Data Processing Agreement

This agreement covers the processing of buyer personal data in orders from your connected sales channels and forms part of the Terms of Service. For this data you are the controller and [Company name] is the processor (GDPR art. 28; KVKK art. 12).

1. Subject matter

Data: buyer name, shipping address, phone, e-mail, order contents and tracking data. Data subjects: your customers. Purpose: displaying orders, forwarding them to your supplier, posting tracking to your store, keeping profit and return records.

2. Our obligations

• We process the data only on your instructions (the features and settings you enable) and to provide the service.
• We apply technical and organisational measures: encrypted connections, encrypted access tokens, workspace isolation, activity logs, daily backups.
• Personnel with access are bound by confidentiality.
• We notify you without undue delay, and within 72 hours, after becoming aware of a personal data breach.
• We provide reasonable assistance with data subject requests and supervisory authority inquiries.

3. Sub-processors

To fulfil orders we transfer data to the supplier you connect (CJ Dropshipping, AliExpress, Printify) and to the sales channel you connect for tracking updates. Infrastructure sub-processors are listed in the Privacy Policy, which is updated when a sub-processor is added.

4. International transfers

The suppliers and platforms you choose may be located outside your country. As controller, you are responsible for informing your customers and having a lawful basis for these transfers.

5. Duration and deletion

Order data is kept while the store connection and your account exist. When you remove the connection or delete your account the data is deleted and removed from backups within 30 days. Shopify customer redaction requests are applied automatically.

Last updated: 15 October 2026