Data Processing Agreement (DPA)

1. Scope & Purpose

This Data Processing Agreement ("DPA") forms an integral part of the service contract between Last Minute T-Shirt Printing ("Data Processor") and commercial customers or organization clients ("Data Controller"). It applies to all processing of personal data conducted during the provision of custom clothing printing, artwork proofing, and merchandise fulfillment.

2. Subject Matter & Duration

The subject matter of processing includes contact information, customer logos, design files, garment size breakdowns, and delivery address details necessary to manufacture and dispatch custom printed apparel. Processing duration persists for the active contract term plus statutory tax/accounting retention periods.

3. Processor Obligations

The Data Processor agrees to:

• Process personal data strictly in accordance with documented instructions from the Data Controller.
• Ensure all personnel authorized to process customer data are bound by strict statutory confidentiality duties.
• Maintain appropriate technical and organizational security measures (including SHA-256 asset verification and encrypted storage).
• Notify the Data Controller without undue delay upon becoming aware of any confirmed personal data breach.
• Assist the Data Controller in fulfilling data subject access requests under UK GDPR.

4. Sub-processors & Third Parties

The Data Processor utilizes vetted sub-processors for essential service delivery, including UK commercial courier services (DPD, DHL, Royal Mail) and secure payment infrastructure. All sub-processors operate under equivalent data protection terms.

5. Data Deletion & Export

Upon termination of the service agreement or completion of custom garment fulfillment, the Data Processor shall, at the choice of the Data Controller, delete or return all customer personal data unless UK statutory law mandates continued retention.