Data Processing Addendum

This addendum forms part of the Terms of Service and applies between the merchant using Dropvora ("Merchant", the controller) and OMENDES LLC, 1209 Mountain Road Pl NE #13325, Albuquerque, NM 87110, USA · hello@dropvora.com ("Dropvora", the processor) to personal data Dropvora processes on the Merchant's behalf. By creating an account and using order forwarding you accept this addendum.

The Merchant's own account data is covered by the Privacy Policy, not by this addendum.

• Data subjects: buyers who place orders containing Dropvora products in the Merchant's Shopify store.
• Categories of data: name, shipping address, phone number, email, order number, items, total and tracking number. No special category data is processed.
• Purpose: creating the order in the Merchant's CJ Dropshipping account, writing the tracking number back to Shopify, and showing the Merchant order and profit reports.
• Duration: for as long as the Merchant's account is open and order forwarding is used.

• Dropvora processes personal data only on the Merchant's instructions (including the Merchant's settings and use of the service) and for the purposes in this addendum, and informs the Merchant if it believes an instruction is unlawful.
• Personnel with access to the data are bound by confidentiality.
• The data is not used to train artificial intelligence models and is not sent to AI providers.
• The data is not sold or used for Dropvora's own purposes.

Dropvora maintains appropriate technical and organisational measures: HTTPS on every connection, store and CJ access tokens encrypted with AES-256-GCM, database access restricted with row-level security, and privileged operations that run only on the server.

Dropvora notifies the Merchant without undue delay of a security incident affecting this data, with the details then known and the steps taken. The Merchant is responsible for securing its own account credentials and devices.

The Merchant authorises the following subprocessors:

• Supabase: database and storage (EU, Frankfurt).
• Vercel: application hosting and server functions (US).
• CJ Dropshipping: creating and shipping the order in the Merchant's own account (China and CJ warehouses). The relationship with CJ is governed by the terms of the Merchant's own CJ account.
• Shopify: reading the order and writing fulfilment details (the Merchant's own store).

Dropvora binds its subprocessors to data protection obligations no less protective than this addendum and remains liable for their processing as for its own. Before adding a new subprocessor Dropvora updates this page and notifies the Merchant by email; the Merchant may object on reasonable grounds within 15 days and, if no solution is found, stop using order forwarding or cancel its subscription.

Dropvora forwards access, correction or deletion requests from buyers to the Merchant and refers the buyer to the Merchant, who is responsible for answering them. On Shopify's customers/redact notification the buyer's shipping details are deleted, customers/data_request notifications are recorded, and Dropvora reasonably assists in answering them.

• The Merchant informs its buyers in its own privacy policy that orders are passed to its supplier and carrier.
• The Merchant ensures a valid legal basis for the processing (usually the sales contract with the buyer).
• The Merchant does not place special category data, such as health information or ID numbers, in order notes or product customisations.

Data is processed in the US and, for fulfilment, in the countries where CJ operates. For transfers from the EU, EEA, UK or Switzerland, where required, the European Commission's Standard Contractual Clauses (Module 2: controller to processor) and the UK Addendum are incorporated into this addendum by reference, with the Merchant as data exporter and Dropvora as data importer.

On the Merchant's written request Dropvora provides the information needed to demonstrate compliance with this addendum. Where required by law or a competent supervisory authority, the Merchant may request an audit with reasonable notice, at most once a year.

When the Merchant deletes its account, buyer data is deleted within 30 days. Before deleting, the Merchant may request a copy of its orders at hello@dropvora.com. Data that the law requires us to keep is retained only for that period and kept confidential.

If this addendum conflicts with the Terms of Service on the protection of personal data, this addendum prevails. Liability limits and governing law are as set out in the Terms of Service. If you need a signed copy, email hello@dropvora.com.