Data Processing Addendum
This Data Processing Addendum ("DPA") forms part of the MAXBIO Pay Terms of Service between you (the creator, the "Controller") and us (the "Processor"). It applies to personal data of your buyers, subscribers and affiliates that we process for you ("Customer Personal Data").
1. Who we are
MAXBIO Pay is operated by Craig McIntosh, a sole trader trading as MAXBIO.LINK and MAXBIO Pay ("we", "us", "our"). Our address is 4 Hyndford's Close, 34 High Street, Edinburgh EH1 1TG, Scotland, United Kingdom.
Contact: support@maxbio.link or support.maxbio.link.
2. Scope and instructions
We process Customer Personal Data only on your documented instructions, which are these Terms, your configuration of the Service (for example your email rules, webhooks and integrations) and any written instructions you give us, unless the law requires otherwise (in which case we will tell you, unless the law prevents it).
- Subject matter and purpose: hosting checkouts, processing orders, delivering digital products, sending receipts and subscription emails, tracking affiliate referrals, and sending data to services you connect.
- Data subjects: your buyers, subscribers, prospective buyers and affiliates.
- Categories: name, email, order and subscription details, payment metadata, IP address, download history, marketing consent, referral codes.
- Duration: the term of your account plus the deletion periods in our Privacy Policy.
3. Our obligations
- Staff and contractors who can access Customer Personal Data are bound by confidentiality.
- We keep appropriate technical and organisational security measures, including encryption in transit, encryption of stored secrets, access controls, backups and logging.
- We will help you respond to data subject requests and with security, breach notification, impact assessments and consultations, taking into account the nature of the processing.
- We will notify you without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data.
- At the end of the Service we delete Customer Personal Data (or return it via export, at your choice) within 90 days, except where the law requires us to keep it.
- We will make available information needed to demonstrate compliance, and allow reasonable audits (normally by written questionnaire) on 30 days' notice, no more than once a year.
4. Sub-processors
You authorise us to use the sub-processors listed at Sub-processors. We will give at least 14 days' notice of new sub-processors by updating that page and notifying account holders; you may object on reasonable data-protection grounds, and if we cannot resolve the objection you may terminate. We impose data-protection terms on our sub-processors equivalent to this DPA and remain responsible for them.
Services you connect (your email-marketing platform, email sender, webhook endpoints, Stripe and PayPal accounts) are your own processors or independent controllers, not our sub-processors.
5. International transfers
Where Customer Personal Data is transferred outside the UK or EEA, we rely on adequacy regulations, the UK International Data Transfer Addendum or the EU Standard Contractual Clauses (Module 2 or 3 as applicable), which are incorporated by reference where required.
6. Your obligations
You are responsible for having a lawful basis for the processing, providing privacy information to your buyers, and the lawfulness of your instructions.
7. Contact us
Questions about this document: support@maxbio.link, support.maxbio.link, or post to Craig McIntosh, a sole trader trading as MAXBIO.LINK and MAXBIO Pay, 4 Hyndford's Close, 34 High Street, Edinburgh EH1 1TG, Scotland, United Kingdom.