Data Processing Addendum

The Customer is the controller and Stem is the processor for Customer Personal Data. Stem will process it only to provide, secure and support the Services, follow the Customer’s documented lawful instructions and comply with law. The User Agreement, configured features, support requests and this DPA form those instructions.

• Have a lawful basis, provide required notices and give only lawful instructions.
• Configure access and retention appropriately and keep account contacts current.
• Respond to people’s rights requests and tell Stem when assistance is needed.
• Do not submit prohibited or unusually sensitive data without written approval and safeguards.

Stem ensures people authorised to process Customer Personal Data are bound by confidentiality and access it only as needed. Stem maintains proportionate technical and organisational measures including access controls, secure credential handling, encrypted transport, tenant separation, logging, rate limiting, backup controls and incident procedures.

The Customer gives general authorisation for vetted subprocessors needed for hosting, synchronisation, storage, communications, security, support, document rendering and payment confirmation. Stem remains responsible for imposing appropriate data-protection obligations on them.

Stem will give reasonable notice of a material new subprocessor where required, consider a documented reasonable objection and use a lawful safeguard for restricted international processing.

Taking account of the nature of processing, Stem will reasonably assist with access, correction, deletion, restriction, portability and objection requests; security and breach duties; impact assessments; regulator consultations; and information reasonably needed to demonstrate compliance. Extra work outside ordinary product controls may be chargeable if agreed first.

Stem will notify the Customer without undue delay after confirming a personal-data breach affecting Customer Personal Data and will provide available information about the nature, likely consequences, affected data and mitigation. The Customer remains responsible for notifications it must make as controller.

During the service, the Customer may use available export features. On verified termination or deletion instruction, Stem will delete or return Customer Personal Data within a reasonable period, subject to protected backup rotation and records that law requires Stem to retain. Retained data remains protected and is used only for the required purpose.

Subject: providing the contracted business software and support. Duration: the account term plus deletion, backup and lawful-retention periods. People: the Customer’s staff, customers, suppliers, contacts and any other people lawfully recorded.

Data: identity/contact, roles, activity/audit, sales/returns, products, credit/loyalty, invoices, delivery details, payment method/reference/status and supplier/staff business data. Sensitive data is not authorised by default.

This DPA takes priority over inconsistent User Agreement terms only for processing Customer Personal Data. It is governed by the governing-law clause in the User Agreement, while preserving mandatory data-protection rights and regulator powers.