ReadyPO Data Processing Agreement

Version: 2026-10-30-v1. Published October 30, 2026; effective for a merchant upon valid acceptance. This DPA forms part of the ReadyPO Merchant Terms between B2B Commerce Tools LLC (Provider) and the accepting merchant (Merchant). The completed agreement record identifies the parties, business addresses, contacts, store, accepted version and acceptance date.

1. Scope, roles and instructions

This DPA applies to personal data Provider processes on Merchant's behalf through ReadyPO (Merchant Data). Merchant ordinarily acts as controller and Provider as processor. If Merchant acts as processor for another controller, Provider acts as subprocessor and Merchant must have the controller's authority to appoint Provider and the listed providers, give instructions and enter applicable transfer arrangements.

Provider shall process Merchant Data only on documented lawful instructions to provide, secure and support ReadyPO, including Merchant's authorized service settings and actions and verified written instructions through support. Provider shall inform Merchant if an instruction appears to violate applicable data-protection law. If legally required to process otherwise, Provider shall notify Merchant beforehand unless the law prohibits notice.

Processing for Provider's own business administration, billing, legal obligations or separately identified security purposes is governed by applicable law and the Privacy Policy to the extent Provider acts as an independent controller. This does not authorize unrelated use of PO contents.

2. Processing schedule

3. Purpose limits and confidentiality

Provider shall not sell Merchant Data, use it for unrelated profiling or cross-context behavioral advertising, or voluntarily enable AI model-training sharing contrary to the agreed purposes. Authorized personnel and service identities shall have access only for an authorized purpose. People with access must be subject to appropriate confidentiality obligations.

Merchant remains responsible for its notices, lawful basis, instructions, staff access and review/automation settings. These responsibilities do not excuse Provider's own obligations.

4. Security measures

Provider shall maintain technical and organizational measures appropriate to the nature and risk of processing, including:

• Authenticated Shopify merchant/buyer access and tenant/customer access boundaries.
• Restricted operator and service-identity access, strong unique operator passwords where used and MFA for relevant operator accounts.
• HTTPS, encrypted database transport for runtime and migrations, and provider-managed database/recovery encryption.
• Signed webhook verification, expiring original-file access capabilities, protected exports and bounded access-event records.
• Required TLS and certificate validation for governed outbound Mailgun delivery.
• Purpose-limited AI requests with response storage disabled through store:false and voluntary sharing disabled in the designated account.
• Verified privacy-request handling, tenant-scoped record identification/export/erasure and review of ambiguous or shared records before disclosure/deletion.

These measures do not promise end-to-end email encryption, exclusive geographic residency, Zero Data Retention at every provider, uninterrupted operation, perfect security or an independent certification. Provider shall assess controls and maintain incident, recovery and deletion procedures appropriate to its obligations.

5. Subprocessors and other services

Merchant gives general written authorization for the service providers identified below, within their stated processor/subprocessor scope. Where Merchant is a processor, it confirms the required controller authorization. Provider shall impose appropriate written data-protection obligations and remain responsible for its subprocessors as required by applicable law and transfer terms.

Provider may obtain updated provider details through its applicable contracts and shall make information needed to demonstrate compliance available to Merchant. A provider's own downstream processing remains subject to applicable authorization, protection and transfer requirements.

Mailgun/Sinch terms identify certain communications transmission, security and compliance activities as independent-controller processing. That scope is not represented as processing solely on Merchant's instructions. Shopify's own commerce-platform relationship with Merchant is distinct from Provider's instructed API processing; an app erase cannot erase independent Shopify records or recall delivered recipient messages.

For a planned appointment or replacement of a direct subprocessor under Provider's control, Provider shall give at least 30 days' advance notice and sufficient information and opportunity to object on data-protection grounds before engagement. Provider shall promptly forward relevant downstream-provider notices and assist with objections within applicable windows. This does not waive or replace mandatory prior authorization, advance notice or objection rights, including applicable SCC requirements.

