Data Processing Agreement

1. Parties and definitions

“Processor”, “we”, “us”: Orumio, represented by Masanori Iwata, Mitsuhashi Building 3F, 1-3-3 Kita-Aoyama, Minato-ku, Tokyo 107-0061, Japan, contact support@orderjay.com. “Controller”, “you”, “Merchant”: the business that uses the App — the operator of the system of record the App is connected to (a Shopify store, a Zoho Inventory + Books organisation or an Unleashed organisation) and of the mailbox connected to it. “App”: OrderJay. “Personal Data”, “Processing”, “Data Subject”, “Personal Data Breach” and “Supervisory Authority” have the meanings given in the GDPR. “Data Protection Law” means every privacy or data protection law applicable to the Processing under this DPA, including the EU GDPR, the UK GDPR, Japan’s Act on the Protection of Personal Information (APPI) and the US state privacy laws addressed in Annex IV.

2. Roles and scope

You are the Controller of the Personal Data in your system of record and in the mailbox you connect. We are your Processor and process that Personal Data only to provide the App to you. Your system of record (Shopify, Zoho or Unleashed) and your mailbox provider are independent parties to this DPA; your relationships with them are governed by your agreements with them. A workspace has exactly one system of record, fixed by the first connection. This DPA applies for as long as the App is installed or your system of record is connected to it, and survives uninstallation or disconnection for as long as we hold any of your Personal Data.

3. Instructions

We process Personal Data only on your documented instructions, including in respect of transfers to a third country. Your instructions are: (a) this DPA, including Annex I; (b) the App’s documented functionality, which you direct by installing it or connecting your system of record, connecting a mailbox, ratifying a policy (which classes of work may run, with what exposure caps and for which retailers) and by the resolutions your staff take on exceptions; and (c) any further written instruction you give us that we accept.

We will tell you if, in our opinion, an instruction infringes Data Protection Law. We will not process Personal Data for our own purposes — specifically not for marketing, advertising, profiling, resale or the training of machine-learning models — and we pass the same prohibition to the interpretation provider in Annex III. If we are required by law to process Personal Data beyond your instructions, we will inform you of that requirement before processing, unless the law forbids it on important grounds of public interest.

4. Confidentiality

The App is operated by a single person, who is bound by a duty of confidentiality in respect of all Personal Data processed under this DPA. There are no staff accounts, contractors or support agents with access to Merchant data. If that ever changes, any person authorised to process Personal Data will be placed under an equivalent obligation of confidentiality before access is granted.

5. Security

We implement and maintain the technical and organisational measures in Annex II, appropriate to the risk having regard to the state of the art, the costs of implementation and the nature, scope, context and purposes of the Processing. We may update those measures over time but will not reduce the overall level of security.

6. Sub-processors

You give us general written authorisation to engage sub-processors. Those engaged at the effective date are listed in Annex III. Before we add or replace one we will update Annex III and notify you by email at the address on file at least 30 days in advance. You may object on reasonable data protection grounds within that period; if we cannot resolve your objection you may terminate by uninstalling the App or by disconnecting your system of record and telling us, and we will delete your data in accordance with §10. We impose obligations on each sub-processor no less protective than those in this DPA and remain fully liable to you for its performance.

7. Assistance with data subject rights

Taking account of the nature of the Processing, we will assist you by appropriate technical and organisational measures in fulfilling your obligation to respond to requests to access, rectify, erase, restrict, port or object. Where a Data Subject contacts us directly we will not respond substantively ourselves; we will refer them to you and tell you promptly. We honour Shopify’s mandatory compliance webhooks: customers/data_request (we provide you with the data we hold about the contact), customers/redact (we delete or anonymise it — including the address of any location for which that contact is the only buyer; a location another buyer still orders for keeps its address, because it is your business address and their orders need it) and shop/redact (we delete your tenant, per §10). A redaction erases our copy: your store’s own record is yours, and if it still holds the data, a later read of that record brings back what it holds. Zoho and Unleashed have no equivalent signal, so for a Zoho or Unleashed workspace the same three outcomes are reached by writing to us, and we perform them within 10 business days. We state that rather than describe an automatic mechanism we do not have.

