Data Processing Agreement (DPA)

This Data Processing Agreement ("DPA") forms part of the agreement for MyQCart POS Services between the Client ("Controller", "you") and MyQCart™ ("Processor", "we", "us", or "our"), where MY QCART is the trading division of ORVIK Group LTD with its registered office at 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. It applies where MyQCart processes personal data on your behalf in the course of providing the Services.

This DPA is intended to help business Clients operating in or serving the UK meet their obligations under UK GDPR when using a third-party processor.

1. Definitions

• "Controller", "Processor", "Personal Data", "Processing", "Data Subject", "Supervisory Authority" and "Personal Data Breach" shall have the meanings given to them under applicable Data Protection Legislation.
• "Data Protection Legislation" means all applicable data protection and privacy legislation in force from time to time in the UK, including the UK GDPR and the Data Protection Act 2018.
• "UK GDPR" has the meaning given to it in section 3(10) of the Data Protection Act 2018.
• "Subprocessor" means any third party appointed by the Processor to process personal data on behalf of the Controller.

2. Roles of the Parties

• The Client is the Data Controller for personal data relating to its own staff, customers, and end users entered into the Services.
• MyQCart is the Data Processor, processing such data solely on behalf of the Client.

3. Scope and Nature of Processing

• Subject matter: Provision of POS software, sales terminal access, Double Accounting Entry record-keeping, and support services.
• Duration: For the term of the Client's active subscription.
• Nature and purpose: Storage, transaction ledgering, and customer ledger records.

4. Processor Obligations

MyQCart shall:

• Process personal data only on the documented instructions of the Client.
• Ensure authorized personnel are bound by confidentiality.
• Implement technical and organizational security measures, including Double Accounting Entry ledger reconciliation and HTTPS TLS encryption.
• Notify the Client without undue delay upon becoming aware of any confirmed personal data breach.

5. Subprocessors

MyQCart imposes data protection obligations on approved subprocessors (cloud infrastructure, payment processors) and remains responsible for their performance.

6. International Transfers

Standard contractual clauses and legal transfer safeguards are maintained for any cross-border transfers.

7. Security Measures

MyQCart maintains strict security measures including TLS/SSL encryption, role-based access, cryptographic password hashing, and optional daily cloud backups.

8. Audit Rights

Upon reasonable notice, the Client may verify MyQCart's compliance with this DPA.

9. Confidentiality

Each party shall keep confidential all commercial and technical information received under this DPA.

10. Liability

Liability under this DPA is subject to the limitation of liability provisions in our Terms of Service.

11. Governing Law

This DPA shall be governed by the laws of England and Wales.

12. Contact Us