This Data Processing Addendum (“DPA”) is incorporated into the DirectSnail Terms of Service between the Shopify merchant using DirectSnail (“Merchant”) and DirectSnail. It applies when DirectSnail processes Personal Data for the Merchant.
1. Definitions and roles
“Data Protection Law” means privacy and data-protection laws applicable to the processing, including the GDPR where applicable and United States state privacy laws. “Personal Data,” “process,” “controller,” “processor,” “business,” and “service provider” have the meanings given by applicable Data Protection Law.
The Merchant is the controller or business for its customer Personal Data. DirectSnail is the processor or service provider and will process Personal Data only on the Merchant’s documented instructions, including instructions communicated through configuration and use of the service.
2. Processing details
| Subject matter | Creating, addressing, printing, delivering, suppressing, tracking, and measuring merchant-directed postal campaigns. |
|---|---|
| Duration | For the term of the Merchant’s use of DirectSnail and the limited retention periods needed to provide the service, honor suppressions, meet legal obligations, and complete deletion. |
| People | Merchant personnel, Shopify customers selected or evaluated for campaigns, postcard recipients, and people making support or opt-out requests. |
| Personal Data | Names, postal addresses, Shopify customer identifiers, limited purchase attributes used for segmentation, campaign membership, postal delivery events, and order-attribution records. |
| Purpose | Providing DirectSnail according to Merchant instructions. DirectSnail does not sell Personal Data or use it for cross-merchant advertising or profiling. |
3. DirectSnail obligations
DirectSnail will:
- Process Personal Data only to provide the service, comply with documented lawful instructions, or meet a legal obligation.
- Not sell or share Personal Data for cross-context behavioral advertising; retain, use, or disclose it outside the business purposes in this DPA; or combine it with personal data received from another business except as permitted by law to provide the service.
- Ensure personnel with access are subject to appropriate confidentiality obligations.
- Maintain reasonable administrative, technical, and organizational safeguards appropriate to the processing.
- Notify the Merchant if, in our reasonable opinion, an instruction infringes applicable Data Protection Law.
4. Merchant obligations
The Merchant will provide lawful instructions, obtain any required notices or permissions, use the service consistently with Data Protection Law, and avoid supplying Personal Data not needed for the service. The Merchant is responsible for the lawfulness and accuracy of its Shopify customer data, audience decisions, campaign content, and response to customer rights requests.
5. Security
DirectSnail’s safeguards include encrypted network transport, scoped authentication, tenant isolation, limited collection, access logging, signed webhook verification, fulfillment idempotency, and retention controls. DirectSnail regularly evaluates these measures and may update them without materially reducing overall protection.
6. Subprocessors
The Merchant authorizes DirectSnail to use subprocessors needed to provide the service. DirectSnail remains responsible for their processing under written obligations appropriate to the services they perform.
| Provider | Purpose | Primary processing |
|---|---|---|
| Lob | Address verification, printing, mailing, delivery events | United States |
| Railway | Application and database infrastructure | United States |
| Cloudflare | Artwork and application-asset storage through R2 | United States / global network |
Shopify provides the commerce platform, merchant authentication, source data, and billing under its separate relationship with the Merchant. DirectSnail will provide reasonable notice before adding a new subprocessor that materially processes customer Personal Data and will consider reasonable, substantiated objections.
7. Individual rights and assistance
Taking into account the nature of processing, DirectSnail will reasonably assist the Merchant with access, correction, deletion, restriction, objection, portability, and opt-out requests. If DirectSnail receives a request relating to Merchant-controlled Personal Data, we may direct the person to the Merchant and notify or assist the Merchant unless prohibited by law.
8. Security incidents
DirectSnail will notify the Merchant without undue delay after confirming a breach of security affecting Merchant Personal Data. The notice will include available information reasonably needed to understand the nature, likely consequences, affected data, and remediation. Notification is not an admission of fault.
9. Deletion and return
At the end of the services, DirectSnail will delete or return Merchant Personal Data as required by Data Protection Law and Shopify’s mandatory privacy workflows, except where retention is required by law or needed for limited security, financial, suppression, or backup purposes. Retained data remains protected and isolated from ordinary use.
10. Audits and information
DirectSnail will provide information reasonably necessary to demonstrate compliance with this DPA. Where that information is insufficient, the parties may agree to a proportionate audit subject to confidentiality, security, scope, timing, and cost protections. Audits may not expose another merchant’s data or compromise the service.
11. International transfers
If Data Protection Law requires a transfer mechanism for processing outside the originating jurisdiction, the parties will use the applicable standard contractual clauses or another legally recognized mechanism. DirectSnail will apply any required supplementary measures appropriate to the transfer.
12. Order of precedence and contact
If this DPA conflicts with the Terms of Service on the handling of Personal Data, this DPA controls. All other terms remain in effect. Privacy and data-processing questions can be sent to privacy@directsnail.com.