8. Personal data breach

We will notify you of a Personal Data Breach affecting your Personal Data without undue delay after becoming aware of it, and in any event targeting within 72 hours of confirming it, describing so far as known: the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences and the measures taken or proposed. Where the information cannot be provided at once we will provide it in phases. We maintain a written security incident response policy covering detection, containment, assessment, notification, remediation and post-incident review, and we review it after every significant incident.

9. Data protection impact assessments

Taking into account the nature of the Processing and the information available to us, we will provide reasonable assistance with your data protection impact assessments and any prior consultation with a Supervisory Authority.

10. Deletion and return

• On uninstallation we immediately discard the stored Shopify credentials and stop every scheduled sync, so no further Processing of Shopify data can occur; a connected mailbox is disconnected and its credentials discarded at the same time.
• Disconnecting a Zoho organisation revokes our authorisation at Zoho, erases the stored tokens and stops every scheduled sync, so no further Processing of Zoho data can occur. Any draft the App had prepared and not yet released stays in your organisation and is yours; we tell you so before the disconnect, because after it we hold no credential that could remove it.
• Disconnecting an Unleashed organisation erases the stored API ID and key and the App’s copy of your customers and products at once, and stops every scheduled sync, so no further Processing of Unleashed data can occur. Nothing is left in your organisation to remove, because the App writes nothing to it. The retailers, contacts and addresses the App derived from your records stay in your workspace as its record until you ask us to erase them (below).
• On receipt of Shopify’s shop/redact request (about 48 hours after uninstallation) we delete your tenant: records, mailbox messages and attachments, receipts, exceptions and logs. As a backstop against a lost webhook, any installation uninstalled for more than 30 days is deleted the same way. Zoho and Unleashed send no such request and there is no 30-day backstop for them; for a Zoho or Unleashed workspace the equivalent deletion — the records the App derived from your organisation and, if you ask, your whole workspace — is performed on your written request within 10 business days.
• Before then, you may request an export of your receipts and records in a machine-readable format, or earlier deletion, at any time by writing to the contact address.
• Operational logs and telemetry contain identifiers, classifications, counts and timings only and expire on the hosting provider’s ordinary schedule; audit events are kept 90 days and job events 180 days.

11. Audits and information

We will make available to you all information reasonably necessary to demonstrate compliance with this DPA and allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate. In the first instance we respond to a reasonable written request with our data posture document, our incident response policy and a written description of the measures in Annex II; an inspection may be requested where that is not sufficient, on reasonable notice, no more than once in any twelve-month period except following a Personal Data Breach, and subject to confidentiality.

12. International transfers

We are established in Japan; the App’s database and file store are placed in the United States (a North-American location hint) and the application runs on our hosting provider’s global network (Annex III). Where Personal Data protected by the EU GDPR is transferred to a country without an adequacy decision, the Standard Contractual Clauses approved by the European Commission (Implementing Decision (EU) 2021/914), Module Two (controller to processor), are incorporated into this DPA by reference and take precedence over it in the event of conflict. For those Clauses: you are the data exporter and we the data importer; the optional docking clause applies; the general authorisation for sub-processors in §6 applies with 30 days’ notice; the governing law is that of Ireland; disputes are resolved in the courts of Ireland; and Annexes I–III below serve as Annexes I–III to the Clauses. Where Personal Data protected by the UK GDPR is transferred, the UK International Data Transfer Addendum to the EU SCCs (version B1.0) is incorporated by reference, completed by Annexes I–III. Japan has received an adequacy decision from the European Commission, and the United Kingdom has made an equivalent finding.

13. Japan (APPI)

Where Japan’s Act on the Protection of Personal Information applies, we act as a party entrusted with the handling of personal data (委託先) under Article 27(5)(i), and you retain the supervisory obligation under Article 25. The measures in Annex II are the measures we take for that purpose, and §12 records the location of the servers for the purposes of Article 28.

