Data Processing Agreement

This Data Processing Agreement (the "DPA") is part of the Terms of Service between you (the "Seller") and PowerList TCG LLC ("PowerList TCG", "we", "us"). It applies when PowerList TCG handles personal information about your buyers on your behalf and that information is protected by the UK GDPR, the EU General Data Protection Regulation or the Swiss Federal Act on Data Protection (together, "Data Protection Law"). You accept it by using the Service; you do not need to sign it. If you would like a copy signed by us, email [email protected]. Where this DPA and the Terms disagree about personal information, this DPA wins.

Definitions

"Controller", "processor", "personal data", "processing", "data subject", "personal data breach" and "supervisory authority" have the meanings given in Data Protection Law. "Buyer Data" means the personal data about your buyers that the Service receives from the marketplaces and stores you connect, described in Annex 1.

Roles And Instructions

You are the controller of Buyer Data and PowerList TCG is your processor. We process Buyer Data only on your documented instructions. Your instructions are the Terms, this DPA, and the way you set up and use the Service (for example, connecting a marketplace, syncing orders or printing pull sheets). We will tell you if we believe an instruction breaks Data Protection Law, unless the law forbids us from telling you. You are responsible for having a lawful basis to give us Buyer Data, for the instructions you give, and for following the rules of the marketplaces and stores you connect.

We use Buyer Data only to provide the Service to you. In particular:

• Buyer messages are sent only if you turn them on, only to a buyer about their own order, only through the marketplace or store the order came from, and only with the wording you set.
• We never use Buyer Data for our own marketing, never contact your buyers on our own behalf, and never sell or share it.
• We never use Buyer Data to identify cards, to train any model, or for analytics or research of our own.

Personal information about you as our customer (your account, billing and usage) is not Buyer Data. For that information PowerList TCG is the controller, as our Privacy Policy explains.

Confidentiality

Everyone at PowerList TCG who can access Buyer Data is bound to keep it confidential and accesses it only to provide, support or secure the Service for you.

Security

We keep the technical and organisational measures in Annex 2 in place to protect Buyer Data, taking into account the state of the art, the cost of implementation and the risk to your buyers. We may improve these measures over time, but we will not reduce the overall level of protection.

Sub-processors

You give us general authorisation to use the sub-processors listed in Annex 3. We will tell you by email at least 30 days before we add or replace a sub-processor that handles Buyer Data, and update this page. If you object on reasonable data protection grounds, tell us within those 30 days; if we cannot address your objection, you may close your account before the change takes effect. Each sub-processor is bound by a written contract with data protection obligations no less protective than this DPA, and we remain responsible to you for its performance.

Helping You Meet Your Obligations

• Requests from your buyers. If a buyer contacts us about their personal data, we will pass the request to you without undue delay and will not answer it ourselves unless you ask us to. We will help you respond with the tools in the Service or, where those are not enough, by reasonable assistance on request.
• Assessments. We will give you the information you reasonably need for a data protection impact assessment or a prior consultation with a supervisory authority about the Service.
• Personal data breaches. If we become aware of a personal data breach affecting Buyer Data, we will notify you without undue delay, and we aim to do so within 48 hours. We will tell you what we know about the breach, its likely consequences and what we are doing about it, and keep you updated as we learn more.

Deletion At The End Of The Service

When you delete your account, we delete Buyer Data from our systems, as described in the Privacy Policy. Copies in our encrypted backups are overwritten on a rolling basis and are gone within 30 days. We do not keep Buyer Data after that, unless the law requires us to. Your own copies of your orders stay in your marketplace and store accounts, which we do not touch.

Information And Audits

We will make available the information reasonably necessary to show that we meet this DPA, normally by answering your written questions within 30 days. If a supervisory authority requires an audit, or our answers do not reasonably show compliance, you may audit us on 30 days' written notice, no more than once in any 12 months, during business hours, at your own cost, and in a way that protects the confidentiality of other customers' data. None of these limits applies where Data Protection Law or the SCCs require more, or to an audit a supervisory authority carries out itself.

Transfers Outside The UK And EEA

PowerList TCG and its sub-processors are in the United States, so using the Service transfers Buyer Data there. To protect those transfers:

• From the EEA: the Standard Contractual Clauses adopted by the European Commission in Decision (EU) 2021/914 (the "SCCs"), Module Two (controller to processor), are incorporated into this DPA, with you as data exporter and PowerList TCG as data importer. Clause 7 (docking) does not apply; under Clause 9, Option 2 (general written authorisation) applies with the 30-day notice in Sub-processors; the optional wording in Clause 11 does not apply; for Clauses 17 and 18 the governing law and courts are those of Ireland; and Annexes I to III of the SCCs are completed by Annexes 1 to 3 below. The supervisory authority under Clause 13 is the one for your establishment, or for your EU representative if you have one.
• From the UK: the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (version B1.0) issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018 (the "UK Addendum") is incorporated into this DPA. Table 1: the parties are you (exporter) and PowerList TCG LLC (importer), with the contact details on your account and below. Table 2: the SCCs as incorporated above, Module Two. Table 3: Annexes 1 to 3 below. Table 4: neither party may end the UK Addendum under its Section 19. The Mandatory Clauses of the UK Addendum apply.
• From Switzerland: the SCCs apply as above, with references to the GDPR read as references to the Swiss Federal Act on Data Protection where that law applies, and the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority.

Your acceptance of the Terms is treated as both parties' signature of the SCCs and the UK Addendum, including their annexes, dated the day you accepted the Terms or 15 October 2026, whichever is later. If the SCCs or the UK Addendum are replaced or updated, the new version applies from the date the law requires it.

Liability And Term

Each party's liability under this DPA is subject to the limitations in the Terms, except where Data Protection Law or the SCCs do not allow liability to be limited. This DPA lasts for as long as PowerList TCG processes Buyer Data for you.

Annex 1: Details Of The Processing

This annex is Annex I of the SCCs and completes Table 3 of the UK Addendum.

A. The parties

B. The transfer

C. Competent supervisory authority

The supervisory authority for the Seller's establishment in the EEA, or for its EU representative if it has one. For transfers under the UK Addendum, the UK Information Commissioner. For transfers from Switzerland, the Swiss Federal Data Protection and Information Commissioner.

Annex 2: Security Measures

• Data is encrypted in transit, and account credentials and marketplace connections are encrypted or hashed when stored.
• Access to systems holding Buyer Data is limited to authorised staff, protected by strong authentication, and reviewed regularly.
• Each Seller's data is kept separate from every other Seller's.
• Backups are encrypted, kept for a limited time, and restorable.
• Access to Buyer Data is logged and monitored, and we maintain an incident response procedure.
• Buyer Data is used only to provide the Service to the Seller.

Annex 3: Sub-processors

Our other service providers do not receive Buyer Data.

Contact Us