Version 1.0 · Effective date: 31 October 2026
This Data Processing Agreement (“DPA”) forms part of the agreement between Rishvi Ltd (“Rishvi”, “we”, “us”), a company registered in England and Wales, company number 08347225, of Suite 1, 1st Floor, 730 Romford Road, London, Greater London, England, E12 6BT, United Kingdom, and the client identified in the applicable proposal, quotation, statement of work, order form, subscription or agreement (“Client”). It applies whenever Rishvi processes personal data on the Client’s behalf in providing services (“Services”) under any Rishvi brand, including services delivered under our Standard Commercial Terms and Conditions.
At a glance
- Roles: the Client is the controller of its data; Rishvi is its processor and acts only on the Client’s documented instructions.
- Brands covered: Rishvi, Linnworks Custom, HyperStock (including the Hyperstock and Hyperlook apps) and UK eInvoice.
- Security: Rishvi operates an ISO/IEC 27001:2022 certified information security management system.
- No AI training: Client Personal Data is never used to train general-purpose AI models without the Client’s written agreement.
- Breaches: Rishvi notifies the Client without undue delay.
- End of Services: data is returned or deleted at the Client’s choice.
1. Definitions
“Client Personal Data” means personal data that Rishvi processes on the Client’s behalf in providing the Services. “Data Protection Law” means the UK GDPR, the Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025), the Privacy and Electronic Communications Regulations 2003 and, where it applies, the EU GDPR. “Sub-processor” means a third party engaged by Rishvi to process Client Personal Data. Terms such as “controller”, “processor”, “data subject”, “personal data breach” and “processing” have the meanings given in Data Protection Law.
2. Scope and brands
This DPA applies to all Services provided by Rishvi, whether under the Rishvi name or one of its brands:
- Rishvi (rishvi.co.uk) – Linnworks and Odoo consultancy, development, integrations, hosting and support;
- Linnworks Custom (linnworkscustom.com) – Linnworks macros, scripts, apps and customisations;
- HyperStock (hyperstock.app) – the Hyperstock and Hyperlook mobile apps for Linnworks and related AI features; and
- UK eInvoice (ukeinvoice.co.uk) – electronic invoicing and related services.
This DPA does not apply to personal data Rishvi processes as a controller, such as website visitors, enquiries, client contacts, billing and marketing. That processing is described in our Privacy Policy.
3. Roles of the parties
The Client is the controller of Client Personal Data and Rishvi is its processor. Where the Client is itself a processor for another controller, Rishvi acts as its sub-processor, and the Client confirms that it has the authority to appoint Rishvi and that its instructions are consistent with those of the controller.
4. Client instructions
Rishvi will process Client Personal Data only on the Client’s documented instructions, including those in the agreement, the agreed scope, support requests, configuration choices made in our products and this DPA, unless the law requires otherwise. If so, Rishvi will tell the Client before processing unless the law prohibits this. Rishvi will tell the Client promptly if it believes an instruction breaks Data Protection Law, and may suspend the affected processing until the instruction is confirmed or changed. Additional instructions outside the agreed scope may be charged as a change request.
5. Details of processing
The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Schedule 1. Processing lasts for the duration of the Services plus any agreed return or deletion period.
6. Confidentiality
Rishvi will ensure that its staff and contractors who process Client Personal Data are bound by written confidentiality obligations or a statutory duty of confidentiality, have received appropriate data protection training, and access Client Personal Data only as needed to provide the Services.
7. Security
Rishvi will implement and maintain appropriate technical and organisational measures to protect Client Personal Data, taking into account the state of the art, the cost of implementation, the nature, scope, context and purposes of the processing, and the risk to individuals. Current measures are described in Schedule 2. Rishvi may update these measures provided the overall level of protection is not reduced.