Provider shall assess timely objections, seek a reasonable alternative or mitigation, and suspend or end the affected processing where no lawful resolution is available. Urgent changes must be lawful, limited to necessary scope and notified as soon as practicable. A provider's shorter notice period does not excuse Provider from an applicable longer obligation.

6. Rights and compliance assistance

Taking account of the processing and information available, Provider shall assist Merchant with applicable individual rights, security obligations, breach reporting, impact assessments and regulatory consultation.

Provider shall route direct individual requests to Merchant promptly unless instructed or legally required to handle them differently. It shall verify authority before disclosure or deletion, protect unrelated records and explain unresolved shared-record issues. Support requests may be sent to support@b2bcommercetools.com.

For rights assistance, Provider shall identify relevant tenant-scoped records, provide an appropriately restricted return/export or perform authorized erasure, and report the outcome and any lawful retention or unresolved limitations. Merchant acting as processor shall promptly relay relevant information to its controller and communicate authorized controller instructions.

7. Personal-data breaches

Provider shall notify Merchant without undue delay after becoming aware of a personal-data breach affecting Merchant Data, as required by applicable law. It shall provide available information about the nature and scope, likely consequences, contact point, containment and remediation, with updates as information becomes available, and reasonably assist Merchant's required notifications.

8. Return, retention and deletion

At the end of processing, Provider shall, at Merchant's lawful choice, return or delete Merchant Data and delete copies unless applicable law requires retention. Provider shall agree a practical secure return method and handle a verified request without undue delay in accordance with applicable law and instructions, explaining the status and any lawful retention.

Ordinary PO history is retained until Merchant deletion or applicable erasure. Prepared privacy exports expire after 30 days; security access events after 90 days, subject to applicable erasure and documented exceptions. Personal information in resolved support cases shall be removed within 90 days after resolution, with documented exceptions for legal, security or active-dispute needs. These schedules do not override valid termination or deletion duties.

Limited recovery copies may persist until expiry, protected from normal use. The inspected Render recovery window is three days. Provider shall apply relevant erasures before normal service resumes after a restore. Customer-controlled support-case removal and service-provider protected backend deletion/recovery lifecycles are distinct; Provider shall accurately describe remaining copies, expiry and lawful retention rather than certify immediate erasure of every provider copy.

Previously delivered recipient messages and independently held Shopify records are not recalled by app-database deletion. Provider shall identify the applicable scope and assistance.

9. Information, audits and liability

Provider shall make available information needed to demonstrate compliance with applicable processor obligations and allow and contribute to lawful audits and inspections by Merchant or its appointed auditor. Reasonable confidentiality, notice and security arrangements may protect other tenants and secrets but must not prevent mandatory rights or regulator access.

The single aggregate liability cap and damages exclusion in Merchant Terms section 9 apply to claims between Provider and Merchant to the extent permitted. They do not override applicable transfer clauses, non-waivable rights, individual/regulatory remedies or mandatory liability.

10. International transfers

ReadyPO is operated from the United States and uses the providers described above. Provider shall process or transfer Merchant Data internationally only in accordance with lawful instructions and an applicable lawful mechanism.

Where the conditions for reliance on the SCCs in the Annex to Commission Implementing Decision (EU) 2021/914 are satisfied and a covered restricted transfer requires them, those unmodified SCCs form part of this DPA with the selections in Schedule A. No clause expands the instrument beyond its lawful scope. Where the instrument is inapplicable or cannot be fulfilled, the parties must establish another lawful arrangement before the affected transfer proceeds.

For covered UK restricted transfers relying on the UK Addendum, the ICO International Data Transfer Addendum B1.0, in force 21 March 2022, including its mandatory clauses and permitted revisions, forms part of this DPA with Schedule B. For Swiss-covered transfers relying on recognised SCCs, Schedule C applies. The applicable transfer record and assessment must be completed before reliance.

Provider shall cooperate with applicable transfer assessments and keep relevant information current. If it cannot comply with an applicable transfer instrument, it shall notify Merchant and suspend affected processing as the instrument requires. Contract acceptance alone does not establish that a required assessment has been completed.

