Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Service ("Agreement") between ShipStream, LLC ("ShipStream," "Processor," "we," or "us") and the customer ("Customer," "Controller," or "you") using the ShipStream Data Border service ("Service").

This DPA sets forth the parties' obligations with respect to the processing of Personal Data in connection with the Service.

1. Definitions

"Applicable Data Protection Law" means all laws and regulations applicable to the processing of Personal Data, including the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), and other applicable U.S. state privacy laws.

"Controller" means the entity that determines the purposes and means of processing Personal Data. For purposes of this DPA, Customer is the Controller of Customer Personal Data.

"Customer Personal Data" means any Personal Data that ShipStream processes on behalf of Customer in connection with the Service.

"Data Subject" means an identified or identifiable natural person whose Personal Data is processed.

"Personal Data" means any information relating to an identified or identifiable natural person, including information that constitutes "personal information" under the CCPA.

"Process" or "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, or deletion.

"Processor" means the entity that processes Personal Data on behalf of the Controller. For purposes of this DPA, ShipStream is the Processor of Customer Personal Data.

"Security Incident" means any accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data.

"Service Provider" has the meaning given under the CCPA and refers to ShipStream's role in processing Personal Data on behalf of Customer.

"Subprocessor" means any third party engaged by ShipStream to process Customer Personal Data.

2. Scope and Applicability

2.1 Scope

This DPA applies to the processing of Customer Personal Data by ShipStream in connection with providing the Service.

2.2 Relationship to Agreement

This DPA supplements and forms part of the Agreement. In the event of a conflict between this DPA and the Agreement, this DPA shall prevail with respect to the processing of Personal Data.

2.3 Customer as Controller

Customer is the Controller of Customer Personal Data and determines the purposes and means of processing. ShipStream processes Customer Personal Data only as a Processor on behalf of Customer.

3. Details of Processing

3.1 Categories of Data Subjects

Customer Personal Data may relate to the following categories of Data Subjects:

Recipients of shipments (Amazon order recipients)
Customer's employees and representatives
Customer's end clients (for SaaS Provider customers)

3.2 Categories of Personal Data

The following categories of Personal Data may be processed:

Category	Examples
Contact Information	Name, shipping address, phone number, email address
Order Information	Order identifiers, tracking numbers
Account Information	Customer contact name, email, phone, billing address
Usage Data	Label request logs, timestamps, IP addresses

3.3 Sensitive Personal Data

The Service is not designed to process sensitive personal data (such as health information, financial account numbers, or government identifiers). Customer shall not submit sensitive personal data to the Service.

3.4 Processing Purposes

ShipStream processes Customer Personal Data solely for the following purposes:

Retrieving and delivering shipping labels from Amazon's SP-API
Maintaining audit logs as required by Amazon's Data Protection Policy
Providing customer support
Billing and account management
Service improvement and analytics (using aggregated, anonymized data)

3.5 Duration of Processing

ShipStream will process Customer Personal Data for the duration of the Agreement, plus any retention periods specified in Section 6.

4. Obligations of ShipStream (Processor)

4.1 Processing Instructions

ShipStream shall:

Process Customer Personal Data only in accordance with Customer's documented instructions, unless required by law
Inform Customer if, in ShipStream's opinion, an instruction violates Applicable Data Protection Law
Not process Customer Personal Data for any purpose other than providing the Service

Customer's instructions are documented in this DPA, the Agreement, and any written instructions provided by Customer.

4.2 Confidentiality

ShipStream shall:

Ensure that personnel authorized to process Customer Personal Data are bound by confidentiality obligations
Limit access to Customer Personal Data to personnel who need access to perform the Service

4.3 Security Measures

ShipStream shall implement and maintain appropriate technical and organizational measures to protect Customer Personal Data, including:

Technical Measures:

Encryption of data in transit (TLS 1.2+)
Encryption of data at rest
Access controls and authentication
Logging and monitoring of access
Regular security assessments
Vulnerability management
Intrusion detection

Organizational Measures:

Security policies and procedures
Employee security training
Background checks for personnel with data access
Incident response procedures
Business continuity planning

4.4 Subprocessors

ShipStream may engage Subprocessors to process Customer Personal Data, subject to the following conditions:

ShipStream maintains an up-to-date list of Subprocessors (see Section 5)
ShipStream enters into written agreements with Subprocessors imposing data protection obligations no less protective than this DPA
ShipStream remains liable for the acts and omissions of its Subprocessors
Customer may object to new Subprocessors as described in Section 5.3

4.5 Data Subject Requests

ShipStream shall:

Promptly notify Customer of any request received directly from a Data Subject
Not respond to Data Subject requests directly, unless authorized by Customer
Provide reasonable assistance to Customer in responding to Data Subject requests, taking into account the nature of the processing

4.6 Assistance with Compliance

ShipStream shall provide reasonable assistance to Customer with:

Responding to Data Subject requests (access, deletion, correction)
Data protection impact assessments (if required)
Consultations with regulatory authorities (if required)
Demonstrating compliance with Applicable Data Protection Law

Assistance may be subject to reasonable fees for work beyond the normal scope of the Service.

