Data processing agreement

This agreement

This data processing agreement forms part of the terms of service for Restoc. It applies whenever a customer's use of Restoc involves us processing personal data on the customer's behalf, and needs no signature: it takes effect when the customer accepts the terms. Words such as controller, processor, personal data and processing mean what they mean in the UK GDPR and the Data Protection Act 2018.

The particulars

The processor

Kaleido Ltd, a company registered in England and Wales, company number 17516332, whose registered office is at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ

The controller

The customer, the organisation that holds the Restoc account

Subject matter

Providing Restoc to the customer

Duration

For as long as the customer uses Restoc, and until the data is deleted or returned at the end

Nature and purpose

Hosting, storing and processing personal data so that Restoc works for the customer

Types of personal data

Your name, email address and a hash of your password; Your store's .myshopify.com domain, a Shopify Admin API access token (granted at install or pasted from your custom app) and that app's API secret key; Sync bookkeeping: when your store last synced, whether its stock came from Shopify or sample data, how much of your catalogue it read, and any sync error; Tracked SKUs: title, your own SKU code, Shopify variant id, current stock, lead time and computed reorder point; Sales quantities and dates per SKU, with the Shopify order reference; Your alert settings: the email address reorder alerts go to (your account email until you change it) and a Slack webhook URL, if you set one; Which setup steps your account has reached (account created, store connected, first sync, first lead time saved) and when it reached each; Your plan tier, trial end date and the state of your Shopify subscription charge; When you last used the app (at most once an hour) and which core actions you completed, such as a lead time saved or a report exported; and the account details of the customer's users (names, email addresses and sign-in records)

People the data is about

The customer's users, and the people whose details the customer puts into Restoc

Where it is processed

Amazon Web Services, in a single region alongside the app. Pages are served through CloudFront; the Postgres database stays in its region.

What Kaleido Ltd agrees to

As the processor, we will:

• process the personal data only on the customer's documented instructions, which are these terms and the customer's use of Restoc, unless the law requires otherwise, in which case we tell the customer first unless the law forbids it;
• make sure everyone we allow to process it is bound to keep it confidential;
• take the technical and organisational measures Article 32 of the UK GDPR requires to keep it secure, including encryption of data in transit and access limited to the people who need it;
• use only the subprocessors on our subprocessors page, which the customer authorises by this agreement. We update that page before a new subprocessor processes the data; the customer may object within 30 days, and if we cannot resolve the objection, end its use of Restoc and receive a refund of any amount paid for a period it will not receive. Each subprocessor is bound by obligations no less protective than these, and we remain responsible for it;
• help the customer, as far as we reasonably can, to answer requests from the people the data is about;
• help the customer meet its obligations on security, personal data breaches, data protection impact assessments and consulting the regulator, taking into account what we process and the information we have;
• tell the customer without undue delay after we become aware of a personal data breach affecting its data;
• at the end of the customer's use of Restoc, delete the personal data, or return it if the customer asks, unless the law requires us to keep it (each of the customer's users can download a copy of their own data from Settings in Restoc before then);
• make available the information needed to show that we meet these obligations, and allow for and contribute to audits by the customer or an auditor it appoints, on reasonable notice and no more than once a year unless a regulator requires it or after a personal data breach;
• tell the customer straight away if we think an instruction breaks data protection law.

What the customer agrees to

The customer is responsible for having a lawful basis for the personal data it puts into Restoc, for telling the people it is about what the law requires, and for the instructions it gives us.

Transfers outside the United Kingdom

We transfer the personal data outside the United Kingdom only where the transfer is covered by the UK's adequacy regulations or by appropriate safeguards, such as the International Data Transfer Agreement or the UK Addendum to the EU's standard contractual clauses.

Liability

Each side's liability under this agreement is subject to the limits in the terms of service, except where the law does not allow it to be limited.

Keeping a copy

To keep a copy of this agreement, print this page or save it as a PDF from your browser.

Who we are

Restoc is a product of Kaleido Ltd, a company registered in England and Wales, company number 17516332, whose registered office is at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.

You can reach us at support@restocapp.com.

Last updated 2026-10-21