Download Lesuto Hub & Seller - Shop and sell on iOS and Android
Download Lesuto Hub & Seller - Shop and sell on iOS and Android
Last Updated: October 15, 2026 | Version: 3.2
Effective Date: October 9, 2026
Last Updated: October 15, 2026
Version: 3.2
This Data Processing Agreement ("DPA") supplements the Platform Operator Agreement, Merchant Agreement, Marketplace Supplier Agreement, or Managed Supplier Wholesale and Dropship Agreement (the "Principal Agreement") between Lesuto Technologies, Inc., a Texas corporation, with its principal office at 600 Congress Ave, STE 1400, Austin, TX 78701 ("Lesuto"), and the business that accepts or signs the Principal Agreement ("you").
"Controller," "processor," "personal data," "data subject," "processing," "personal data breach," and "supervisory authority" have the meanings given in the GDPR. "Business," "service provider," "sell," and "share" have the meanings given in the CCPA. "Data Protection Law" means all privacy and data protection laws that apply to the processing, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the GDPR as retained in UK law and the UK Data Protection Act 2018 ("UK GDPR"), the Swiss Federal Act on Data Protection ("FADP"), the California Consumer Privacy Act as amended ("CCPA"), the Texas Data Privacy and Security Act ("TDPSA"), and other U.S. state privacy laws. "Business Personal Data" means personal data that you provide to the Platform and that Lesuto processes on your behalf, as described in Annex I. "SCCs" means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914.
When Lesuto processes Business Personal Data as your processor, Lesuto will:
(a) process it only on your documented instructions, which are the Principal Agreement, this DPA, and your configuration and use of the Platform, unless the law requires otherwise, in which case Lesuto will tell you before processing unless the law prohibits it;
(b) tell you promptly if, in its opinion, an instruction infringes Data Protection Law;
(c) ensure that personnel authorized to process it are bound by confidentiality;
(d) implement the technical and organizational measures in Annex II;
(e) engage sub-processors only as described in Section 5;
(f) taking into account the nature of the processing, assist you by appropriate measures in responding to data subject requests, and forward to you without undue delay any request it receives that concerns Business Personal Data;
(g) assist you with security, personal data breach notification, data protection impact assessments, and prior consultation, taking into account the information available to Lesuto;
(h) delete or return Business Personal Data as described in Section 9; and
(i) make available the information reasonably necessary to demonstrate compliance with this section and allow audits as described in Section 10.
Where Lesuto processes Business Personal Data as your service provider or processor under the CCPA, the TDPSA, or another U.S. state privacy law, Lesuto: (a) processes it only for the limited and specified business purposes of providing the Platform, security, debugging, and the other purposes the Principal Agreement describes; (b) does not sell or share it; (c) does not retain, use, or disclose it outside the direct business relationship with you or for any purpose other than those business purposes, except as the law permits; (d) does not combine it with personal data Lesuto receives from others, except as the law permits; (e) complies with the applicable law and provides the same level of privacy protection the law requires of you; (f) will notify you if it can no longer meet its obligations; and (g) allows you to take reasonable steps to stop and remediate unauthorized use. Lesuto certifies that it understands and will comply with these restrictions.
You give Lesuto general authorization to engage the sub-processors listed in Annex III. Lesuto will give you at least 30 days' notice, by updating the published list and through the Platform or by email, before a new sub-processor begins processing Business Personal Data. You may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, you may terminate the affected services and receive a refund of prepaid fees for them. Lesuto imposes data protection obligations on each sub-processor that are no less protective than this DPA, and remains responsible to you for each sub-processor's performance of those obligations.
Lesuto maintains the security measures in Annex II. Lesuto will notify affected controllers of a personal-data breach without undue delay and in any event within 72 hours of becoming aware of it. The notice will describe, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed, and Lesuto will provide further information as it becomes available. Notice of a breach is not an admission of fault.
