Data Processing Agreement

Published Winch legal document. This version is the current Data Processing Agreement for the Winch Legal / Trust platform.

This Data Processing Agreement describes how Winch processes personal data on behalf of business customers when providing the service.

Roles

The customer is generally the controller or business responsible for determining the purposes and means of processing customer personal data. Winch generally acts as a processor or service provider when it processes that data to provide the service.

Processing instructions

Winch processes customer personal data according to the customer's documented instructions, the applicable agreement, and the configuration selected by the customer in the service.

Categories of data

Customer personal data may include account data, buyer contact details, buyer conversation content, order and document metadata, product and catalog context, support communications, and technical logs.

Security

Winch maintains technical and organizational measures designed to protect customer personal data against unauthorized access, loss, misuse, alteration, or disclosure.

Subprocessors

Winch may use subprocessors to provide infrastructure, hosting, authentication, payments, AI processing, email, monitoring, and other service functions. The current list is maintained in the Subprocessors document.

Data subject requests

Winch will provide reasonable assistance for data subject requests where required and where the customer cannot fulfill the request directly through the service.

Deletion and return

Upon termination or written request, Winch will delete or return customer personal data according to the applicable agreement, product capabilities, legal obligations, and backup retention practices.

Audits

Winch will provide reasonable information necessary to demonstrate compliance with this DPA, subject to confidentiality, security, and operational limitations.