Data Processing Agreement

Last updated: August 2026

This DPA forms part of the agreement between [FOUNDER: company legal name] ("Return OS", the processor) and the merchant using the service (the controller). It applies wherever Return OS processes personal data of the merchant's customers on the merchant's behalf.

1. Subject matter and instructions

Return OS processes shopper personal data (email address, order number, ordered items, return reasons, free-text notes) solely to operate the merchant's return workflow: accepting requests, notifying the parties, and executing refunds the merchant approves. The merchant's configuration and actions in the dashboard are the documented instructions. Return OS processes no more data than this and for no other purpose.

2. Confidentiality and security

Store API credentials are encrypted at rest (libsodium secretbox) with a key held outside the database and its backups. All traffic is TLS. Access to production systems is limited to personnel who need it. Shopper-facing endpoints are rate-limited and abuse-protected.

3. Subprocessors

The merchant authorizes the subprocessors listed in the Privacy Policy. Return OS will update that list before adding a subprocessor; continued use of the service constitutes acceptance, and the merchant may terminate if they object.

4. Data subject rights

Return OS assists the merchant with access and erasure requests. Erasure anonymizes returns and order snapshots; financial records of executed refunds are retained without personal data, as permitted for compliance with legal obligations.

5. Retention and deletion

Shopper personal data is anonymized 180 days after a return reaches a terminal state. On termination of the merchant's subscription, personal data processed for the merchant is deleted or anonymized within 90 days, except where retention is legally required.

6. Breach notification

Return OS will notify affected merchants without undue delay after becoming aware of a personal data breach affecting their data, with enough detail to meet the merchant's own notification obligations.

7. Transfers

Primary processing and storage is in the EU (Germany). Where a subprocessor processes data outside the EU/EEA, transfers rely on standard contractual clauses or an adequacy decision.