1. Parties and roles
Between GBNOX LLC, 5005 W Laurel St, Tampa, FL 33607, United States (“Processor”) and the customer named on the account (“Controller”).
For personal data the Controller loads into its workspaces, the Controller is the controller and GBNOX is the processor. For the Controller’s own account and billing data, GBNOX is the controller and the Privacy Policy applies instead.
“Data Protection Laws” means the UK GDPR, the EU GDPR, the CCPA/CPRA and any other privacy law applicable to the processing.
2. Subject matter and duration
GBNOX processes personal data to provide GBNOX Radar under the Terms of Service, for as long as the account is open, plus the retention periods in section 9.
3. Nature and purpose of processing
Hosting and storing workspace data; retrieving listing, order, inventory and fee data from marketplace APIs on the Controller’s instruction; scoring listings; generating AI rewrites when requested; producing reports; sending service notifications; and providing support.
4. Types of personal data
- Users the Controller invites — name, email address, role, activity records.
- Client and brand identifiers the Controller enters into workspaces, which may name individuals where a client is a sole trader.
- Marketplace data retrieved on instruction. This is business data — listings, fees, inventory, aggregate order figures. It is not intended to include consumer names or addresses, and the Controller should not load them.
Categories of data subject: the Controller’s personnel, and personnel of the Controller’s clients.
No special-category data. GBNOX Radar is not designed for health, biometric, genetic, political, religious or similar data, and the Controller must not submit it.
5. Processing only on instructions
GBNOX processes personal data only on the Controller’s documented instructions, which comprise the Terms of Service, this DPA, and the actions the Controller takes in the product. If GBNOX must process for a legal reason instead, it will tell the Controller first unless the law forbids it.
GBNOX will tell the Controller if, in its opinion, an instruction infringes Data Protection Laws.
GBNOX does not sell personal data, does not share it for cross-context behavioural advertising, and does not retain, use or disclose it for any purpose other than performing the Services.
6. Confidentiality
Everyone GBNOX authorises to process the data is bound by confidentiality obligations and gets access only to what their role requires.
7. Security
GBNOX maintains the technical and organisational measures described on the Security page, which forms Annex II of this DPA. These include encryption in transit and at rest, AES-256-GCM encryption of marketplace credentials, bcrypt password hashing, role-based access control, rate limiting and audited change control.
8. Sub-processors
The Controller gives general authorisation for GBNOX to engage the sub-processors listed on the sub-processors page. GBNOX will give at least 30 days’ notice before adding or replacing one. The Controller may object on reasonable data-protection grounds within that period; if the parties cannot agree an alternative, the Controller may terminate and receive a refund of the unused prepaid period.
GBNOX imposes data-protection terms on each sub-processor that are no less protective than this DPA, and remains liable for their performance.
9. Deletion and return
- The Controller may export workspace data from the dashboard at any time.
- On termination, data remains available for export for 30 days, after which GBNOX deletes it.
- Marketplace credentials are deleted immediately on disconnection or account closure.
- Backups age out on the provider’s cycle; data in a backup stays protected by this DPA until it does.
- GBNOX may keep data where the law requires — chiefly billing records for tax purposes.
- GBNOX will confirm deletion in writing on request.
10. Assisting the Controller
GBNOX will provide reasonable assistance with:
- Data subject requests — most are answerable from the dashboard. Where they are not, GBNOX will help. If a request reaches GBNOX directly, it will pass it to the Controller rather than answer it, unless the law says otherwise.
- Data protection impact assessments and prior consultation with a regulator, taking into account the information available to GBNOX.
- Personal data breaches — notification without undue delay after becoming aware, with the nature of the breach, the categories and approximate number of records affected, likely consequences, and the measures taken.
11. International transfers
Personal data is processed in the United States. Where data moves from the UK or EEA, the transfer relies on the European Commission’s Standard Contractual Clauses (Module Two, controller to processor), which are incorporated into this DPA by reference, together with the UK International Data Transfer Addendum where UK data is involved.
For those Clauses: the Controller is the data exporter and GBNOX the data importer; the optional docking clause applies; the governing law and forum are those in the Terms of Service to the extent the Clauses permit; Annex I is completed by sections 1 to 4 of this DPA, Annex II by the Security page, and Annex III by the sub-processors page.
12. Audit
GBNOX will make available the information reasonably necessary to demonstrate compliance with this DPA, and will respond to a reasonable security questionnaire no more than once a year. Where that is not enough for a supervisory authority, the parties will agree the scope of an audit that does not compromise other customers’ confidentiality or security.
13. Liability
Liability under this DPA is subject to the limitations in the Terms of Service, except where Data Protection Laws forbid limiting it.
14. Order of precedence
If this DPA conflicts with the Terms of Service on the processing of personal data, this DPA governs. If it conflicts with the Standard Contractual Clauses, the Clauses govern.
Questions about this document
Write to us through the contact form and say which document you are asking about. A person reads every message. Our postal address is 5005 W Laurel St, Tampa, FL 33607, United States.