Legal
Data Processing Addendum
This Data Processing Addendum (“DPA”) forms part of the Terms of Service between [OrderCtrl legal entity name] (“OrderCtrl”) and the Merchant, and applies when OrderCtrl processes Personal Data on the Merchant’s behalf. Capitalized terms not defined here have the meaning given in the Terms or, where applicable, in Data Protection Laws.
1. Definitions
- Data Protection Laws means laws that apply to the processing of Personal Data under the Terms, including the EU GDPR, UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and U.S. state privacy laws such as the California Consumer Privacy Act as amended (“CCPA”).
- Personal Data means information relating to an identified or identifiable person that OrderCtrl processes on behalf of the Merchant (“Store Data”).
- Subprocessor means a third party engaged by OrderCtrl to process Personal Data.
- Security Incident means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data.
2. Roles and instructions
- The Merchant is the controller (or business) and OrderCtrl is the processor (or service provider) of Personal Data.
- OrderCtrl will process Personal Data only on the Merchant’s documented instructions, which consist of the Terms, this DPA, and the Merchant’s configuration and use of the Service, unless required by law, in which case OrderCtrl will inform the Merchant unless legally prohibited.
- The Merchant is responsible for the lawfulness of its instructions and for providing any notices and obtaining any consents its customers require.
3. CCPA service provider terms
OrderCtrl will not sell or share Personal Data, retain, use or disclose it for any purpose other than providing the Service or outside the direct business relationship with the Merchant, or combine it with personal information from other sources except as permitted by the CCPA. OrderCtrl will notify the Merchant if it can no longer meet its obligations under the CCPA.
4. Confidentiality of personnel
OrderCtrl will ensure that people authorized to process Personal Data are bound by confidentiality obligations and access it only as needed to provide the Service.
5. Security
OrderCtrl will implement and maintain appropriate technical and organizational measures to protect Personal Data, as described in Annex 2. OrderCtrl may update these measures provided the overall level of protection is not reduced.
6. Subprocessors
The Merchant authorizes OrderCtrl to engage Subprocessors. OrderCtrl will impose data protection obligations on each Subprocessor that are no less protective than this DPA and remains responsible for their performance.
OrderCtrl will give at least [30] days’ notice of a new Subprocessor by updating this page and notifying account holders by email or in the app. The Merchant may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Merchant may terminate the affected part of the Service and receive a refund of prepaid fees for the unused period.
| Subprocessor | Purpose | Location |
|---|---|---|
| [Hosting and database provider] | Application hosting, databases, file storage and backups | [Region] |
| Stripe, Inc. | Subscription billing and payment processing for OrderCtrl plans | United States |
| Goshippo, Inc. (Shippo) | Shipment tracking, return labels and address validation | United States |
| EasyPost | Shipment tracking, return labels and address validation | United States |
| Emailit | Delivery of transactional emails, including sign-in codes and customer notifications | [Region] |
| PostHog, Inc. | Marketing website analytics and merchant app product analytics | United States |
| Anthropic, PBC | AI-assisted features: suggested replies, order summaries and email writing help | United States |
| Geoapify | Address validation (when enabled) | [Region] |
| LocationIQ | Address validation (when enabled) | [Region] |
Services the Merchant connects. When the Merchant connects services such as WooCommerce, payment providers (for example Stripe or Square accounts used for refunds), marketing tools (for example Klaviyo) or helpdesks (for example Gorgias, Zendesk or Help Scout), OrderCtrl shares Personal Data with them at the Merchant’s direction. Those providers act for the Merchant under their own terms and are not OrderCtrl Subprocessors. Shipping carriers receive tracking numbers as needed to report delivery status.
7. Data subject requests
Taking into account the nature of the processing, OrderCtrl will assist the Merchant by appropriate measures in responding to requests from individuals to exercise their rights. If OrderCtrl receives a request directly, it will forward it to the Merchant where it can identify the Merchant and will not respond except as instructed or required by law.