Schedule A: EU SCC selections and appendix mapping

• Module two applies where Merchant is controller and Provider processor; module three where Merchant is an authorized processor and Provider subprocessor.
• Optional Clause 7 docking is omitted. The optional independent dispute-resolution-body provision in Clause 11 is omitted; mandatory remedies remain.
• Clause 9(a), Option two, general written authorization applies to the agreed subprocessor list. The specified notice period for Provider's direct appointments is 30 days. Mandatory requirements and controller authority/notice for module three are preserved.
• Clause 17, Option one: Irish law. Clause 18(b): courts of Ireland. Mandatory individual rights and other permitted proceedings remain. These provisions apply to the SCCs; Merchant Terms' Wisconsin provision governs the ordinary service agreement subject to its stated exceptions.
• Annex I.A is the completed agreement record: Merchant legal name/address/contact/role, Provider B2B Commerce Tools LLC/address/privacy contact, relevant service activities, binding acceptance and date. Provider privacy contact is Taylor Simpson, Owner, support@b2bcommercetools.com.
• Annex I.B is section 2 together with section 8's retention criteria and the identified transfer in the completed transfer record.
• Annex I.C identifies the competent supervisory authority under Clause 13 from the actual exporter's establishment, representative or other applicable facts, in the completed transfer record.
• Annex II consists of the specific measures in section 4 and assistance measures in section 6.
• The section 5 agreed list supports general authorization. Where specific authorization is separately required/agreed, complete Annex III and obtain it before engagement.

The parties shall complete and preserve the relevant transfer record and assessment with their agreement. The mandatory SCC text, including Clauses 14-16, is not amended by these selections or other DPA clauses.

Schedule B: UK Addendum tables

Table 1: The start date is the valid acceptance date for the applicable completed arrangement. Exporter/importer identities, registered addresses, relevant registration numbers if any and key contacts are those in the completed agreement/transfer record.

Table 2: The Approved EU SCCs are those in Decision 2021/914 with module two or three as applicable; Clause 7 omitted, Clause 11 optional redress omitted, Clause 9(a) general authorization and the applicable 30-day period described above. Module four's combined-data question does not apply.

Table 3: Appendix information is mapped by Schedule A to the completed party/transfer record and sections 2, 4, 5, 6 and 8. UK adaptations replace the EU supervisory authority with the Information Commissioner and do not use EU Clause 13/Annex I.C.

Table 4: Both Exporter and Importer may exercise the narrowly conditioned termination right in mandatory section 19. The Addendum's default England and Wales law/courts apply. Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses. Mandatory revision, hierarchy and individual rights are preserved.

Schedule C: Swiss transfers

For transfers governed by the Swiss Federal Act on Data Protection of 25 September 2020 (FADP), the applicable module and selections in Schedule A apply with these adaptations:

• For the Swiss-law transfer arrangement, references to the GDPR mean the FADP. Where GDPR also applies, the EU arrangement remains separate and unmodified.
• Annex I.C designates the Swiss Federal Data Protection and Information Commissioner (FDPIC) for FADP transfers. An applicable EU authority retains parallel competence for GDPR transfers.
• Swiss law governs contractual claims concerning the Swiss arrangement, and the courts of Zurich, Switzerland, hear disputes between the parties. Mandatory rights and third-party beneficiary remedies remain.
• References to a Member State do not prevent a data subject habitually resident in Switzerland from enforcing rights before Swiss courts under Clause 18(c).
• The completed parties, transfer description, safeguards and provider authorization remain required. This schedule does not assert DPF certification or replace an applicable transfer assessment.

11. Precedence, notices and acceptance

Applicable mandatory transfer clauses prevail over conflicting commercial terms, including liability, forum and notice provisions. The UK Addendum's own hierarchy applies to UK transfers. This DPA otherwise controls conflicts about processing Merchant Data.

Material agreement changes follow Merchant Terms section 10.3; provider-change and mandatory transfer rights remain separate. The completed version, party details, document references and acceptance date shall be preserved. Existing merchants are not deemed to have accepted retroactively.

Contact: support@b2bcommercetools.com.