01Parties and scope
This Data Processing Agreement (“DPA”) forms part of the Terms for Stores between the Store (controller) and ADS Delivery OOD (processor). It applies to personal data about buyers that ADS Delivery OOD processes on the Store's behalf to provide ParcelMood.ai, and meets the requirements of Article 28 of the EU General Data Protection Regulation (GDPR).
02Details of the processing
| Subject matter | Branded tracking pages, product cut-outs, friend links and related counts. |
|---|---|
| Duration | For the term of the Terms for Stores, plus the deletion period below. |
| Data subjects | The Store's buyers. |
| Categories of data | First name, order number, city, product name and image, carrier, tracking number, delivery status. |
| Special categories | None. The Store must not submit special categories of data. |
03Processing on instructions
ADS Delivery OOD processes the data only on the Store's documented instructions, which are the Terms, this DPA and the Store's use of the dashboard, unless the law requires otherwise. We will tell the Store if we believe an instruction infringes data protection law.
04Confidentiality and security
People authorised to process the data are bound by confidentiality. We keep appropriate technical and organisational measures, including:
- encryption in transit (TLS) on every page and API;
- public tracking links built from random 128-bit tokens, never from order numbers;
- signature verification on incoming shop webhooks, rejecting anything unsigned;
- hosting on infrastructure providers with their own certified security programmes.
We review these measures as the service grows and update this list when we add to it.
05Sub-processors
The Store authorises the sub-processors listed in our Privacy Policy. We will give at least 14 days' notice of a new sub-processor, and the Store may object on reasonable data protection grounds. We impose data protection obligations on each sub-processor that are no less protective than this DPA, and remain responsible for them.
06Assistance and breaches
We help the Store respond to data subject requests and with impact assessments where relevant. We notify the Store without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting the Store's data, with the information the Store needs to meet its own obligations.
07International transfers
Where data is transferred outside the European Economic Area, the transfer relies on an adequacy decision or on the European Commission's Standard Contractual Clauses, which are incorporated by reference.
08Deletion and return
At the end of the service we delete the Store's personal data within 30 days, or return it on the Store's written request made before closure, unless the law requires us to keep it.
09Audits
We make available the information needed to show compliance with this DPA. The Store may audit, on reasonable written notice, no more than once a year, at its own cost and under confidentiality, unless a supervisory authority requires otherwise.
10Contact
Data protection questions: privacy@parcelmood.ai.