What this covers
This Data Processing Agreement ("DPA") forms part of the Terms of Service between Centurion Network ("we", the processor) and each shop that uses tcgpos ("you", the controller). It applies whenever we process personal data about your customers, staff or other people on your behalf, and in particular where the UK GDPR, the Data Protection Act 2018 or the EU GDPR applies to you. If this DPA and the Terms disagree about personal data, this DPA wins.
You accept it by creating or using a tcgpos shop. There is nothing separate to sign; contact us if you need a countersigned copy for your records.
Details of the processing
- Subject matter and purpose: providing tcgpos to you: the register, inventory, buylist, customer records, store page, online orders, events, email to your customers, reports and support.
- Duration: while you use tcgpos, and afterwards only for as long as section 9 allows.
- Nature: storing, organising, retrieving, displaying, sending, exporting and deleting data, as you direct through the dashboard, register and store page.
- People concerned: your customers and store page visitors, people who sell cards to you, event players, and your staff.
- Types of personal data: names, email addresses, phone numbers, postal addresses, purchase and trade-in history, store credit and loyalty balances, event entries, want lists, messages, and - where you record them for buying second-hand goods - identification details from a seller's ID. Card numbers are handled by your payment processor and never reach tcgpos.
- Special categories: none are needed by tcgpos. Don't record health, religious or similar data about people in it.
1. Your instructions
We process the personal data only on your documented instructions: the Terms, this DPA, and what you or your staff do in tcgpos. We don't use it for our own purposes, sell it or share it except as this DPA allows. If we think an instruction breaks data protection law, we will tell you. If the law makes us process the data some other way, we will tell you first unless the law forbids it.
2. Confidentiality
Everyone at Centurion Network who can reach your data is bound to keep it confidential, and has access only as needed to run and support tcgpos.
3. Security
We keep appropriate technical and organisational measures in place for the risk, including:
- a separate database for each shop;
- encryption in transit (HTTPS) and encryption of stored secrets and sellers' ID details;
- passwords and PINs stored only as one-way hashes, two-step sign-in, and two-step sign-in required for our own admin staff;
- access to a shop for support only when the shop asks, and recorded;
- nightly backups of every shop's database, kept 7 days on our server, with an encrypted copy stored off-site for 30 days;
- limits on repeated sign-in attempts.
4. Sub-processors
You authorise us to use these sub-processors, each bound by written terms that protect the data at least as well as this DPA:
- Tier.net, which hosts the servers that run tcgpos and hold each shop's database (United States);
- Cloudflare, which manages our domain names and stores our encrypted off-site backups, which it cannot read (United States);
- Google (Google Workspace), which relays the email tcgpos itself sends (United States).
The payment processors, email providers and other services you choose to connect (such as Stripe, Square, PayPal, Authorize.net, NMI, QuickBooks, eBay or Discord) work for you under your own agreement with them, not as our sub-processors.
We will give you at least 30 days' notice, by email or in the dashboard, before adding or replacing a sub-processor. If you object on reasonable data protection grounds and we can't resolve it, you may cancel and we will refund any prepaid time you haven't used.
We remain responsible to you for our sub-processors' work.
5. International transfers
tcgpos is run from, and stores data in, the United States. For personal data from the UK, the transfer is made under the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the UK Information Commissioner, which is incorporated into this DPA, with the EU Standard Contractual Clauses (module two, controller to processor) for personal data from the EU or EEA. You are the exporter and we are the importer; the details above complete their annexes, and section 3 describes the security measures. Where the UK or EU recognises another valid transfer mechanism we rely on, we may use that instead.
6. Helping you with people's rights
The dashboard lets you find, correct, export and (for UK shops) erase a customer's personal data, so you can answer most requests yourself. If a person contacts us directly, we will pass the request to you and not answer it ourselves unless you ask us to. We will also give you reasonable help with data protection impact assessments and with questions from a data protection authority, as far as they concern tcgpos.
7. Personal data breaches
If we become aware of a personal data breach affecting your data, we will tell you without undue delay, with what we know about what happened, the data and people affected, its likely consequences and what we are doing about it, and keep you updated - so you can meet your own duty to report it within 72 hours where that applies.
8. Information and audits
We will give you the information you reasonably need to show that this DPA is being followed, and answer reasonable written questions about our security. If that isn't enough, or a data protection authority requires it, we will allow an audit by you or an independent auditor bound by confidentiality, on reasonable notice, during business hours and no more than once a year unless there has been a breach.
9. When you leave
Before your shop closes you can export your data, and we will provide a full export on request. When you ask us to delete your shop, we delete its database; its copies in backups are deleted as those backups expire, within 30 days, unless the law requires us to keep something - in which case we keep only that, only for as long as required.
Contact
Questions about this DPA, or requests under it, can be sent to us:
- Email: support@tcgpos.app
- Mail: Centurion Network, PO Box 461, Dallas, NC 28034, United States
Shops already on tcgpos can also write to us from Support in their dashboard. More ways to reach us are on the contact page.