Draft pending review by counsel — not yet in force
Data Processing Addendum
Version 2026-10-16.1 · Effective · Not yet reviewed by counsel · Markdown
In short
- You (the retailer) are the controller of consumer data in drop-ship orders; RunOps is your processor; brands are independent controllers.
- We process it only to stage and submit the orders you instruct, and purge it 90 days after the order is finished.
- We notify you of a personal-data breach without undue delay and within 72 hours.
- Subprocessors are listed publicly with 30 days' notice of changes. Signed copies are available on request.
This summary is for convenience. The full text below governs.
This Data Processing Addendum (“DPA”) is part of the Terms of Service between RunOps Inc. (“Processor”) and the Retailer (“Controller”). It applies whenever RunOps processes Personal Data on the Controller’s behalf. A countersigned copy is available on request from [NOTICE EMAIL].
1. Definitions
“Personal Data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach” have the meanings in the GDPR and UK GDPR and, where applicable, the equivalent terms in the CCPA (“service provider”, “personal information”). “Customer Personal Data” means Personal Data in drop-ship Orders (consumer name, address, phone) and in the Controller’s Users’ records that RunOps processes for the Controller.
2. Roles
2.1 The Controller is the controller of Customer Personal Data. RunOps is its processor (and service provider under the CCPA).
2.2 Brands receive Customer Personal Data when an Order reaches their Dealer Portal and process it as independent controllers under their own terms. RunOps is not responsible for Brands’ processing.
3. Instructions
3.1 RunOps processes Customer Personal Data only on the Controller’s documented instructions, which are: to stage and, where enabled, submit Orders to the Brands the Controller directs; to show Order records to the Controller; and as otherwise needed to provide the Service under the Terms. RunOps will tell the Controller if it believes an instruction breaks the law.
3.2 RunOps will not sell or share Customer Personal Data, use it for its own purposes, or combine it with other data except as the Service requires.
| Item | Detail |
|---|---|
| Subject matter | drop-ship Order fulfilment through Dealer Portals |
| Duration | the term of the Terms plus the deletion periods below |
| Data subjects | the Controller’s end customers; the Controller’s Users |
| Categories | name, postal address, phone (where a Brand requires it), store email, PO references |
| Special categories | none; the Controller must not send any |
4. Confidentiality
4.1 RunOps ensures that people authorised to process Customer Personal Data are bound by confidentiality and access it only as needed.
5. Security measures
5.1 RunOps maintains the technical and organisational measures described on the Security page, including: TLS in transit; consumer blocks sealed on the Order record; Portal Credentials encrypted and bound to the Account; row-level tenant isolation; redaction of consumer fields from logs and error messages; least-privilege access; audit logging; and backups with point-in-time recovery.
6. Subprocessors
6.1 The Controller authorises the subprocessors listed on the Subprocessors page. RunOps will give at least 30 days’ notice of a new subprocessor there and by email to Owners; the Controller may object on reasonable data-protection grounds, and if the objection cannot be resolved, may terminate the affected Service.
6.2 RunOps imposes data-protection terms on each subprocessor no less protective than this DPA and remains responsible for them.
7. Data-subject requests and assistance
7.1 RunOps will promptly forward requests it receives from data subjects to the Controller and help the Controller respond, taking into account the nature of the processing. RunOps will also provide reasonable help with impact assessments and consultations with authorities.
8. Personal-data breaches
8.1 RunOps will notify the Controller without undue delay and in any case within 72 hours of becoming aware of a personal-data breach affecting Customer Personal Data, with the information then available (nature, categories and approximate numbers, likely consequences, measures taken), and will update it as more is known.
9. Deletion and return
9.1 Customer Personal Data in drop-ship Orders is purged 90 days after the Order reaches a final state. On termination, RunOps deletes remaining Customer Personal Data within [30] days, after allowing the Controller to export Order records, unless the law requires retention.
10. Audits
10.1 RunOps will make available the information reasonably needed to demonstrate compliance with this DPA, including [SECURITY REPORTS OR QUESTIONNAIRE RESPONSES], and will allow audits by the Controller or its auditor on reasonable notice, at most once a year unless a breach has occurred, [AT THE CONTROLLER’S COST].
11. International transfers
11.1 Where Customer Personal Data is transferred from the EEA, UK or Switzerland to a country without an adequacy decision, the parties agree to [THE EU STANDARD CONTRACTUAL CLAUSES (MODULE 2) / UK INTERNATIONAL DATA TRANSFER ADDENDUM — ANNEXES TO BE COMPLETED BY COUNSEL], which are incorporated by reference.
12. Liability and precedence
12.1 Each party’s liability under this DPA is subject to the limitations in the Terms, [EXCEPT WHERE COUNSEL SPECIFIES OTHERWISE]. For Personal Data, this DPA prevails over the Terms where they conflict.
Change log
| Version | Effective | Change |
|---|---|---|
| 2026-10-16.1 | 2026-10-16 | First engineering draft, pending review by counsel. |