Data Processing Addendum

1. Definitions

"Data Protection Laws" means all laws applicable to the processing of Customer Personal Data under the Terms, including the GDPR, UK GDPR and Data Protection Act 2018, the Swiss FADP, the CCPA, LGPD, PIPEDA, PIPL, APPI, PIPA, PDPA (Singapore and Thailand), the Indian DPDP Act 2023 and the Australian Privacy Act 1988. "Customer Personal Data" means personal data in Customer Data processed by Shipzobuy as processor or service provider. "Controller", "processor", "data subject", "personal data breach", "processing" and "supervisory authority" have the meanings given in the GDPR, and equivalent terms in other Data Protection Laws (such as "business" and "service provider") are to be read accordingly.

2. Roles and scope

The Customer is the controller (or a processor acting for its own controller) and Shipzobuy is the processor (or sub-processor) of Customer Personal Data. The subject matter, nature, purpose and duration of processing and the categories of data and data subjects are set out in Annex I. Shipzobuy processes personal data relating to its own customers' accounts, billing and security as an independent controller under its Privacy Policy.

3. Processing on documented instructions

Shipzobuy will process Customer Personal Data only on the Customer's documented instructions, including with regard to international transfers, unless required to do so by Union, Member State or other applicable law, in which case Shipzobuy will inform the Customer of that legal requirement before processing unless the law prohibits it. The Terms, this DPA and the Customer's configuration and use of the Service (for example, connecting a store, purchasing a label, or enabling tracking write-back) are the Customer's complete instructions. Shipzobuy will inform the Customer if, in its opinion, an instruction infringes Data Protection Laws.

The Customer is responsible for the lawfulness of its instructions and for having a lawful basis and giving all notices required for the processing, including the transfer of shipping data to Carriers.

4. Confidentiality

Shipzobuy ensures that persons authorised to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that access is limited to those who need it.

5. Security

Shipzobuy implements and maintains the technical and organisational measures described in Annex II, which are designed to ensure a level of security appropriate to the risk, as required by Article 32 GDPR. Shipzobuy may update those measures, provided the overall level of security is not reduced.

6. Sub-processors

The Customer gives Shipzobuy general authorisation to engage sub-processors. The current list is published at Sub-processors. Shipzobuy will give at least 30 days' notice of any new or replacement sub-processor by updating that list and notifying Account owners by email or in the Service. The Customer may object on reasonable data protection grounds within that period; the parties will discuss the objection in good faith, and if it cannot be resolved, the Customer may terminate the affected Service and receive a pro-rata refund of prepaid subscription fees for the period after termination.

Shipzobuy imposes on each sub-processor data protection obligations no less protective than those in this DPA and remains liable to the Customer for its sub-processors' performance.

Carriers and Label Providers selected by the Customer to transport parcels process shipping data as independent controllers under their own terms and are not Shipzobuy's sub-processors.

7. Assistance with data subject requests

Taking into account the nature of the processing, Shipzobuy will assist the Customer by appropriate technical and organisational measures, insofar as possible, in responding to requests from data subjects to exercise their rights. The Service lets the Customer access, correct, export and delete Customer Data. If Shipzobuy receives a request directly from a data subject relating to Customer Personal Data, it will refer the data subject to the Customer and will not respond except on the Customer's instructions or as required by law.

8. Personal data breaches

Shipzobuy will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notification will describe, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Shipzobuy will provide further information as it becomes available and take reasonable steps to contain and remedy the breach. Notification is not an acknowledgement of fault or liability.

9. Impact assessments and consultation

Shipzobuy will provide reasonable assistance to the Customer with data protection impact assessments and prior consultations with supervisory authorities, to the extent required by Data Protection Laws and relating to the Customer's use of the Service.

10. Return and deletion

On termination of the Service, the Customer may export Customer Data for 30 days. Thereafter, Shipzobuy will delete Customer Personal Data within 90 days, unless retention is required by applicable law, in which case Shipzobuy will protect it and process it only for that purpose. Backups are overwritten in the ordinary course of business.

