Usedkit › Data processing agreement
Data processing agreement
Under Article 28 of the GDPR, between the shop (the controller) and Usedkit, run by Pyry Savela (the processor). Part of the terms, accepted with them. In force from 13 October 2026.
1. What is processed, and why
| Purpose | Telling the shop's customers, at their request, when an item of the model they wait for is listed; the shop's statistics of it. |
|---|---|
| Data subjects | The shop's customers who sign up through its forms. |
| Personal data | Email address, the model or search words, an optional maximum price, the language, sign-up and confirmation times, which emails were sent and which links were opened. |
| Duration | Unconfirmed sign-ups: 7 days. Confirmed: until the customer unsubscribes, the shop erases them, or one year. Everything: until 30 days after the agreement ends. |
2. The processor
- Processes the data only on the shop's documented instructions: these terms, the plugin's settings and the shop's requests. If an instruction seems to break the law, we say so.
- Keeps the data confidential; only the operator has access.
- Protects it (Article 32): connections over TLS; API keys stored only as hashes; the server and its database reachable only by the operator; daily backups kept 14 days; data kept to what the service needs and deleted on schedule.
- Helps the shop answer its customers' requests: a customer's data can be erased through the plugin, and we provide a copy of it on request.
- Tells the shop of a personal data breach without undue delay, and in any case within 48 hours of becoming aware of it, with what is known.
- Gives the shop the information needed to show this agreement is kept, and answers reasonable questions about it.
- When the agreement ends, deletes the data within 30 days (backups within 14 days after that), unless the law requires keeping it.
3. Sub-processors
The shop authorises these. We tell shops by email at least 30 days before adding or replacing one; a shop that objects can end the agreement before the change. Each is bound by data protection terms at least as strict as these.
| Who | Where | What for |
|---|---|---|
| Brevo (Sendinblue SAS) | France, EU | Delivers the emails: confirmation, arrival and service emails. |
| Cloudflare, Inc. | United States, with EU data centres; EU Standard Contractual Clauses and the EU-US Data Privacy Framework | Carries traffic to the service (network, TLS) and forwards replies to Usedkit's own addresses. |
4. Where
The data is stored on a server in Finland. Transfers outside the EU happen only through the sub-processors above, under the safeguards named.