GDPR Compliance and International Data Transfers

If you sell to customers in the UK or European Union, you may need to answer your own customers' or partners' questions about how the platforms you rely on handle personal data. This article explains how DecoNetwork stores and processes customer data, how DecoNetwork approaches international data transfers, how data reaches any third-party services connected to your store, and what data protection documentation is available, so you can respond to compliance questions with confidence.

In This Article

• Why This Matters
• Where Customer Data Is Stored and Processed
• International Data Transfers
• Third-Party Integrations and Sub-processors
• Data Processing Agreements and Documentation
• Best Practices
• FAQs
• Additional Resources

Why This Matters

Your own compliance obligations may require you to understand how the platforms and vendors you use, including DecoNetwork, store and move personal data. Knowing DecoNetwork's approach helps you respond to due-diligence questions from your customers, partners, or compliance reviewers, and helps you confirm what, if anything, you need to put in place on your side when you connect third-party services to your store.

Where Customer Data Is Stored and Processed

DecoNetwork's core application and customer data are hosted on infrastructure that DecoNetwork manages directly, located in the United States. A small number of supporting services, such as the vector design engine, run on additional US-based infrastructure. DecoNetwork does not let customers select a hosting region, since all accounts are served from the same US-based environment.

International Data Transfers

DecoNetwork does not routinely transfer customer personal data to third parties, so it has not adopted the EU Standard Contractual Clauses (SCCs), Binding Corporate Rules (BCRs), a UK International Data Transfer Agreement (IDTA), or the UK Addendum to the SCCs. DecoNetwork is an Australian company, and manages its data protection obligations under Australia's Privacy Act 1988 and the Australian Privacy Principles (APPs) rather than under an EU- or UK-specific international transfer mechanism.

Third-Party Integrations and Sub-processors

DecoNetwork does not share customer personal data with third parties by default. Data only reaches a third party when you choose to connect an optional integration or service to your store, for example a payment gateway, shipping carrier, or supplier purchase-ordering connection. Enabling one of these integrations is your decision, and how that connected provider handles data is governed by your agreement with that provider. DecoNetwork reviews its own integrations for GDPR compliance at the time each one is built.

Because the third parties that can access data depend entirely on which optional integrations you choose to enable, DecoNetwork does not publish a single consolidated list of sub-processors. To understand what data a specific integration shares, refer to that integration's own privacy documentation before enabling it.

Data Processing Agreements and Documentation

DecoNetwork does not currently offer a Data Processing Agreement (DPA) or UK IDTA. This article, together with the Server Security FAQs, reflects the full extent of the data protection documentation DecoNetwork is able to provide at this time.

Best Practices

• Review which optional integrations are enabled on your store, and only enable the ones you actively use, since each connected integration is a point where data may be shared with a third party.
• Read the privacy documentation of any third-party integration (payment gateway, shipping carrier, marketing tool) before connecting it to your store.
• Use DecoNetwork's built-in GDPR Data Consent Options to manage consent collection for your own customers.
• Keep a record of which integrations you've enabled and why, so you can answer your own customers' or partners' data-handling questions quickly if asked.

FAQs

Is DecoNetwork GDPR compliant?
Yes. DecoNetwork does not share customer personal data with third parties by default, and manages data protection under its own compliance framework as an Australian company.

Does DecoNetwork rely on an adequacy decision for any jurisdiction?
DecoNetwork does not routinely transfer personal data internationally, so it has not identified a specific adequacy decision it relies on for this purpose.

Has DecoNetwork carried out Transfer Risk Assessments (TRAs) or Data Protection Impact Assessments (DPIAs)?
DecoNetwork has not undertaken formal Transfer Risk or Data Protection Impact Assessments, since its data handling model does not route personal data through the kind of routine cross-border transfer these assessments are designed to evaluate.

Can DecoNetwork provide a list of named sub-processors?
Not as a single standing list, since this depends on which optional third-party integrations you choose to enable on your own store. See Third-Party Integrations and Sub-processors above.

Can DecoNetwork provide additional or customized compliance documentation on request?
No. This article and the Server Security FAQs represent the full extent of the data protection documentation DecoNetwork is able to provide.

Additional Resources

• Server Security FAQs
• GDPR Data Consent Options
• Cookie Consent Options