Data processing agreement
Preliminary version pending legal review. This document describes the intended commitment, but it is not yet a signed agreement.
1. Parties and subject matter
This agreement is entered into between the merchant using the HideMyDrop service, acting as data controller, and GRT Ventures OÜ, acting as data processor. It governs the processing of the personal data of the merchant's buyers that the service receives in order to provide masked parcel tracking.
2. Duration
The agreement applies for the whole duration of the service contract. It ends with it, subject to the end-of-contract obligations described in section 9.
3. Nature and purpose of the processing
The processor receives the orders and tracking numbers sent by the merchant's shop. It generates a masked tracking identifier, collects and filters transport events, displays a tracking page to the buyer and sends delivery notifications where the merchant has enabled that feature.
4. Categories of data
- Buyer contact data: e-mail address and name.
- Country code of the delivery destination.
- Order data: number, amount and currency.
- Carrier tracking numbers, the masked identifier and transport events.
The service processes no postal address, no phone number and no special category of data within the meaning of Article 9 of the Regulation.
5. Categories of data subjects
The buyers of the merchant's shops, as well as the merchant's staff using the dashboard.
6. Obligations of the processor
- Process the data only on the merchant's documented instructions, use of the service constituting the instruction for the processing described in section 3.
- Ensure the confidentiality of the persons authorised to process the data.
- Implement appropriate technical and organisational measures, described in the service privacy policy.
- Assist the merchant in answering requests from their buyers to exercise their rights.
- Notify the merchant of any personal data breach within 72 hours at the latest after becoming aware of it.
- Make available to the merchant the information necessary to demonstrate compliance with this agreement.
7. Sub-processors
The merchant authorises the use of the following sub-processors.
- Hetzner Online GmbH, server hosting, Germany and Finland.
- OpenAI, classification of transport event labels. This provider receives only commercial fields and never any buyer personal data: no e-mail, no name, no order number and no tracking number.
A tracking data provider is currently being selected. The list above will be completed before any real data is processed by that provider, and the merchant will be informed beforehand. The same applies to any other change of sub-processor.
8. Transfers outside the European Union
The use of OpenAI involves a transfer to the United States, limited to the commercial fields described in section 7. The contractual safeguards for this transfer will be specified in the final version of this agreement.
9. Data at the end of the contract
At the end of the contract, the processor deletes the personal data processed on the merchant's behalf. Data whose retention is required by law, in particular billing records, is excepted.
10. Contact
Any question about this agreement can be sent to the contact address below.