Lesuto does not claim SOC 2, ISO 27001, cyber insurance, or a completed PCI DSS self-assessment.
The Platform is hosted in Google Cloud us-west1 (Oregon, United States). Where you transfer Business Personal Data subject to the GDPR to Lesuto in the United States, the SCCs are incorporated into this DPA as follows:
If the SCCs conflict with this DPA, the SCCs control. Lesuto applies the supplementary measures in Annex II, and will tell you if it receives a government request for Business Personal Data, unless the law prohibits it, and will challenge requests it reasonably considers unlawful.
Requests about Customer data, for which Lesuto is controller, should be sent to Lesuto at privacy@lesuto.com or eu-privacy@lesuto.com. If you receive one, you will forward it to Lesuto without undue delay.
Before the Principal Agreement ends, you may export Business Personal Data using the Platform's export tools or by request to privacy@lesuto.com. Within 90 days after Lesuto receives your written request following termination, Lesuto will delete or return it, except copies the law requires Lesuto to keep (including financial records kept for 7 years) and copies in backups, which are deleted on the normal backup cycle. Retained data stays protected under this DPA. Customer data remains with Lesuto as controller.
On written request, no more than once per 12 months, Lesuto will provide a written description of the measures in Annex II and complete a reasonable security questionnaire. If that information is not enough to demonstrate compliance, or if a supervisory authority requires it, or after a personal data breach affecting your data, you may conduct an audit, on at least 30 days' notice, during business hours, by an independent auditor bound by confidentiality, without access to other customers' data, and at your expense unless the audit reveals a material breach of this DPA. This section is how the parties will meet the audit requirements of Clause 8.9 of the SCCs.
Each party's liability arising out of this DPA is subject to the limitations in the Principal Agreement, including the amounts-owed carve-out and the data-breach super-cap (the greater of 2 times the fees or margin from the prior 12 months, or twenty-five thousand dollars ($25,000)). Nothing in this DPA limits either party's liability to data subjects under the SCCs or Data Protection Law where the law does not allow it to be limited.
Except as stated in Section 7 for the SCCs, this DPA is governed by the laws of the State of Texas, United States, without regard to its conflict of laws principles, and disputes are resolved in the state or federal courts located in Travis County, Texas as provided in the Principal Agreement.
This DPA controls over the Principal Agreement for personal-data processing. The SCCs control over this DPA. An Executed Agreement that expressly modifies data processing terms controls over this DPA, but never over the SCCs.
| Item | Detail |
|---|---|
| Parties | Data exporter: you (contact details in the Principal Agreement or Order Form). Data importer: Lesuto, legal@lesuto.com. |
| Subject matter | Hosting and operation of the Lesuto Platform |
| Duration | Term of the Principal Agreement, plus the return and deletion period in Section 9 |
| Frequency | Continuous |
| Nature | Collection, storage, organization, retrieval, transmission, display, and deletion |
| Purpose | Providing the Platform, support, security, and legal compliance |
| Data subjects | Your personnel and contacts; individuals who appear in content you upload |
| Categories of Business Personal Data | Name, business contact details, user identifiers, role and permissions, activity logs, and personal data contained in content you upload |
| Special category data | Not intended. You will not upload special category data unless the Principal Agreement allows it. |
| Sub-processor transfers | As listed in Annex III, for the purposes stated there |
| Customer data (Lesuto as controller, for information) | Identity, contact, shipping, payment metadata (never full card numbers), order history, Hub activity |
Questions: privacy@lesuto.com
EEA and UK: eu-privacy@lesuto.com
Read this before you click. This document is executed electronically. No paper counterpart and no handwritten signature will be collected.
By clicking "I Agree" (or any equivalently labelled control) in the Lesuto Command Center, Lesuto Hub, or Lesuto Seller, you, [Accepting User], acting under channel [Channel Code] on [Acceptance Date]:
(a) acknowledge that this document, version [Document Version], was made available to you in full before you accepted, and that you were able to read, print, download, and take independent legal advice on it;
(b) agree to be bound by this document on behalf of [Company Name], and represent and warrant that you are authorised to bind that entity;
(c) consent to transact business with Lesuto by electronic means and to receive contracts, notices, and disclosures electronically rather than on paper; and
(d) adopt the click as your signature.
