Data processing agreement
Preliminary version pending legal review. This document describes the intended commitment, but it is not yet a signed agreement.
1. Parties and subject matter
This agreement is entered into between the merchant using the HideMyDrop service, acting as data controller, and GRT Ventures OÜ, acting as data processor. It governs the processing of the personal data of the merchant's buyers that the service receives in order to provide masked parcel tracking.
2. Duration
The agreement applies for the whole duration of the service contract. It ends with it, subject to the end-of-contract obligations described in section 9.
3. Nature and purpose of the processing
The processor receives the orders and tracking numbers sent by the merchant's shop. It generates a masked tracking identifier, collects transport events from the provider named in section 7, filters them, displays a tracking page to the buyer and sends delivery notifications where the merchant has enabled that feature.
4. Categories of data
- Buyer contact data: e-mail address and name.
- Country code of the delivery destination.
- Order data: number, amount and currency.
- Carrier tracking numbers, the masked identifier and transport events, which with some carriers carry the recipient's name recorded at handover.
The service processes no postal address, no phone number and no special category of data within the meaning of Article 9 of the Regulation.
5. Categories of data subjects
The buyers of the merchant's shops, as well as the merchant's staff using the dashboard.
6. Obligations of the processor
- Process the data only on the merchant's documented instructions, use of the service constituting the instruction for the processing described in section 3.
- Ensure the confidentiality of the persons authorised to process the data.
- Implement appropriate technical and organisational measures, described in the service privacy policy.
- Assist the merchant in answering requests from their buyers to exercise their rights.
- Notify the merchant of any personal data breach within 72 hours at the latest after becoming aware of it.
- Make available to the merchant the information necessary to demonstrate compliance with this agreement.
7. Sub-processors
The merchant authorises the use of the following sub-processors.
- Hetzner Online GmbH, server hosting, Germany and Finland.
- OpenAI, classification of transport event labels. This provider receives only commercial fields and never any buyer personal data: no e-mail, no name, no order number and no tracking number.
- The company publishing parcelsapp.com, collection of transport events. It receives the parcel's carrier tracking number and nothing else, and returns the routing history published by the carrier, which can contain the delivery town and the recipient's name recorded in the delivery event. Legal name and registered office not stated on its site; terms of use governed by the law of Dubai (United Arab Emirates); representative in the European Union: BizLegal Ltd, Midleton, Ireland.
- Proxysale, the company publishing proxy-sale.pro, provision of the residential IP addresses, requested in France, through which those queries are routed. This intermediary sees the name of the queried site, the address of the processor's servers and the volume exchanged; the tracking number and the response travel encrypted end to end and are not readable by it. Legal form and registered office not stated on its site.
The list above is updated, and the merchant informed, before any change of sub-processor.
8. Transfers outside the European Union
Hetzner Online GmbH processes data within the European Union. The use of OpenAI involves a transfer to the United States, limited to the commercial fields described in section 7, without any buyer personal data. The contractual safeguards for this transfer will be specified in the final version of this agreement.
The publisher of parcelsapp.com and Proxysale do not state their registered office; the terms of the former are governed by the law of Dubai, those of the latter name no national law. The processor therefore treats both as transfers to third countries without an adequacy decision. That transfer relies on the derogation of Article 49(1)(b) and (c) of the Regulation: it is necessary for the performance of the parcel tracking the merchant owes the buyer, and it is made in the buyer's interest. It is limited to the carrier tracking number, which the carrier makes available to anyone holding it, and to the events returned; no account, contact or order data is transmitted. Towards the network intermediary, the number and the response travel encrypted end to end and are not readable by it. The processor will inform the merchant if it enters into standard contractual clauses with either provider or replaces it with a provider established in the European Union.
9. Data at the end of the contract
At the end of the contract, the processor deletes the personal data processed on the merchant's behalf. Data whose retention is required by law, in particular billing records, is excepted.
10. Contact
Any question about this agreement can be sent to the contact address below.