8. Access to Client systems and credentials
Where the Client gives Rishvi access to Linnworks, Odoo, marketplaces, carriers, ERP, accounting, e-invoicing or other systems, Rishvi will:
- use that access only for the agreed work, a reported issue or support the Client has requested;
- apply least-privilege access where practical and limit access to the people working on the task;
- handle credentials, tokens and API keys through secure mechanisms and never enter them into AI tools;
- use test data or limited samples where practical, and agree with the Client before working on live data where that is needed; and
- revoke or delete credentials and tokens when the work or connection ends.
The Client must share credentials only through the secure method agreed with Rishvi, not by ordinary email, chat or WhatsApp.
9. Sub-processors
The Client gives general written authorisation for Rishvi to use sub-processors to provide the Services, including hosting and cloud, database, email, monitoring, backup, support, communication, payment and AI providers. The current categories of sub-processors are described in our Privacy Policy, and a full list is available on request from info@rishvi.co.uk.
Rishvi will impose data protection obligations on each sub-processor by written contract that are no less protective than this DPA, and remains responsible to the Client for their performance. Where the agreement requires it, Rishvi will give advance notice of new or replacement sub-processors. The Client may object on reasonable data protection grounds within 14 days of notice; the parties will then discuss the objection in good faith, and if it cannot be resolved the Client may end the affected Services without penalty.
10. Artificial intelligence
Where the Services include AI features, such as HyperStock AI, or Rishvi uses approved AI tools to deliver the Services, the Client authorises Rishvi to use approved AI providers as sub-processors for that purpose. Rishvi will send them only the information reasonably needed, use business or API arrangements, and choose restricted-retention settings where available. Rishvi will not use Client Personal Data to train its own or third-party general-purpose AI models unless the Client agrees in writing. AI output is reviewed before it is relied on for the Services.
11. Marketplace data
Where Client Personal Data comes from marketplaces such as Amazon or eBay, Rishvi will handle it in line with the relevant marketplace’s data protection requirements and use it only to provide the Services. Amazon order information containing personal data will be kept for no longer than 30 days after shipment, or any shorter period Amazon requires.
12. International transfers
Rishvi will not transfer Client Personal Data outside the UK, or allow a sub-processor to do so, unless a lawful transfer mechanism applies, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another mechanism permitted by Data Protection Law. Clients with specific data-location requirements must agree them in writing.
13. Data subject rights
Taking into account the nature of the processing, Rishvi will give the Client reasonable help, by appropriate technical and organisational measures, to respond to requests from individuals exercising their rights. If Rishvi receives a request directly, it will pass it to the Client without undue delay and will not respond itself unless the Client authorises it.
14. Assistance
Rishvi will give the Client reasonable help with its obligations on security, personal data breaches, data protection impact assessments and prior consultation with the regulator, taking into account the nature of the processing and the information available to Rishvi. Rishvi may charge reasonable costs for assistance that goes beyond what is normally included in the Services, except where the need arises from Rishvi’s own breach.
15. Personal data breaches
Rishvi will notify the Client without undue delay after becoming aware of a personal data breach affecting Client Personal Data. The notice will include, as far as the information is available, the nature of the breach, the categories and approximate number of individuals and records concerned, the likely consequences, and the measures taken or proposed. Rishvi will update the Client as more becomes known, take reasonable steps to contain the breach and limit its effects, and co-operate with the Client’s investigation. Notifying the regulator and affected individuals is the Client’s responsibility as controller, unless agreed otherwise.
16. Records of processing
Rishvi will keep records of its processing activities carried out on behalf of the Client as required by Data Protection Law and make them available to the Client or the regulator on request.
17. Return and deletion
When the Services end, Rishvi will, at the Client’s choice, return or delete Client Personal Data within a reasonable period, unless the law requires Rishvi to keep it. If the Client does not make a choice within 30 days of the end of the Services, Rishvi may delete the data. Data in backups will be deleted or overwritten in line with Rishvi’s backup cycle and will not be used for any other purpose in the meantime. Rishvi will delete working copies made for testing, troubleshooting or migration when they are no longer needed.
