Data processing agreement

This Data Processing Agreement (“DPA”) forms part of the DropshipDuo Terms of Service between you, the merchant using DropshipDuo (“Merchant”, “you”), and DropshipDuo (“DropshipDuo”, “we”, “us”). It applies whenever we process personal data of your customers in order to provide our services to you.

You accept this DPA when you tick “I agree to the DropshipDuo Terms of Service and Data Processing Agreement” at registration or when you first use DropshipDuo. If this DPA conflicts with the Terms of Service on the processing of personal data, this DPA prevails.

• You are the data controller. You decide why and how your customers’ personal data is collected, and you remain responsible for having a lawful basis to share it with us and for informing your customers in your own privacy notice.
• DropshipDuo is the data processor. We process your customers’ personal data only on your behalf and only on your documented instructions. Your instructions are this DPA, the Terms of Service, and the orders, settings and requests you submit through DropshipDuo.

If we believe an instruction breaches applicable data protection law, we will tell you and may pause the affected processing until it is clarified.

Data subjects: your end customers — the people who buy from your store and receive your orders.

Categories of personal data:

• customer name;
• email address;
• phone number;
• shipping address;
• order information — such as order number, products, quantities, prices, order notes, shipping method and tracking details.

We do not need, and you should not send us, special categories of personal data (such as health data) through order information.

We process your customers’ personal data only to:

• Source products — purchase and prepare the items in your orders;
• Fulfill orders — pick, pack, quality-check and label orders;
• Ship orders — hand orders to carriers and prepare customs documents;
• Track shipments — sync tracking numbers and delivery status back to you and your sales channels;
• Provide after-sales support — handle delivery issues, returns, reshipments and refunds.

• We do not use your customers’ personal data for advertising, marketing or profiling, whether for ourselves or for anyone else.
• We do not sell, rent or trade your customers’ personal data.
• We do not contact your customers except where needed to deliver an order or resolve an after-sales issue, or where you ask us to.

You authorise us to share your customers’ personal data with the logistics and supply-chain providers that are necessary to deliver the service, including:

• carriers, last-mile delivery companies and customs brokers;
• warehouses and fulfillment centres;
• suppliers and factories, which receive only what they need to prepare an order (for example product, quantity and, where required, a shipping label);
• hosting and IT providers that run the DropshipDuo platform;
• the sales platforms you connect, to sync order status and tracking.

Each provider receives only the data needed for its task and is bound by data protection obligations no less protective than this DPA. We remain responsible to you for their processing. We will provide our current list of sub-processors on request, and you may object to a new sub-processor on reasonable data protection grounds.

We maintain appropriate technical and organisational measures to protect your customers’ personal data, including:

• encryption of data in transit (HTTPS/TLS);
• role-based access control so staff and partners see only the data their task requires;
• account authentication and logging of access to order data;
• data minimisation on shipping labels and supplier documents;
• confidentiality obligations and data protection training for our personnel;
• regular backups and review of our security measures.

Fulfilling cross-border orders means personal data may be processed outside the country where you or your customers are located, including in China and in the countries where our warehouses and carriers operate. Where the law requires it, we put appropriate safeguards in place, such as the Standard Contractual Clauses approved by the European Commission.

• During the service: we keep your customers’ personal data for as long as needed to fulfill, ship and support the related orders, and longer only where tax, customs or other laws require it.
• Deletion on request: you can ask us to delete specific customer data at any time, unless we are legally required to keep it.
• When you stop using DropshipDuo: you can export your order data for 30 days after your account is closed. After that, we delete or anonymise your customers’ personal data within 90 days, including in our active systems, and instruct our sub-processors to do the same. Backups are overwritten in their normal cycle.
• Legal retention: data we must keep by law is kept securely, used only for that purpose and deleted when the retention period ends.

If we become aware of a personal data breach affecting your customers’ data, we will notify you without undue delay and in any case within 48 hours. Our notice will describe, as far as we know at the time, what happened, the data and number of people affected, the likely consequences and the measures we have taken or propose. We will keep you updated and help you meet any obligation to notify authorities or affected customers.

If one of your customers contacts us directly to access, correct, delete or otherwise exercise rights over their personal data, we will forward the request to you within 5 business days and will not respond to it ourselves unless you instruct us to. We will help you respond to such requests, for example by locating, correcting or deleting the relevant order data.

Taking into account the nature of the processing, we will give you reasonable assistance with data protection impact assessments and consultations with authorities, and make available the information reasonably necessary to demonstrate our compliance with this DPA.

We may update this DPA to reflect changes in the law or our services. We will change the “Last updated” date above and notify you of material changes by email or in the DropshipDuo dashboard before they take effect.

Questions about this DPA: support@dropshipduo.com