Version: 1.0 Effective date: 9 October 2026
This Data Processing Addendum ("DPA") forms part of the Terms of Service between KF Premium LTD ("XEWI", "Processor") and the customer ("you", "Controller").
1. Definitions
"UK GDPR", "Data Protection Act 2018", "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have their meanings under UK data protection law. "Customer Personal Data" means personal data we process on your behalf in providing the Service.
2. Roles and scope
2.1 You are the controller and XEWI is your processor for Customer Personal Data. The details of the processing are in the Annex.
2.2 XEWI is a controller, not a processor, of data about you as a customer (account, billing and usage data). The Privacy Notice covers that data.
2.3 You confirm that you have a lawful basis to provide Customer Personal Data to us and to instruct us to process it. In particular, your use of Amazon buyer data must comply with Amazon's data protection policies.
3. Our obligations
XEWI will:
- process Customer Personal Data only on your documented instructions. These Terms, this DPA and your use and configuration of the Service are your instructions. We will tell you if we believe an instruction infringes data protection law;
- ensure that anyone authorised to process it is bound by confidentiality;
- implement appropriate technical and organisational measures (clause 5);
- use sub-processors only in line with clause 6;
- assist you, taking into account the nature of the processing, with data subject requests, security, breach notifications, data protection impact assessments and prior consultation with the ICO;
- delete or return Customer Personal Data at the end of the Service (clause 7);
- make available the information reasonably needed to demonstrate compliance with Article 28, and allow audits (clause 8); and
- not sell Customer Personal Data or use it for our own purposes, except to create aggregated, de-identified data as permitted by the Terms of Service.
4. Personal data breaches
We will notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. We will give you the information you reasonably need to meet your own notification obligations and keep you updated as we learn more.
5. Security measures
The measures we maintain include:
- hosting in the UK (AWS eu-west-2);
- encryption in transit (TLS/HSTS) and at rest;
- encryption of Amazon access credentials with a key held in a secrets manager;
- tenant isolation, with database row-level security;
- least-privilege access for staff and systems;
- hashing of personal identifiers in logs, and masking of sensitive fields such as buyer VAT numbers;
- a web application firewall with rate limiting;
- threat detection; and
- security scanning in the deployment pipeline.
We may update these measures, provided the overall level of protection is not reduced.
6. Sub-processors
6.1 You give general authorisation for XEWI to use the sub-processors listed in the Sub-processor List.
6.2 We will give at least 30 days' notice of a new or replacement sub-processor. If you object on reasonable data protection grounds, we will discuss it with you in good faith. If we cannot resolve the objection, you may terminate the affected Service and receive a refund of prepaid fees for the unused period.
6.3 We will impose data protection obligations on each sub-processor that are no less protective than this DPA, and we remain responsible for their performance.
7. Deletion and return
When you close your account, we stop processing Customer Personal Data at once (your Amazon connections are removed) and permanently delete it from our operational systems, data lake and file storage 30 days after closure, unless you cancel the closure by signing back in during that period, or the law requires us to keep it. Deleted data may persist in our database provider's encrypted backups until they are overwritten, within 7 days. On your written request, we will delete Customer Personal Data within one month. Before closing, you can export the data the Service makes available for export.
8. Audits
We will answer reasonable written questions about our compliance, and provide summaries of our security measures. If that is not enough to show compliance, you may, on 30 days' notice, no more than once a year, and at your own cost, audit our compliance with this DPA through an independent auditor bound by confidentiality.
9. International transfers
Where a sub-processor processes Customer Personal Data outside the UK, we will ensure an approved transfer mechanism is in place: UK adequacy regulations, the ICO's International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.
10. Liability and precedence
The limitations of liability in the Terms of Service apply to this DPA, except where the law does not allow them to. If this DPA conflicts with the Terms of Service on data protection, this DPA prevails.
Annex: details of processing
| Subject matter and duration | Providing the Service, for the term of the Terms of Service plus the deletion period in clause 7 |
| Nature and purpose | Collecting, storing, analysing and displaying the seller's Amazon data; generating reports and recommendations; carrying out actions the seller approves or automations the seller enables |
| Data subjects | The seller's buyers; the seller's own staff and users; the seller's contacts included in its Amazon data |
| Categories of personal data | Buyer name, email address (often anonymised by Amazon), shipping address where Amazon provides it, order details; buyer name and VAT number in VAT transaction reports; user names and emails |
| Special category data | None intended. The seller must not upload it |
| Sub-processors | As listed in the Sub-processor List |