This Data Processing Addendum ("DPA") forms part of the Terms of Use between ADV Orders and the business customer that uses the Service ("Customer"). It applies whenever we process Customer Personal Data on Customer's behalf. If this DPA and the Terms conflict on a data protection matter, this DPA controls.

1. Definitions

"Customer Personal Data" means personal information that we process on Customer's behalf in providing the Service, including the names, shipping addresses, email addresses and phone numbers of Customer's own customers that reach the Service from connected platforms such as Shopify and Amazon.

"Data Protection Laws" means the privacy and data protection laws that apply to the processing, including the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA") and other U.S. state consumer privacy laws, and, only where they apply, the EU General Data Protection Regulation and the UK GDPR.

"Sub-processor" means a third party we engage that processes Customer Personal Data.

"Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.

Other capitalized terms have the meaning given in the Terms of Use or the Data Protection Laws.

2. Roles

Customer is the "business" (CCPA) or "controller" of Customer Personal Data. We are Customer's "service provider" or "contractor" (CCPA) and, where the GDPR applies, its "processor". Customer is responsible for the lawfulness of the data it brings into the Service and for any notices and consents its own customers require.

3. Scope of processing

The subject matter, nature, purpose, duration and categories of data are described in Annex A. We process Customer Personal Data only to provide, secure, support and maintain the Service for Customer.

4. Customer's instructions

We process Customer Personal Data only on Customer's documented instructions. The Terms, this DPA and Customer's use and configuration of the Service are Customer's complete instructions. We will tell Customer if, in our opinion, an instruction infringes Data Protection Laws, unless the law prohibits us from doing so.

5. Service provider commitments

With respect to Customer Personal Data, we will not:

(a) sell or share it, as those terms are defined in the CCPA;

(b) retain, use or disclose it for any purpose other than the business purposes set out in the Terms and this DPA, including for any commercial purpose other than providing the Service, or outside the direct business relationship between us and Customer;

(c) combine it with personal information we receive from or on behalf of another person, or collect from our own interactions with consumers, except as the CCPA permits;

(d) use it for advertising, for profiling, or to train machine-learning or generative AI models.

We will comply with the obligations that apply to us under the CCPA and give Customer Personal Data the level of privacy protection the CCPA requires. We will notify Customer if we determine that we can no longer meet these obligations, and Customer may then take reasonable and appropriate steps to stop and remediate any unauthorized use. We certify that we understand and will comply with the restrictions in this Section 5.

Data that reaches the Service from Amazon or Shopify is also handled under the rules those platforms impose on us, described in Sections 13 and 14 of our Privacy Policy. Where those rules are stricter than this DPA, for example the deletion of Amazon buyer information no later than 30 days after an order ships, we follow them.

6. Confidentiality and personnel

Only personnel who need access to provide the Service can access Customer Personal Data. Every such person is bound by a duty of confidentiality and completes our security and data protection training before access is granted and every year after.

7. Security

We implement and maintain the technical and organizational measures described in Annex B, which are designed to protect Customer Personal Data against Security Incidents. We may update these measures as long as the overall level of protection is not reduced.

8. Sub-processors

Customer gives a general authorization for us to engage Sub-processors. A current list is available on request at privacy@adv.design. Before a new Sub-processor starts processing Customer Personal Data, we will notify Customer by email or in the Service, at least 30 days in advance where feasible. Customer may object on reasonable data protection grounds within that period; if we cannot reasonably address the objection, Customer may terminate the affected part of the Service. We impose data protection obligations on each Sub-processor that are no less protective than this DPA, and we remain responsible for their performance.

9. Assistance

Taking into account the nature of the processing, we will reasonably assist Customer in responding to requests from individuals exercising their privacy rights (access, deletion, correction and similar). The Service already handles Shopify's customer data request and deletion notifications automatically. If we receive such a request directly, we will refer the individual to Customer. Where Data Protection Laws require it, we will also provide reasonable information Customer needs for a data protection assessment.

10. Security Incidents

We will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Security Incident affecting Customer Personal Data. The notice will describe, as far as then known, the nature of the incident, the categories and approximate volume of data concerned, the likely consequences, and the measures taken or proposed. We will update Customer as more information becomes available. Where Amazon-sourced data is affected, we also notify Amazon within 24 hours as Amazon's policies require.

11. Retention and deletion

We keep Customer Personal Data only as long as needed to provide the Service and as described in our Privacy Policy, including the automatic deletion of Amazon buyer information no later than 30 days after an order ships. When Customer deletes its account, its data is deleted from our active systems. Backup copies are overwritten on a rolling schedule. We may keep data longer only where the law requires it, and then only for that purpose.

12. Information and audits

On Customer's written request, no more than once in any twelve-month period (or after a Security Incident, or where a regulator requires it), we will answer reasonable written security questionnaires and provide summaries of our security policies and controls. Any information we provide is our confidential information.

13. Transfers

We process Customer Personal Data in the United States. If Customer is subject to the GDPR or UK GDPR and a transfer to us requires a transfer mechanism, the EU Standard Contractual Clauses (Module Two, controller to processor) and the UK International Data Transfer Addendum are incorporated into this DPA by reference, with Customer as data exporter and us as data importer.

14. Liability and term

Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Terms. This DPA lasts for as long as we process Customer Personal Data on Customer's behalf.

Annex A. Description of the processing

Subject matter and purpose: providing the order management, inventory, shipping-label and integration features of the Service to Customer, together with security, support and maintenance.

Nature of the processing: receiving data from platforms Customer connects, storing it, displaying it to Customer's authorized users, sending the minimum necessary data to shipping carriers and other services Customer chooses to use, and deleting it on the schedules described above.

Duration: for the term of the Terms of Use and the retention periods in Section 11.

Data subjects: Customer's own customers (buyers and recipients of orders) and Customer's authorized users of the Service.

Categories of data: names, shipping and billing addresses, email addresses, phone numbers, order contents and values, shipment and tracking details, and notes Customer's users add. The Service is not designed for sensitive personal information, and Customer should not submit it.

Annex B. Security measures

(a) Encryption in transit with TLS 1.2 or higher on every external connection.

(b) Application-level AES-256-GCM encryption of buyer personal information and integration credentials at rest, on top of the storage-level encryption provided by our hosting providers, with a documented key-rotation procedure.

(c) Multi-factor authentication on every user account of the Service; an authenticator app is required for accounts that handle Amazon buyer information and for our own staff. Passwords of at least 12 characters with complexity rules, reuse of the last 10 blocked, a 365-day maximum age, and account lockout after 10 failed attempts.

(d) Least-privilege access to production systems, with a quarterly access review, and multi-factor authentication on every infrastructure account.

(e) Audit logging of sign-ins, administrative actions and any staff access to a customer account. Application logs have personal information removed before they are written and are kept for 12 months.

(f) Automatic deletion of buyer personal information on fixed schedules, including shipping-label images and customs documents.

(g) Separate development and production environments; production data is never copied into development.

(h) Continuous dependency vulnerability monitoring, static code analysis and secret scanning on every change, and a weekly scan of our internet-facing services, with fixed remediation deadlines (critical issues within 7 days).

(i) Hosting on managed providers that hold SOC 2 Type II attestations.

(j) A written incident response plan, exercised at least once a year, and annual security training for personnel.

Contact

ADV Orders by ADV Design
Privacy & Compliance
Email: privacy@adv.design
Legal: legal@adv.design

---

This Data Processing Addendum is drafted in English, and the English version is the sole authoritative text.