8. Security incidents
OrderCtrl will notify the Merchant without undue delay, and in any event within 72 hours, after becoming aware of a Security Incident affecting the Merchant’s Personal Data. The notice will describe, to the extent known, the nature of the incident, the categories and approximate number of individuals and records concerned, likely consequences, and the measures taken or proposed. OrderCtrl will take reasonable steps to contain and remediate the incident.
9. Assistance
OrderCtrl will provide reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities, to the extent required by Data Protection Laws and relating to the Service.
10. Return and deletion
On termination of the Service, OrderCtrl will, at the Merchant’s choice, make Personal Data available for export for [30] days and then delete or anonymize it, except where retention is required by law. Data in backups will be deleted as backups are overwritten in the normal course and will remain protected by this DPA until then.
11. Audits
OrderCtrl will make available information reasonably necessary to demonstrate compliance with this DPA, such as answers to security questionnaires and summaries of relevant policies. Where Data Protection Laws require it and that information is not sufficient, the Merchant may conduct an audit on at least 30 days’ notice, no more than once a year, during business hours, at its own cost, and subject to reasonable confidentiality and security requirements.
12. International transfers
Where Personal Data is transferred from the EEA, UK or Switzerland to a country without an adequacy decision, the parties agree that the European Commission’s Standard Contractual Clauses (Module 2: controller to processor) apply and are incorporated by reference, with the UK International Data Transfer Addendum and Swiss amendments as applicable. For those clauses: the optional docking clause applies; Option 2 (general authorization) applies to Clause 9 with the notice period in Section 6; the optional language in Clause 11 does not apply; and the governing law and forum are [Ireland / the EU member state to be specified]. Annexes 1 and 2 of this DPA complete the clauses’ annexes.
13. General
If this DPA conflicts with the Terms, this DPA controls for the processing of Personal Data. If the Standard Contractual Clauses apply and conflict with this DPA, the clauses control. Liability under this DPA is subject to the limitations in the Terms, except where Data Protection Laws do not allow it.
Annex 1: Details of processing
| Subject matter | Provision of the OrderCtrl post-purchase platform to the Merchant. |
|---|---|
| Duration | The term of the Merchant’s use of the Service, plus the export and deletion period in Section 10. |
| Nature and purpose | Syncing orders and subscriptions from the Merchant’s store; tracking shipments; operating the customer portal; handling requests, claims and returns; performing order and subscription actions; sending emails; running automations; analytics; helpdesk lookups; and optional AI-assisted features. |
| Data subjects | The Merchant’s customers, recipients of orders, and the Merchant’s team members using the Service. |
| Categories of data | Names; email addresses; phone numbers; billing and shipping addresses; order, item and payment status details; shipment and delivery information; subscription details; request, claim and return details, including photos and messages; portal sign-in and session information; and IP addresses used for security. |
| Special categories | None intended. The Merchant should not use the Service to process special categories of data. |
| Frequency | Continuous. |
Annex 2: Security measures
- Encryption: customer contact and address details on orders, subscriptions and address checks, store and integration credentials, and other sensitive settings are encrypted in the database. Data is encrypted in transit using TLS.
- Authentication: passwords are hashed; team members may use two-factor authentication; customers sign in with single-use codes that expire after 15 minutes, are stored as hashes, and are rate-limited.
- Access control: role-based access for Merchant teams (owner, admin and analyst), with optional two-factor authentication; tenant checks on order actions; API access by revocable, rotatable keys.
- Integrity: signature verification of incoming webhooks; protection against cross-site request forgery; validation of redirects in sign-in flows.
- File protection: claim evidence is stored privately and served only through signed, expiring links.
- Data minimization and retention: email logs are deleted after 90 days; Merchants can anonymize customer details on orders.
- Resilience: [backups, monitoring and recovery measures to be confirmed with the hosting provider].