32 requires, suited to the risk. These include: connections to our servers use HTTPS, passwords and staff PIN codes are stored scrambled (hashed), keys for connected services are stored encrypted, each shop's records are separated by account permissions, staff access follows the roles the shop sets, changes to the service go through security review, and we keep the service available and able to recover after a problem and regularly check that these measures work.
We help the shop answer requests from people about their data, keep the records secure, deal with breaches, carry out impact assessments and consult the UK Information Commissioner's Office when needed. If someone asks us directly about a shop's records of them, we pass the request to the shop without undue delay and answer it only as the shop instructs or the law requires.
We give the shop the information it needs to show it meets these duties, and allow and contribute to audits, including inspections, by the shop or an auditor it appoints, with reasonable notice.

4. Other Companies We Use

The shop agrees that we may use these companies to provide the features it uses. Each is bound by a contract with data protection duties equal to ours, and we stay responsible to the shop for them.

Railway (United States): servers, database and logs. All of the shop's records.
Cloudflare (worldwide network): storage of photos and files, delivery of our website and web app, bot checks, and routing of email sent to our support address.
Resend (United States): sending the shop's receipts, notifications and marketing emails. The recipient and the message.
Google Firebase (United States): notifications to phones, including iPhones through Apple's notification service, and phone-app crash reports. Device identifiers and notification content.

Web notifications go through the push service of the person's own browser, and their content is encrypted so that service cannot read it. Square, Stripe, Shopify, WooCommerce, Discogs and eBay are connected by the shop itself and act under their own terms, not as our sub-processors.

We email the shop at least 30 days before we add or replace one of these companies. The shop can object on reasonable data protection grounds in that time. If we cannot resolve the objection, the shop can stop using the affected feature, or leave, before the change takes effect.

5. Breaches

If a personal data breach affects the shop's records, we email the shop's owner without undue delay after we find out. We say what happened, what data and roughly how many people and records are affected, the likely consequences, and what we have done and will do, and we send updates as we learn more. The shop decides whether to tell the Information Commissioner's Office and the people affected, and we help. We keep a record of every breach for 6 years. Report a suspected breach to [email protected].

6. Transfers to the United States

CogsHelper's servers are in the United States, so the shop's records are sent there. For this transfer, the shop (exporter) and 1134 Digital LLC (importer) enter into the UK International Data Transfer Agreement (IDTA) issued by the Information Commissioner's Office, filled in as follows.

Table 1: Parties

Start date: the date the shop accepts the Terms of Service.
Exporter: the shop's business, with the legal name, address and email in its CogsHelper account, and its company registration number (if it has one) as it gives us when it joins. Key contact: the shop's owner, at the owner email in its account.
Importer: 1134 Digital LLC, a Florida limited liability company, trading as CogsHelper. Its registered address and Florida document number are in the copy of these tables we send the shop when it joins, which forms part of this agreement. Key contact, and contact for people whose data is transferred: Privacy contact, [email protected].

Table 2: Transfer details

UK country whose law governs the IDTA: England and Wales.
Primary place for legal claims to be made by the parties: England and Wales.
Status of the exporter: controller.
Status of the importer: the exporter's processor.
Whether UK GDPR applies to the importer: UK GDPR applies to the importer's processing of the transferred data.
Linked agreement: the CogsHelper Terms of Service and this UK Data Processing Agreement, dated the date the shop accepted the Terms of Service.
Term: as long as the linked agreement is in force.
Ending the IDTA before the end of the term: the parties cannot end it early except as the IDTA allows.
Ending the IDTA when the approved IDTA changes: neither party.
Further transfers by the importer: allowed only to the companies in section 4, as that section allows.
Review dates: first review one year after the start date, then at least once a year, and whenever the transferred data, purposes, importer or risks change.

Table 3: Transferred data

Data, people and purposes: as set out in section 2. These update automatically if section 2 is updated.
Special category and criminal offence data: none. This will not update automatically.

Table 4: Security requirements

As set out in section 3, point 3. These update automatically if that point is updated.

Part 2 (extra protection clauses): none. Part 3 (commercial clauses): the linked agreement, as far as it does not conflict with Part 4. Part 4 (mandatory clauses): Part 4: Mandatory Clauses of the Approved IDTA, being the template IDTA A.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 5.4 of those Mandatory Clauses.

We give the shop the information it needs for its transfer risk assessment on request.

7. When the Shop Leaves

When a shop stops using CogsHelper, it chooses whether we return its records or delete them. Either way, we give it a copy in a usable electronic format and delete its records within 90 days, unless the shop asks us in writing to keep its sales records for it, or UK law requires us to keep them. Records kept for either reason are used for nothing else and deleted when that reason ends. Copies in backups are deleted as the backups expire.

8. Which Terms Win, and Governing Law

On data protection, this agreement wins over anything else in the Terms of Service, and the IDTA's mandatory clauses win over this agreement. This agreement is governed by the laws of the State of Florida, USA, except the IDTA, which is governed by the law of England and Wales as Table 2 says.