Data Processing Agreement

01Parties and scope

This Data Processing Agreement (“DPA”) forms part of the Terms for Stores between the Store (controller) and ADS Delivery OOD (processor). It applies to personal data about buyers that ADS Delivery OOD processes on the Store's behalf to provide ParcelMood.ai, and meets the requirements of Article 28 of the EU General Data Protection Regulation (GDPR).

02Annex I: details of the processing

03Processing on instructions

ADS Delivery OOD processes the data only on the Store's documented instructions, which are the Terms, this DPA, the Store's use of the dashboard and the links the Store places in its own emails, unless the law requires otherwise. We will tell the Store if we believe an instruction infringes data protection law.

04Confidentiality and security

People authorised to process the data are bound by confidentiality. We keep appropriate technical and organisational measures, including:

• encryption in transit (TLS) on every page and API;
• public tracking links built from random 128-bit tokens, never from order numbers;
• signature verification on incoming shop and carrier webhooks, rejecting anything unsigned;
• each store sees only its own data: every dashboard request and every store API call is checked against the signed-in store;
• store codes kept only as salted hashes, with sign-in paused after repeated failures;
• IP addresses used for abuse limits stored only as keyed hashes and deleted after one day;
• tracking and friend pages marked so search engines do not list them;
• hosting on infrastructure providers with their own certified security programmes.

We review these measures as the service grows and update this list when we add to it.

05Sub-processors

The Store gives general authorisation to the sub-processors listed at parcelmood.ai/subprocessors (Annex III). We will give at least 14 days' notice of a new sub-processor, and the Store may object on reasonable data protection grounds. We impose data protection obligations on each sub-processor that are no less protective than this DPA, and remain responsible for them.

06Assistance and breaches

We help the Store respond to data subject requests, and with security, breach notification, impact assessments and prior consultation (GDPR Articles 32 to 36) where relevant. We notify the Store without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting the Store's data, with the information the Store needs to meet its own obligations.

07International transfers

Where data is transferred outside the European Economic Area, the transfer relies on an adequacy decision or on the European Commission's Standard Contractual Clauses, which are incorporated by reference.

08Deletion and return

At the end of the service we delete the Store's personal data within 30 days, or return it on the Store's written request made before closure, unless the law requires us to keep it.

09Audits

We make available the information needed to show compliance with this DPA. The Store may audit, on reasonable written notice, no more than once a year, at its own cost and under confidentiality, unless a supervisory authority requires otherwise.

10Liability, precedence and law

Each party's liability under this DPA is subject to the limitations in the Terms for Stores, except where the law does not allow a limitation. If this DPA conflicts with the Terms for Stores on a data protection matter, this DPA prevails. Where Standard Contractual Clauses apply to a transfer, they prevail over both. This DPA is governed by the laws of the Republic of Bulgaria.

11Annex II: technical and organisational measures

• Encryption in transit (TLS) for every page, API and webhook.
• Tracking and friend pages reached only through random, unguessable links (128-bit tokens), never through order numbers, and marked so search engines do not list them.
• Access control: every dashboard request and store API call is checked against the signed-in store, so a store reaches only its own data; plans and quotas are enforced on the server and fail closed.
• Authentication: store codes stored only as salted scrypt hashes; sign-in paused after five failures per email and per IP address within 15 minutes; optional Google or Apple sign-in limited to emails already in the store's account.
• Input and integrity: signed webhooks (shop and carrier) verified with a constant-time comparison; size limits on all request bodies; rate limits on public actions.
• Minimisation and pseudonymisation: buyers are identified by first name only; rate-limit records keep a keyed hash instead of an IP address or email; friend answers and card ratings are tied to a random browser identifier; a buyer's own photo is not stored, only its cut-out.
• Storage limitation: automatic deletion of tracking pages 90 days after their last change following delivery and at most 180 days after creation, of friend and rating identifiers after 30 days, of a buyer's cut-out and rating cards with their tracking page, of unused images after 30 days, and of rate-limit records after one day.
• Separation: ParcelMood runs on its own code, database, hosting project and credentials, separate from any other ADS product.
• Secrets are kept only in the hosting provider's encrypted environment settings; the tracking-provider key is refused unless it belongs to the dedicated ParcelMood account.
• Hosting and database providers operate their own certified security programmes, including encryption at rest.

12Annex III: sub-processors

The authorised sub-processors, their purpose and location are listed at parcelmood.ai/subprocessors, which forms part of this DPA.

13Contact

Data protection questions: privacy@parcelmood.ai.