Data Processing Agreement (DPA)

Last updated: 26 May 2026 · Version 0.1

What this is. UK and EU GDPR (Art. 28) require a written agreement whenever one party (a “processor”) handles personal data on behalf of another (a “controller”). When you use Unified Orders to manage data about your customers’ buyers, you are the controller and we are the processor. This document is that agreement. It is incorporated into our Terms of Service by reference.

1. Parties

This DPA is between:

“Customer” (the controller) — the legal entity that has agreed to our Terms of Service.
“Unified Orders” (the processor) — defined in section 1 of the Terms of Service.

2. Subject matter, duration, nature, and purpose of processing

Subject matter: personal data of the customer’s end-buyers and counterparties, flowing through the customer’s connected sales channels into the Unified Orders platform.
Duration: for as long as the customer has an active account, plus any post-termination data export window agreed under the Terms of Service.
Nature: hosted software-as-a-service for order management, inventory, listings, buyer messaging, warehouse operations, and analytics derived from the above.
Purpose: to provide the contracted service to the customer in accordance with the customer’s documented instructions (their use of the platform).

3. Categories of data subjects and personal data

3.1 Data subjects

End buyers / customers of the customer.
Senders and recipients of buyer messages.
Shipping recipients (where different from the buyer).

3.2 Categories of personal data

Identifiers: names, usernames, channel buyer IDs, email addresses, phone numbers.
Address data: shipping and billing addresses including country, region, city, postcode, and street.
Transactional data: orders, items, prices, tracking numbers, refunds, dispatch dates.
Communications: subject and content of messages between the customer and the buyer, including email bodies, attachments, and channel-relayed messages.
Derived data: sentiment classification, intent classification, and similar machine-generated signals.

3.3 Special category data

Unified Orders is not designed to process special-category personal data (Article 9 GDPR) or criminal-conviction data (Article 10 GDPR). The customer must not deliberately upload such data to the platform.

4. Roles and instructions

The customer is the controller. Unified Orders is a processor. Unified Orders will process personal data only on the customer’s documented instructions, which include:

The Terms of Service and this DPA.
The customer’s use of the platform (configurations, channel connections, rules, exports, deletions).
Written instructions provided to privacy@unifiedorders.com.

Where Unified Orders is required by law to process personal data outside the customer’s instructions, it will notify the customer first unless that law prohibits notification.

5. Confidentiality

Unified Orders ensures that personnel authorised to process personal data are bound by appropriate confidentiality obligations.

6. Security measures

Unified Orders implements technical and organisational measures appropriate to the risk, including those described in section 11 of the privacy policy. In summary:

Encryption of credentials at rest (AES-256-GCM).
Encryption in transit (TLS).
Multi-factor authentication available for all user accounts.
Bcrypt-hashed passwords.
Audit logging of state-changing actions and accesses to buyer personal data.
Tenant isolation enforced at the application layer.
Automated PII scrubbing 30 days after order dispatch.
Regular review and update of security controls.

7. Sub-processors

The customer authorises Unified Orders to engage the sub-processors listed at /sub-processors. Unified Orders will:

Impose contractual data-protection obligations on each sub-processor at least equivalent to those in this DPA.
Remain responsible to the customer for the acts and omissions of its sub-processors as if they were its own.
Give the customer at least 30 days’ notice of any new or replacement sub-processor that processes personal data, by email and by updating /sub-processors.
If the customer objects to a new sub-processor on reasonable data-protection grounds, the parties will work in good faith to find an alternative. If none can be agreed, the customer may terminate the affected service with no further fees becoming due.

8. International transfers

Personal data may be transferred outside the UK and EEA in the course of providing the service. Unified Orders relies on the following transfer mechanisms:

UK adequacy decisions and the EU-US Data Privacy Framework where applicable.
Standard Contractual Clauses (Module 2 or 3, as appropriate) with the UK Addendum where required.
The sub-processor’s own DPA where it incorporates equivalent safeguards.

Where AI processing is involved and the customer has not nominated a specific AI provider, requests may be routed via OpenRouter to downstream providers in additional jurisdictions. The customer is responsible for configuring AI provider settings appropriately for their own compliance position, as set out in section 7 of the privacy policy.

9. Assistance to the controller

Unified Orders will assist the customer (taking into account the nature of the processing and the information available) with:

Responding to data subject access, rectification, erasure, restriction, portability, and objection requests.
Carrying out Data Protection Impact Assessments where required by Art. 35 GDPR.
Notifying personal data breaches without undue delay (and in any event within 72 hours of becoming aware of a notifiable breach).
Consultations with supervisory authorities (e.g. the ICO).

10. Personal data breaches

Unified Orders will notify the customer at the contact email on file without undue delay (and in any event within 72 hours) of becoming aware of a personal data breach affecting the customer’s data. The notification will include the information required by Art. 33(3) GDPR to the extent then known, and Unified Orders will provide updates as the investigation progresses.

11. Audits

On reasonable written request, Unified Orders will make available to the customer the information necessary to demonstrate compliance with this DPA, and will allow for and contribute to audits, including inspections, conducted by the customer or another auditor mandated by the customer.

Such audits will be limited to one per calendar year, performed during normal business hours with reasonable notice, conducted in a manner that does not unreasonably interfere with Unified Orders’ operations, and at the customer’s expense. Independent third-party audit reports may be provided in lieu of an on-site inspection where they reasonably address the customer’s concerns.

12. Return or deletion of personal data

On termination of the service, the customer may export personal data within the export window set out in the Terms of Service. After that window, Unified Orders will delete or anonymise personal data within 90 days, except where retention is required by law or for the assertion or defence of legal claims.

13. Conflicts

In the event of any conflict between this DPA and the Terms of Service, this DPA prevails to the extent of the conflict and only in relation to personal data.

Contact

DPA enquiries: privacy@unifiedorders.com.