Legal effect. The parties intend this electronic acceptance to be a signed writing. Under the United States Electronic Signatures in Global and National Commerce Act (15 U.S.C. sections 7001 to 7031, the "ESIGN Act") and the Uniform Electronic Transactions Act ("UETA") as enacted in Texas (Texas Business and Commerce Code chapter 322), an electronic signature and an electronic record have the same legal force and effect as a handwritten signature on paper. Neither party will contest the validity, admissibility, or enforceability of this document, or of the acceptance record described in Appendix B, on the ground that it was accepted electronically, that it bears no handwritten signature, or that it is not an original writing.
Hardware and software you need. To view and retain this document you need a current web browser or the Lesuto mobile app, an internet connection, an active Lesuto account, and the ability to print or store a PDF or HTML file. If you cannot meet these requirements, do not click "I Agree"; write to legal@lesuto.com instead.
Withdrawing consent. You may withdraw your consent to transact electronically by writing to legal@lesuto.com. Withdrawal operates prospectively only. It does not unwind this acceptance, and it does not discharge any obligation that has already accrued. Because Lesuto operates no paper contracting channel, withdrawing consent may require Lesuto to suspend the access or services this document governs.
Retrieving what you accepted. The version you accepted, and the date you accepted it, remain available to you at any time from Legal and Compliance in the dashboard. You may also request a copy from legal@lesuto.com at no charge.
Later versions. Lesuto may publish a new version of this document. When the version string changes, the dashboard marks this document as requiring re-acceptance and tells you which version you previously accepted. A later version does not retroactively displace the version you accepted; your earlier acceptance stays on record exactly as made.
This appendix describes how Lesuto records and proves your acceptance. It is a statement of Lesuto's logging practice and part of the record of this document. It grants no rights and creates no obligation beyond the body of this document.
Document code. data-processing-agreement
What is captured when you click. Accepting this document writes a row to the Lesuto agreement acceptance ledger containing:
| Field | Recorded value |
|---|---|
| Document code | The stable identifier of this document |
| Document version | The exact version string presented to you and accepted |
| Content fingerprint | The SHA-256 hash of the exact document text you accepted |
| User identity | Your authenticated Lesuto user ID |
| Acting entity | The channel code, and where applicable the tenant or customer record, the acceptance was made under |
| Timestamp | Server-side date and time of the click |
| IP address | Originating client IP, read from the gateway forwarding header |
| Device and client | The user agent string presented by your browser or app |
Captured server-side. The timestamp, IP address, and user agent are recorded by Lesuto's servers from the request that carried your acceptance. They are not read from form input, so the accepting party cannot alter them.
Where the record lives. The current acceptance is held in the agreement_acceptance ledger, one row per user per document. Before any row is overwritten by a re-acceptance, the superseding write copies the prior row, including its version, timestamp, IP address, and user agent, into the append-only agreement_acceptance_history table. The history table is never updated or deleted in the ordinary course, so the full chain of every version you accepted survives.
Erasure requests. If you exercise a right of erasure, Lesuto removes the IP address and user agent from these records but retains the document code, version, user identity, and timestamp. Those four fields are the evidence that a binding agreement was formed, and Lesuto retains them on the basis of its legitimate interest in establishing and defending legal claims, and where applicable to comply with a legal obligation.
Version integrity. The version string in the ledger is copied from the document that was rendered to you, not supplied by the client. If Lesuto publishes new text, it publishes it under a new version string, so a stored acceptance always points at the wording that was actually on screen.
Producing the record. To obtain a certified copy of your acceptance record, including the document text as it stood at the version you accepted, write to legal@lesuto.com.
