Data Processing Agreement

Version 1.0, June 2026

This Data Processing Agreement ("DPA") governs how Fashion Business Collective Ltd, trading as SureTariff ("Processor", "we", "us"), processes personal data on behalf of the business customer ("Controller", "you") when you use the Service. It forms part of, and is incorporated into, the Terms of Use. Terms defined there have the same meaning here.

1. Definitions

"UK GDPR", "Personal Data", "processing", "controller", "processor", "data subject", and "personal data breach" have the meanings given in the UK GDPR and the Data Protection Act 2018 ("Data Protection Laws"). "Sub-processor" means any processor we engage to process Personal Data on your behalf.

2. Roles and Scope

You are the controller and we are your processor in respect of the Personal Data described in Annex I. Each party will comply with its obligations under Data Protection Laws. You are responsible for the lawfulness of the Personal Data you submit and of your instructions, and for ensuring you have a lawful basis and all necessary notices and consents, including for any third-party personal data contained in Product Data.

The core Service processes Product Data, which is commercial business information and generally does not contain Personal Data. The Service does not process consumer data. This DPA applies only to the limited extent that we process Personal Data on your behalf, and any such Product Data is deleted within 24 hours of classification acceptance in the ordinary course.

Account data (processed by us as controller). As part of account management we collect and store the names and business email addresses of your authorised users, together with your company contact details. We process this account data as a controller (not as processor under this DPA) in order to administer accounts, provide support and billing, and keep your users informed about system functionality updates, security notices, and similar service communications. This processing is described in our Privacy Policy.

3. Our Processing Obligations

We will:

  • process Personal Data only on your documented instructions (including those in the Terms and this DPA), unless required otherwise by law, in which case we will inform you unless legally prohibited;
  • ensure persons authorised to process Personal Data are bound by appropriate confidentiality obligations;
  • implement and maintain the technical and organisational security measures in Annex II, taking account of Article 32 of the UK GDPR;
  • assist you, taking into account the nature of processing, to respond to data subject rights requests;
  • assist you in complying with Articles 32 to 36 of the UK GDPR (security, breach notification, impact assessments, prior consultation), taking into account the nature of processing and the information available to us;
  • delete Product Data within 24 hours of classification acceptance in the ordinary course, and, at the end of the Service, delete or return remaining Personal Data at your choice and delete existing copies unless legal requirements require continued storage.

4. Personal Data Breach

We will notify you without undue delay, and in any event within 72 hours of becoming aware, of any personal data breach affecting Personal Data we process on your behalf, with the information reasonably available to us to help you meet your own obligations. You are responsible for notifying the Information Commissioner's Office and affected data subjects where required.

5. Sub-processors

You provide general authorisation for us to engage Sub-processors (including third-party AI model providers and hosting providers) to process Personal Data, provided we impose obligations on each Sub-processor no less protective than this DPA and remain responsible to you for their performance. The categories of Sub-processor we engage are set out in Annex III, and the current list of named Sub-processors is available to any client with an active account on request at any time. We will inform you of any intended change and allow you at least 30 days to object on reasonable data-protection grounds.

6. International Transfers

By signing up to and using the Service, you specifically authorise and instruct us to host and process your data in the United Kingdom, unless a different hosting location is specifically agreed with you in writing. Where any Sub-processor (including a third-party AI model provider) processes Personal Data outside the United Kingdom, we will not make that transfer unless an appropriate safeguard is in place, namely the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with any supplementary measures required. The 24-hour deletion of Product Data further limits the personal data involved in any such processing.

The United Kingdom is our default hosting location, and customers in other regions, including the European Union and the United States, are normally served from our UK servers. Where specifically agreed with you in writing, the Service itself may instead be hosted in another region, for example a European Union or United States data-centre instance. Even in that case, you acknowledge and agree that account management is carried out from our United Kingdom office using UK-based servers, and that your business account information (the names and business email addresses of your authorised users and your company contact details) will be stored in the United Kingdom.

7. Audit and Information

We will make available information reasonably necessary to demonstrate compliance with this DPA and allow for and contribute to audits on reasonable prior notice, no more than once per year except where required by a supervisory authority or following a personal data breach, subject to confidentiality and to not compromising the security of other customers.

8. Liability and Duration

This DPA takes effect on the start of the Terms and continues for as long as we process Personal Data on your behalf. Liability under this DPA is subject to the limitation of liability in the Terms. In the event of conflict with the Terms in respect of processing of Personal Data, this DPA prevails.

Annex I — Details of Processing

  • Subject matter: provision of the SureTariff tariff classification Service.
  • Duration: the term of the Terms.
  • Nature and purpose: processing Product Data to generate HTS classifications, Confidence Scores, and Reasoning Narratives, and delivering results to you.
  • Types of Personal Data: the names and business email addresses of your authorised users, and your company contact details (held by us as controller for account management); and any Personal Data you include within Product Data (for example, supplier contact details), which should be minimised and is deleted within 24 hours of classification acceptance. The Service does not process consumer data.
  • Categories of data subject: your personnel and authorised users; and any individuals referenced in the Product Data you submit.

Annex II — Security Measures

Measures include: hosting in a UK Tier IV, ISO 27001 certified data centre; encryption of data in transit (TLS) and at rest; automatic deletion of Product Data within 24 hours of classification acceptance; role-based access controls and least-privilege access; logging and monitoring; and staff confidentiality undertakings and data-protection training. Credentials you provide for Connected Systems are encrypted using a hardware-backed, non-exportable key held in a Hardware Security Module certified to FIPS 140-2 Level 3 (Google Cloud Key Management Service) and are stored only as ciphertext. We review these measures periodically and update them to maintain a level of security appropriate to the risk.

Annex III — Sub-processors

We engage the following categories of Sub-processor to provide the Service. The current list of named Sub-processors may be requested by any client with an active account at any time, and we will notify you of changes in line with Section 5.

  • Third-party AI model provider(s) - generating classifications from Product Data.
  • Hosting and data-centre provider (United Kingdom) - operating the Service.
  • Email delivery provider - account, support, and service-update communications.
  • Payment processor - subscription billing.

Contact

For any data-protection matter under this DPA, contact us at the address in the Terms. SureTariff is a trading name of Fashion Business Collective Ltd, 124 City Road, London, EC1V 2NX, United Kingdom.