Data Processing Agreement

For your pharmacy’s customer, order and clienteling data, you are the controller and Farmacy OS is the processor. Where we determine purposes for our own account, billing, security or platform-improvement data, we act as an independent controller under our Privacy Policy.

• Data subjects: your pharmacy's customers, and your staff users.
• Data categories: contact details, purchase history, consent state, follow-up and routine context, and communications.
• Special category: health-adjacent data may be implied — minimised, and processed only under an appropriate Article 9 condition.

• We process customer personal data only on your documented instructions, including for transfers.
• We tell you if an instruction appears to infringe data-protection law.
• People authorised to process the data are bound by confidentiality.

• EU (Ireland) hosting on managed Postgres; AES-256 at rest, TLS 1.3 in transit.
• Per-tenant isolation enforced in application code and backstopped by Postgres Row-Level Security.
• Envelope encryption with KMS-held keys for the most sensitive fields.
• Least-privilege access, per-tenant audit logs, and time-boxed, reason-logged support access.
• Testing, dependency scanning, and a documented incident-response process.

You give general authorisation for us to engage sub-processors. We keep a current list, bind each to data-protection terms no less protective than this DPA, and notify you before adding one — so you can object within the window the DPA sets.

Taking account of the nature of processing, we assist you — with appropriate technical and organisational measures, including per-tenant export and deletion tooling — to respond to data-subject requests to access, rectify, erase, restrict, port, or object.

We notify you without undue delay after becoming aware of a personal-data breach affecting your data, with the information you need to meet your own notification obligations, and we assist with your DPIAs and prior-consultation duties where relevant.

EU customer data stays in the EU by default. Any transfer outside the EU relies on EU Standard Contractual Clauses plus a transfer impact assessment and supplementary measures such as encryption and, where offered, zero-data-retention routing for AI inference.

We make available the information needed to demonstrate compliance with Article 28 and allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate — on reasonable notice and subject to confidentiality.

On termination, at your choice, we return or delete the customer personal data and delete existing copies, unless law requires storage. You keep export tooling throughout — no hostage-taking.

Ask for the executable DPA at farmacie@farmacy-growth.com. It’s signed alongside your order form before we process any customer data.