Data Processing Agreement

Version 1.0 — 1 August 2026

This Data Processing Agreement (“DPA”) forms part of, and is incorporated into, the Terms of Service between:

(1) Precious Memories Ltd, a company registered in England and Wales under company number 17332454, whose registered office is at 66 Paul Street, London, EC2A 4NA, operating the service known as The Next Drop (the “Processor”); and

(2) the person or business that registers a seller account on The Next Drop (the “Controller”, “you”).

1. Definitions

“UK GDPR” means the retained EU law version of Regulation (EU) 2016/679 as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018, together with the Data Protection Act 2018.

“Buyer” means an individual who places an order through a drop page operated by the Controller. “Buyer Personal Data” means personal data relating to Buyers that the Processor processes on the Controller's behalf, as described in Annex I. “Sub-processor” means any processor engaged by the Processor to process Buyer Personal Data. Other capitalised terms have the meanings given in the UK GDPR.

2. Roles of the parties

In respect of Buyer Personal Data, the Controller is the controller and the Processor is a processor. The Controller determines what to sell, to whom, what information to request from Buyers, and how to fulfil orders.

In respect of the Controller's own account data (name, email address, business details and subscription records), the Processor acts as an independent controller. That processing is governed by the Privacy Policy and falls outside this DPA.

The Controller warrants that it has a valid lawful basis under Article 6 UK GDPR for the processing it instructs, and that Buyers have been given the information required by Articles 13 and 14. The Processor displays a collection notice at checkout to assist, but responsibility remains with the Controller.

3. Scope and instructions

The Processor shall process Buyer Personal Data only on the documented instructions of the Controller, including as to transfers to a third country, unless required otherwise by law — in which case it shall inform the Controller before processing, unless legally prohibited from doing so.

The Controller's documented instructions comprise this DPA, the Terms of Service, and the Controller's use of the features of The Next Drop in the ordinary course. The Processor shall immediately inform the Controller if, in its opinion, an instruction infringes data protection law.

4. Confidentiality

The Processor shall ensure that any person authorised to process Buyer Personal Data is subject to an appropriate duty of confidentiality, and shall limit access to those who require it to provide the service or comply with law.

5. Security

The Processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 UK GDPR. The measures in force are described in Annex III. The Processor may update them provided the overall level of security is not reduced.

6. Sub-processors

The Controller grants general written authorisation for the Processor to engage Sub-processors. Those engaged at the date of this DPA are listed in Annex II.

The Processor shall give not less than 30 days' notice of any intended addition or replacement. The Controller may object on reasonable data protection grounds within that period; if the objection cannot be resolved, the Controller may terminate without penalty and receive a pro-rata refund of prepaid fees. The Processor shall impose obligations on each Sub-processor no less protective than these, and remains fully liable for their performance.

7. Assistance with data subject rights

The Processor shall assist the Controller in responding to requests from Buyers exercising their rights under Chapter III UK GDPR. Self-service functionality is provided so most requests can be met without contacting the Processor:

Access and portability (Art. 15, 20) — export the complete record held about a Buyer in machine-readable form from the customer screen.
Erasure (Art. 17) — erase a Buyer's personal data from the customer screen. Name, telephone number, delivery address and notes are removed; order totals and dates are retained in non-identifying form for the Controller's accounting obligations.
Rectification (Art. 16) — correct a Buyer's details on the customer record.

Where a Buyer contacts the Processor directly, the Processor shall not respond substantively but shall forward the request to the relevant Controller without undue delay and tell the Buyer it has done so.

8. Assistance with Articles 32–36

The Processor shall assist the Controller in ensuring compliance with its obligations on security, breach notification, data protection impact assessments and prior consultation, taking into account the nature of processing and the information available to the Processor.

9. Personal data breach

The Processor shall notify the Controller without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Buyer Personal Data, describing so far as known its nature, likely consequences, the measures taken, and a contact point for further information.

The Controller is responsible for notifying the Information Commissioner's Office within 72 hours where required, and affected Buyers where applicable. The 48-hour period above is intended to give the Controller a meaningful opportunity to meet that deadline.

10. Deletion, return and retention

On termination of the Controller's account the Processor shall, at the Controller's choice, delete or return all Buyer Personal Data and delete existing copies, unless storage is required by law. The Controller may export all data at any time beforehand.

Deleting an account removes the Controller's drops, items, customers, orders and uploaded images from the live system immediately. Residual copies may persist in encrypted infrastructure backups until overwritten in the ordinary cycle, which does not exceed 30 days. Backups are used only for disaster recovery.

Independently of termination, the Processor applies an automated retention limit: Buyer Personal Data is anonymised 24 months after the Buyer's most recent order. This cannot be disabled, and is applied to satisfy the storage limitation principle in Article 5(1)(e) UK GDPR.