11. Information and audits

Shipzobuy will make available to the Customer all information reasonably necessary to demonstrate compliance with Article 28 GDPR and this DPA, and will allow for and contribute to audits, including inspections, by the Customer or an independent auditor mandated by it. Audits must be requested with at least 30 days' written notice, take place during business hours no more than once in any 12-month period (unless required by a supervisory authority or following a personal data breach), be subject to confidentiality obligations, and avoid disruption to Shipzobuy's operations and other customers. Shipzobuy may first respond by providing documentation, questionnaires and third-party certifications or reports, where these reasonably satisfy the audit request.

12. International transfers

Shipzobuy may transfer Customer Personal Data outside the country in which it was collected in accordance with this DPA and Data Protection Laws.

• EEA. To the extent Customer Personal Data subject to the GDPR is transferred to a third country not subject to an adequacy decision, the Standard Contractual Clauses annexed to Commission Implementing Decision (EU) 2021/914 are incorporated into this DPA: Module Two (controller to processor) where the Customer is a controller, and Module Three (processor to processor) where the Customer is a processor. Clause 7 (docking clause) applies; in Clause 9, Option 2 (general authorisation) applies with the notice period in Section 6; in Clause 11 the optional language does not apply; in Clauses 17 and 18 the law and courts are those of the laws of Spain where that is a Member State, and otherwise of Ireland; Annexes I to III are completed by Annex I, Annex II and the Sub-processor list of this DPA.
• United Kingdom. For transfers subject to the UK GDPR, the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the Information Commissioner under section 119A of the Data Protection Act 2018 is incorporated, with Table 1 completed with the parties' details, Tables 2 and 3 completed by reference to the clauses above, and Table 4 allowing either party to end the Addendum.
• Switzerland. For transfers subject to the FADP, the clauses above apply with the Federal Data Protection and Information Commissioner as competent supervisory authority, references to Member State law read as Swiss law where required, and the term "Member State" not excluding data subjects in Switzerland from bringing claims in their place of habitual residence.
• Other jurisdictions. Where another Data Protection Law requires a specific transfer mechanism (for example, the PIPL standard contract, LGPD standard clauses or APPI equivalent measures), the parties will cooperate to put it in place.

13. US state privacy laws

Where the CCPA or another US state privacy law applies, Shipzobuy acts as a "service provider" or "processor" and: (a) processes Customer Personal Data only for the limited and specified business purposes set out in the Terms and Annex I; (b) will not sell or share Customer Personal Data or use it for cross-context behavioural advertising; (c) will not retain, use or disclose it outside the direct business relationship with the Customer or for any purpose other than those business purposes, except as permitted by law; (d) will not combine it with personal data received from others, except as permitted by law; (e) will comply with applicable obligations and provide the same level of protection required by those laws; (f) will notify the Customer if it can no longer meet its obligations; and (g) grants the Customer the right to take reasonable and appropriate steps to stop and remediate unauthorised use. Shipzobuy certifies that it understands and will comply with these restrictions.

14. Liability and precedence

Each party's liability under this DPA is subject to the limitations in the Terms, except to the extent such limitations are not permitted under Data Protection Laws or the Standard Contractual Clauses. In the event of conflict, the Standard Contractual Clauses prevail over this DPA, and this DPA prevails over the Terms with respect to the processing of Customer Personal Data.

15. Annex I: Details of processing

16. Annex II: Technical and organisational measures

• Encryption: TLS for all data in transit; encryption at rest provided by our hosting infrastructure; secrets and integration credentials stored with restricted, service-only access.
• Access control: organisation-scoped access; database row-level security rules; role-based permissions; principle of least privilege for staff; administrative actions restricted to authorised personnel.
• Authentication: hashed passwords; optional two-step verification; time-limited sessions; PKCE and one-time codes for account-linking flows, with only hashes of codes and tokens stored.
• Integration security: HMAC-signed, timestamped requests between Shipzobuy and connected stores, with replay protection; webhook signature verification; idempotency keys for payments and label purchases.
• Application security: input validation; rate limits and abuse controls on public endpoints; separation of test and production credentials; code review and automated tests before release.
• Availability and resilience: managed cloud hosting with backups and redundancy provided by our hosting provider; monitoring and error alerting.
• Data minimisation: only data needed for fulfilment is imported; IP addresses on public chat endpoints stored only as one-way hashes; consent records stored without IP addresses.
• Personnel: confidentiality obligations; security and privacy training; prompt removal of access on role change.
• Incident management: documented breach response with Customer notification as described in Section 8.
• Vendor management: due diligence on sub-processors and written data protection terms.