14. General

This DPA prevails over any conflicting term of our other agreements with you to the extent of the conflict. If a provision is held invalid, the remainder stays in force. We may update this DPA to reflect changes in law or in the App with 30 days’ notice by email; continued use after the effective date of a change is acceptance of it.

Annex I — Particulars of the Processing

Annex II — Technical and organisational measures

• Encryption in transit — HTTPS only; TLS to your system of record, the database and the mailbox providers. Every Zoho call is made against the regional host that answered your authorisation and is re-derived from the stored data centre before use, so a request carrying our credentials cannot be aimed elsewhere.
• Encryption at rest — provider-managed AES-256 for the database and its backups; OAuth, Shopify and Zoho tokens and the Unleashed API ID and key additionally sealed with AES-256-GCM under a key held only in the hosting secret store and bound to their own row.
• Structural separation — the component that reads untrusted email text cannot write to your system of record or send mail; the components that act see only typed, verified facts. Replies go only to the authenticated sender; orders ship only to the recorded address of the resolved location; address, payment and contact changes are never automated.
• Hold before any write — every action is held for a cancel window and re-validated against live records before it runs; every write carries an idempotency key and is reconciled before it is made, so a retry never produces a second order or a second email. One write comes before that window and is named here because this sentence used to imply otherwise: on Zoho the desk creates a draft Estimate or Sales Order to read the organisation’s own authoritative total, and deletes it again before the receipt is issued. On Shopify the equivalent is a calculation and writes nothing. On Unleashed nothing is written at all: the App’s calls to Unleashed are limited to a fixed list of reads, which an automated test pins.
• Sending identity — a reply leaves from an address on your own domain only after your workspace has proved control of that domain by publishing a DNS record we issue to it alone, and the proof is re-read daily. Until then replies leave from our mail domain, from the intake address of your mailbox with the name of your store or organisation — or else of your workspace — as the sender’s name, and only to a sender whose address authenticated in that conversation; your own address is set as the reply address only after you confirm it with a one-time code.
• Bounded execution — per-job and per-retailer exposure caps, velocity limits and counterparty scope set and versioned by the Merchant.
• Environment separation — production runs on its own database project; development and tests use separate projects and development stores; no production data in development.
• Access control — production access limited to the operator, with multi-factor authentication on every provider account; role-based access (owner / admin / operator) inside the App; identity resolution fails closed.
• Logging — an audit log of every critical change visible to the Merchant; telemetry carries identifiers only, never names, addresses, subjects or bodies.
• Minimisation and retention — only the fields in Annex I; retention periods in the privacy policy; deletion per §10.
• Incident response — the written policy in §8; quarterly credential-rotation drills.

Annex III — Sub-processors

Not sub-processors. Your system of record — Shopify Inc., Zoho Corporation Pvt. Ltd. for a Zoho Inventory + Books organisation, or Unleashed for an Unleashed organisation — and your mailbox provider are your own platforms and independent parties to this DPA (§2). We do not engage them; you do, and Personal Data reaches them on your instruction and under your agreement with them. They are named here because a reader looking for them should find them, not because they are engaged by us. Your Zoho organisation stays in the Zoho data centre it is already in; we call only the regional host that answered your authorisation and hold no copy of your Estimates, Sales Orders, invoices, packages or shipments. From an Unleashed organisation we keep a copy of your customers (with their contacts’ names and email addresses and their delivery addresses) and your products while it is connected; the copy is erased when you disconnect it, and the retailers, contacts and addresses derived from it stay as your workspace’s record until you ask us to erase them (§10). We hold no copy of your sales orders, shipments or invoices, which are read when a question needs them.

Annex IV — United States state privacy laws

To the extent the CCPA/CPRA or another US state privacy law applies, we are your service provider / processor. We will not sell or share Personal Data; will not retain, use or disclose it for any purpose other than providing the App; will not combine it with Personal Data from other sources except as permitted for a service provider; will notify you if we can no longer meet these obligations; and grant you the right to take reasonable steps to stop and remediate unauthorised use. We certify that we understand these restrictions.

Contact

support@orderjay.com

Shopify, Zoho and Unleashed are trademarks of their owners. Naming them describes the systems the App works with; it does not imply their endorsement.