18. Audits and information
Rishvi will make available the information reasonably needed to demonstrate compliance with this DPA and Article 28 UK GDPR, such as security documentation, policies and ISO certification details. Where that is not enough, the Client, or an independent auditor bound by confidentiality, may carry out an audit on at least 30 days’ written notice, during normal business hours, at the Client’s own cost, no more than once in any 12-month period unless a personal data breach has occurred or a regulator requires it. Audits must respect confidentiality, protect other clients’ data and avoid unreasonable disruption.
19. Client responsibilities
The Client is responsible for: having a lawful basis for the processing; giving the required privacy information to individuals; ensuring its instructions are lawful; managing its users, permissions and access, including removing access when people leave; ensuring connected systems are authorised; protecting its own credentials and devices; meeting marketplace data requirements; and not sending Rishvi unnecessary special-category or criminal-offence data.
20. Liability
Each party’s liability under or in connection with this DPA is subject to the limitations and exclusions of liability in the main agreement, except where Data Protection Law does not allow liability to be limited.
21. Term and precedence
This DPA takes effect when the main agreement starts, or when Rishvi first processes Client Personal Data if earlier, and continues for as long as Rishvi processes Client Personal Data. If this DPA conflicts with the main agreement on the processing of Client Personal Data, this DPA prevails. If the parties have signed a separate data processing agreement, that signed agreement prevails over this DPA.
22. Changes to this DPA
Rishvi may update this DPA to reflect changes in Data Protection Law, regulator guidance or the Services. We will give clients at least 30 days’ notice of material changes. Changes will not reduce the overall level of protection for Client Personal Data. The version and effective date are shown at the top.
23. Governing law
This DPA is governed by the law that governs the main agreement. If the main agreement does not state one, the laws of England and Wales apply and the courts of England and Wales have exclusive jurisdiction.
Schedule 1 – Details of processing
| Item | Description |
| Subject matter | Provision of the contracted Rishvi Services, including Linnworks consultancy, development, macros, scripts and support (Rishvi and Linnworks Custom), integrations, Odoo services, hosting, the Hyperstock and Hyperlook apps and HyperStock AI (HyperStock), and e-invoicing (UK eInvoice) |
| Duration | Duration of the agreement plus any agreed return or deletion period |
| Nature and purpose | Accessing, retrieving, storing, transforming, transmitting, displaying, backing up and deleting data as needed to deliver, support, host and secure the Services |
| Types of personal data | Names, contact details, delivery and billing addresses, order and transaction details, customer and supplier records, invoice and e-invoice details, stock and audit records linked to users, user account details, support communications and AI prompts relating to the Client’s operations |
| Data subjects | The Client’s staff and authorised users, customers, suppliers, contractors, delivery recipients and business contacts |
| Special-category data | Not intended to be processed. The Client must not send it unless agreed in writing. |
| Frequency | Continuous for hosted services and apps; as needed for project and support work |
Schedule 2 – Security measures
- ISO/IEC 27001:2022 certified information security management system
- Role-based and least-privilege access to systems and data, with access reviews
- Multi-factor authentication for administrative access where supported
- Secure API authentication, token storage and secret management
- Encryption of data in transit (HTTPS/TLS)
- Separation of production and test environments
- Logging, monitoring and vulnerability management
- Regular backups and tested restore procedures
- Staff confidentiality obligations and security training
- Controlled software development, code review and deployment
- Supplier due diligence for sub-processors
- Incident response and breach management procedures
- Business continuity arrangements
- Secure deletion at the end of the retention period
Contact
Rishvi Ltd
Company number: 08347225
Suite 1, 1st Floor, 730 Romford Road, London, Greater London, England, E12 6BT, United Kingdom
Email: info@rishvi.co.uk
Phone: +44 20 8050 3432
Clients who need a signed copy of this DPA, or a DPA tailored to their requirements, can request one at info@rishvi.co.uk.
