Data Processing Addendum

1. Scope and roles

This Data Processing Addendum ("DPA") is part of the Terms of Service between Stronger eCommerce Inc. ("Processor") and the Customer. It applies to personal information in Customer Data that we process on the Customer's behalf ("Customer Personal Data"). The Customer is the controller (or "business"), and we are the processor (or "service provider"). Where the Customer is itself a processor for someone else, we are its subprocessor. If this DPA and the Terms conflict about Customer Personal Data, this DPA wins.

2. Details of the processing

• Subject matter and purpose: providing the Service: receiving orders from the Customer's sales channels, creating them in its order system, sending them to the Customer's shipping tool where it connects one (ShipStation) and reading shipments back, sending acknowledgments, ship notices, invoices and inventory, alerts, support and billing.
• Duration: for the term of the Terms, then until deletion under section 9.
• Data subjects: the Customer's end customers (shoppers), the Customer's staff and users, and contacts at its partners.
• Categories of data: names, shipping and billing addresses, phone numbers, email addresses, order and shipment details (items, quantities, prices, tracking numbers), and user names and emails. The Service is not designed for sensitive data such as health or payment card data, and the Customer will not send it.
• Operations: collection, storage, retrieval, transformation into partner formats, transmission to the systems the Customer chooses, display and deletion.

3. Processing only on instructions

We process Customer Personal Data only to provide the Service and on the Customer's documented instructions, which are the Terms, this DPA and the settings the Customer chooses in the Service. We will not sell it, share it for cross-context behavioral advertising, use it for our own purposes outside the Service, or combine it with other data except as the Service needs. We will tell the Customer if we believe an instruction breaks the law, or if we can no longer meet our obligations.

4. Confidentiality

Everyone we allow to process Customer Personal Data is bound by a duty of confidentiality, and access is limited to those who need it.

5. Security measures

We maintain technical and organizational measures appropriate to the risk, including:

• encryption in transit (TLS) for the app, the API and connections to partners where the partner supports it;
• encryption of stored credentials (AES-256-GCM) and hosting providers that encrypt data at rest;
• logical separation of each organization's data, checked by automated tests;
• role-based access for the Customer's users and scoped, revocable API keys;
• an activity log of changes and sends, and error monitoring;
• limited staff access, and backups kept by our database provider.

6. Subprocessors

The Customer authorizes the subprocessors listed on the Subprocessors page. We bind each by written contract to data protection terms at least as protective as this DPA, and we remain responsible for them. We will update that page at least 15 days before a new subprocessor starts processing Customer Personal Data. The Customer may object on reasonable data protection grounds by writing to legal@tryintersend.com within that time; we will try to address the objection, and if we cannot, the Customer may cancel the affected Service and receive a refund of prepaid fees for the unused time. Services the Customer connects with its own account, such as ShipStation, QuickBooks Online and Shopify, are not our subprocessors: we send them the data needed for what the Customer turns on (for ShipStation: the recipient's name, company name, shipping address and phone number, the items and their prices, the partner's order number, any gift message and packing notes, and a link to the packing slip, never the recipient's email address; for QuickBooks Online: the partner as customer, invoice and PO numbers, the items with their SKUs, descriptions, quantities and prices, dates and tracking numbers, and SKUs and item names in look-ups, never a shopper's name, address, email address or phone number; for Shopify, when the Customer chooses it as an order system: the recipient's name, company name, shipping address, phone number and, when the partner sends one, email address, the billing name and address, the items with their SKUs, quantities and prices, and the partner's name, order number, dates, gift message and notes), and they process it under the Customer's own agreement with them, once the Customer connects them.

7. Data subject requests and assistance

We will promptly pass to the Customer any request we receive from a data subject about Customer Personal Data, and not answer it ourselves unless the Customer asks us to. Taking into account the nature of the processing, we will help the Customer respond to such requests, and with data protection impact assessments and consultations with authorities, where the law requires.

8. Personal data breaches

We will notify the Customer without undue delay, and in any case within 72 hours, after becoming aware of a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access to Customer Personal Data. We will describe what happened, the data affected, the likely consequences and what we are doing about it, as far as we know at the time, and keep the Customer informed.

9. Return and deletion

The Customer can export its data while its account is active. When the account ends, we delete Customer Personal Data within 30 days of the Customer's written request, and in any case within 90 days, unless the law requires us to keep it. Copies in backups are deleted as the backups are overwritten and are protected until then.

10. Information and audits

On written request, no more than once a year, we will provide the information reasonably needed to show we meet this DPA, such as answers to a security questionnaire and our subprocessors' certifications. Where that is not enough, or a regulator requires it, the Customer may carry out an audit at its own cost, with reasonable notice, during business hours and under confidentiality.

11. International transfers

Customer Personal Data is processed in the United States. Where the Customer sends personal data from the European Economic Area, the United Kingdom or Switzerland, the European Commission's Standard Contractual Clauses (module two or three, as applicable), with the UK Addendum where relevant, are incorporated by reference, with the details in section 2 of this DPA as their annexes, and the governing law and courts in the Terms where the clauses allow.

12. US state privacy laws

Where the California Consumer Privacy Act or a similar US state law applies, we act as the Customer's service provider or processor, will not sell or share Customer Personal Data or retain, use or disclose it outside our business relationship with the Customer, will comply with those laws, and will tell the Customer if we can no longer do so.

13. Liability

Each party's liability under this DPA is subject to the limits and exclusions in the Terms.