11. Audit

The Processor shall make available all information necessary to demonstrate compliance with Article 28 UK GDPR and this DPA, and shall allow for and contribute to audits by the Controller or its mandated auditor, subject to: at least 30 days' written notice; no more than once in any 12-month period (save where required by a supervisory authority or following a breach); conduct during normal business hours without unreasonable disruption and subject to confidentiality; and the Controller bearing its own and the Processor's reasonable costs. The Processor may satisfy this by providing relevant third-party certifications or security documentation.

12. International transfers

As at the date of this DPA, Buyer Personal Data is stored and processed within the European Economic Area (Germany). The Processor relies on the UK adequacy regulations in respect of the EEA, so no International Data Transfer Agreement or Addendum is required. The Processor shall not relocate processing outside the UK or EEA without first putting an appropriate transfer mechanism in place and updating Annex II.

13. Liability and general

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms of Service. In the event of conflict between this DPA and the Terms of Service regarding the processing of Buyer Personal Data, this DPA prevails.

This DPA takes effect when the Controller accepts the Terms of Service and continues until the account is terminated and all Buyer Personal Data has been deleted or returned. It is governed by the law of England and Wales, and the parties submit to the exclusive jurisdiction of the courts of England and Wales.

Annex I — Description of processing

Subject matter	Provision of The Next Drop, enabling the Controller to publish order pages and receive and manage orders from Buyers.
Duration	The term of the account, subject to the 24-month anonymisation limit.
Nature	Collection, recording, storage, structuring, retrieval, display to the Controller, erasure and anonymisation, by automated means.
Purpose	To enable the Controller to receive, view and fulfil Buyer orders, maintain customer records, and view sales analytics.
Data subjects	Buyers — individuals placing an order through the Controller’s drop pages.
Personal data	Name; telephone number; delivery address (where delivery is enabled and supplied); free-text order note; order history including items, quantities, amounts and timestamps.
Special category data	None is requested. A Buyer may voluntarily disclose health information (for example an allergy) in a free-text note. The Controller is responsible for identifying an Article 9 condition if it relies on such information.
Children’s data	The service is not directed at children and must not knowingly be used to collect their data.
Frequency	Continuous, for the duration of the account.

Annex II — Sub-processors and locations

Sub-processors engaged in the processing of Buyer Personal Data:

Supabase	Database, file storage and authentication. AWS eu-central-1 — Frankfurt, Germany (EEA).
Vercel	Application hosting and serverless compute. Region fra1 — Frankfurt, Germany (EEA). Requests may route via an edge location closer to the user, which terminates TLS and forwards the request; application code executes and personal data is processed only in fra1.

The following providers are engaged but do not process Buyer Personal Data, and are listed for transparency: Resend (seller sign-in emails — Controller's email address only; Buyers are never emailed) and Stripe (seller subscription billing — Controller's billing data only).

Annex III — Technical and organisational measures

Access control and segregation

Row Level Security is enforced on every database table containing personal data, so a seller can access only their own records. This is enforced at the database layer, not only in application code.
Buyer personal data is not readable by unauthenticated callers; this has been verified by direct probing of the public database API.
Privileged database functions are restricted by explicit grants and are not executable by unauthenticated or ordinary authenticated callers.
Server-side privileged credentials are held only in server environment configuration and are never exposed to the browser.

Buyer order confidentiality

Order confirmation pages are addressed by a 128-bit random token rather than a guessable order reference, preventing enumeration of other Buyers' orders.

Data integrity

Order prices and item names are re-read from the database server-side at checkout; values supplied by the client are not trusted.
Stock decrements are performed atomically within a database transaction, and order creation is idempotent.

File storage

The image store is not enumerable by unauthenticated callers, and write and delete permissions are scoped to the uploading account.

Transport and platform

All traffic is served over TLS. Infrastructure is patched and maintained by the Sub-processors named in Annex II.

Retention and erasure

Automated anonymisation of Buyer personal data 24 months after the Buyer's last order, executed daily.
Self-service export and erasure available to the Controller; account deletion removes records and uploaded files.

Organisational

Administrative access to production systems is restricted to the directors of Precious Memories Ltd, on the basis of operational necessity.
Any contractor with access to personal data is engaged under written confidentiality obligations before access is granted.
Personal data breaches are handled by the data protection contact at privacy@thenextdrop.co.uk, who is responsible for notifying affected Controllers under clause 9.
Production credentials are held in environment configuration accessible only to those administrators, and are rotated if compromise is suspected.

Acceptance

This DPA is incorporated by reference into the Terms of Service. By creating a seller account on The Next Drop, or by continuing to use the service, you accept this DPA. No signature is required for it to take effect. If you require a separately executed copy, contact privacy@thenextdrop.co.uk.

Precious Memories Ltd, 66 Paul Street, London, EC2A 4NA. Registered in England and Wales, company number 17332454.