Data processing agreement
How Sooquna processes your customers' data on your behalf.
Last updated: 21 October 2026
Roles
This agreement is part of our Terms of service. For the personal data of your store's customers, you are the controller and Sooquna is the processor: we process that data only to provide the service to you.
Processing instructions
We process your customers' data only on your documented instructions, which are given by how you set up and use your store, and by these terms. Our staff who can access it are bound by confidentiality, and we tell you if we believe an instruction breaks the law.
Security measures
We protect the data with encryption in transit, encryption of sensitive settings at rest, separation between stores at the database level, access limited to the people who need it, two-step verification for staff, activity logs, and regular backups.
Sub-processors
We use these sub-processors: DigitalOcean (hosting and database, India), Cloudflare (network, security and file storage, global), SMTP2GO (email delivery) and Meta (WhatsApp messages, when you turn them on). We will tell you by email before adding or replacing a sub-processor, and you may object.
Data subject requests
When one of your customers asks to see, correct or delete their data, you can do most of this in your admin. Where you need our help, we assist you within a reasonable time.
Breach notification
If we become aware of a breach affecting your customers' data, we tell you without undue delay, and within 72 hours, with what we know about it and what we are doing about it.
Deletion and return
You can export your data at any time. When your store is closed, we delete your customers' data within 90 days, except where the law requires us to keep it.