5. Subprocessors

5.1 Authorized Subprocessors

Customer authorizes ShipStream to engage the following Subprocessors:

Subprocessor	Purpose	Location	Data Processed
Fly.io, Inc.	Application hosting	United States	All Service data
Tigris Data, Inc.	Object storage	United States	Shipping labels (temporary)
Stripe, Inc.	Payment processing	United States	Billing information
Resend, Inc.	Email delivery	United States	Email addresses, notifications

5.2 Subprocessor Obligations

ShipStream shall:

Enter into written agreements with each Subprocessor that impose data protection obligations consistent with this DPA
Ensure Subprocessors implement appropriate security measures
Remain liable for the acts and omissions of Subprocessors

5.3 Changes to Subprocessors

ShipStream shall:

Maintain an up-to-date list of Subprocessors at shipstream.io/legal/subprocessors
Notify Customer at least thirty (30) days before engaging a new Subprocessor
Provide Customer the opportunity to object to new Subprocessors on reasonable grounds

If Customer objects to a new Subprocessor and ShipStream cannot reasonably accommodate the objection:

Customer may terminate the affected portion of the Service
ShipStream will refund any prepaid fees for the terminated period
No other liability shall arise from such termination

6. Data Retention and Deletion

6.1 Retention Periods

ShipStream retains Customer Personal Data for the following periods:

Data Category	Retention Period	Reason
Shipping Labels	30 days	Operational (reprint, troubleshooting)
Audit Logs	3 years	Amazon DPP compliance
Account Information	Duration of Agreement + 3 years	Legal compliance
Billing Records	7 years	Tax and accounting requirements

6.2 Deletion Upon Termination

Upon termination of the Agreement:

ShipStream will delete or anonymize Customer Personal Data within thirty (30) days, except for data that must be retained for legal compliance
Customer may request a copy of Customer Personal Data before deletion (subject to technical feasibility)
ShipStream will provide written confirmation of deletion upon request

6.3 Return of Data

Upon Customer's written request prior to termination, ShipStream will provide Customer with a copy of Customer Personal Data in a commonly used, machine-readable format, to the extent technically feasible.

7. Security Incident Response

7.1 Notification

ShipStream shall notify Customer of any Security Incident without undue delay, and in no event later than seventy-two (72) hours after becoming aware of the incident.

7.2 Notification Contents

Security Incident notifications shall include, to the extent known:

Description of the nature of the incident
Categories and approximate number of Data Subjects affected
Categories and approximate number of records affected
Name and contact details of ShipStream's point of contact
Likely consequences of the incident
Measures taken or proposed to address the incident

7.3 Cooperation

ShipStream shall:

Cooperate with Customer in investigating and responding to Security Incidents
Preserve evidence related to the incident
Provide reasonable assistance with Customer's notifications to Data Subjects or regulators
Not notify Data Subjects or regulators directly without Customer's prior written consent (unless required by law)

7.4 Documentation

ShipStream shall document Security Incidents, including facts, effects, and remedial actions taken, and make this documentation available to Customer upon request.

8. Audits and Assessments

8.1 Audit Rights

Customer may audit ShipStream's compliance with this DPA, subject to the following conditions:

Audits shall be conducted no more than once per year, unless a Security Incident has occurred
Customer shall provide at least thirty (30) days written notice
Audits shall be conducted during normal business hours
Customer shall bear the costs of any third-party auditors
Auditors must execute reasonable confidentiality agreements

8.2 Audit Alternatives

In lieu of an on-site audit, ShipStream may, at its discretion:

Provide Customer with relevant certifications (e.g., SOC 2 Type II report)
Provide responses to a reasonable security questionnaire
Provide documentation of security practices and controls

8.3 Confidentiality of Audit Results

Audit results and any information obtained during an audit shall be treated as ShipStream's confidential information and shall not be disclosed to third parties without ShipStream's prior written consent.

9. CCPA-Specific Provisions

9.1 Service Provider Certification

ShipStream certifies that it:

Understands and will comply with the CCPA requirements applicable to Service Providers
Will not sell Customer Personal Data
Will not retain, use, or disclose Customer Personal Data for any purpose other than providing the Service, as permitted under the CCPA
Will not retain, use, or disclose Customer Personal Data outside of the direct business relationship with Customer
Will not combine Customer Personal Data with personal information received from other sources, except as permitted by the CCPA

9.2 Assistance with CCPA Requests

ShipStream shall assist Customer in responding to CCPA requests from consumers, including requests to:

Know what personal information has been collected
Delete personal information
Correct inaccurate personal information
Opt out of the sale or sharing of personal information (not applicable, as ShipStream does not sell or share)

9.3 Notification of Inability to Comply

If ShipStream determines that it can no longer meet its obligations under the CCPA, ShipStream shall:

Promptly notify Customer
Take reasonable steps to remediate the non-compliance
Cease processing Customer Personal Data if remediation is not possible

10. Liability and Indemnification

10.1 Liability

Each party's liability under this DPA is subject to the limitations of liability set forth in the Agreement.

10.2 Customer Indemnification

Customer shall indemnify and hold harmless ShipStream from claims arising from:

Customer's violation of Applicable Data Protection Law
Customer's processing of Personal Data in violation of this DPA
Customer's instructions that violate Applicable Data Protection Law

10.3 ShipStream Indemnification

ShipStream shall indemnify and hold harmless Customer from claims arising from:

ShipStream's violation of Applicable Data Protection Law
ShipStream's processing of Personal Data in violation of this DPA
Security Incidents caused by ShipStream's failure to implement appropriate security measures