Legal / GDPR notice

GDPR notice

Last revised

Draft — not yet reviewed by counsel

This document describes how Tenza actually behaves and is published so you can read it before you commit to anything. It has not been reviewed by a qualified lawyer, so it is not a final contractual instrument and should not be relied on as legal advice. If you need an executed, countersigned version — or you are evaluating Tenza against a procurement or compliance requirement — ask support and we will get the reviewed text to you.

This notice explains how Tenza supports your obligations, and ours, under the EU General Data Protection Regulation and the UK GDPR. It sits alongside the privacy policy and the data processing addendum.

Which of us is the controller

  • For data about you and your team — your account, your billing, your admin activity — Tenza is the controller.
  • For data about your storefront customers, you are the controller and Tenza is your processor. The DPA governs that processing.

Lawful bases we rely on

  • Contract — operating your workspace, billing you, and providing support.
  • Legitimate interests — securing the platform, preventing abuse, and diagnosing failures. We balance these against your rights and keep the processing to what the purpose needs.
  • Legal obligation — retaining financial records.
  • Consent — optional product mail, which you can withdraw at any time without affecting the service.

Data subject rights

Where Tenza is the controller you may request access, rectification, erasure, restriction, portability, or object to processing based on legitimate interests. Most of this is self-serve in Settings; for the rest, ask support. We respond within one month and will tell you if we need to extend that, and why.

Where you are the controller and one of your customers exercises a right, you action it in your admin. Tenza will assist where the platform does not already give you the tool — including locating every record for one data subject across the workspace.

International transfers

Transfers out of the UK and EEA rely on adequacy where it exists, and otherwise on standard contractual clauses with a transfer risk assessment and appropriate supplementary measures.

Breach notification

We notify you without undue delay, and in any event within 72 hours of becoming aware, of a personal-data breach affecting data we process for you. The notice states what happened, which categories of data and roughly how many records are affected, what we have done, and what we recommend you do.

Records and assessments

We maintain records of processing activities and will provide the information you need for your own records or a data protection impact assessment. Ask support and mark the ticket as a legal request.

Supervisory authority

You may complain to your local supervisory authority at any time. We would rather you raised it with us first so we can fix it, but that is your choice and not a precondition.

Contact

Anything in this document that is unclear, or that you need in a different form, goes to support. Mark the ticket as a legal request.