Data processing terms

These Data Processing Terms apply between Etail Depot US, Inc. and the merchant or software platform that expressly incorporates them into an accepted Service Order. They govern only the identified processing activities. They do not replace the privacy notice owed to an individual.

Before Etail processes personal information on your behalf, the Service Order or another record accepted by both parties must identify the purposes and duration, categories of information and people, each party’s responsibilities, authorized recipients, access locations, safeguards, retention and return or deletion. This processing record forms part of these terms and limits the processing to the activities it describes.

Personal information means information about an identified or identifiable person, as well as information protected as personal information under applicable law. Processing includes viewing information in a provider system and collecting, storing, using, sharing or deleting it. Each party’s responsibilities depend on its role in the agreed processing. Access to information alone does not make every provider Etail’s processor.

Etail staff can access merchant application documents, owner identity information and bank information in the provider system. That access does not itself authorize downloads, bank changes, consumer reports or other services.

Each party’s role depends on how it uses personal information and on applicable law. Etail follows the customer’s documented instructions for processing carried out on the customer’s behalf. A party that decides independently why information is used must have its own lawful basis and provide the required privacy notice.

The customer must have authority to provide the information and instructions. Neither party may use these terms to avoid its own statutory responsibilities.

When Etail processes information solely on a customer’s instructions, the customer is the controller or business and Etail is its processor or service provider, as applicable. The processing record must describe the agreed tasks, such as checking an application for completeness, making requested corrections or responding to account questions.

If Etail reasonably believes an instruction violates applicable law, it must notify the customer and suspend that instruction while the concern is resolved. If law requires other processing, Etail must notify the customer before acting unless notice is prohibited. Any compulsory disclosure must be limited to what is required and its legal basis documented. Each party remains responsible for the notices and authority required for its own activities.

Process information only for the recorded services, valid instructions or a legal duty. A legal requirement outside the instructions must be communicated where permitted. Restrict access to authorized people with a legitimate role and confidentiality obligations.

Review permissions when responsibilities change and remove access no longer needed. Exports, remote access and disclosures require a permitted purpose and appropriate controls. Do not copy customer information into unapproved personal accounts, public sharing locations or unrelated automated tools.

These terms do not authorize unrelated advertising, sale, biometric identification, unrestricted profiling or model training. A provider’s independent purposes must be described under its own role and governing terms; those purposes do not grant Etail equivalent use rights.

Where United States state privacy law applies and Etail acts as a processor, service provider or contractor, Etail acknowledges and agrees to comply with the duties attached to that role. The processing record must state the specific permitted business purposes.

Etail must not sell or share covered information as those terms are defined by the applicable law. Use, retention and disclosure are limited to those purposes and the direct service relationship, except as law permits. Combining covered information with other records is prohibited unless the applicable law allows it.

Etail must provide the protection required by that law and notify the customer if it determines that it cannot meet these obligations. The customer may take reasonable and appropriate steps to verify compliance and, upon notice, stop and remedy unauthorized use. Etail must assist with applicable individual requests. These duties also apply through written terms to processors Etail appoints for the covered work.

Where required, Etail certifies that it understands and will comply with the restrictions applicable to its role. Assistance includes applicable audits, risk assessments and automated decision requirements. A legal exemption applies only to the information and activity it covers; use of a financial provider does not exempt every account record.

Each party must implement and maintain safeguards appropriate to the information and its responsibilities, document those safeguards and require appropriate protection from people acting for it. The processing record must identify access controls, secure transmission and storage, incident handling and deletion arrangements.

A covered incident is an actual loss, unauthorized access, use, disclosure, alteration or destruction of the personal information governed by these terms. Investigation and notification duties apply to affected information within the party’s responsibility, including its appointed processors.

Notify the other party without undue delay after becoming aware of an incident affecting the covered information, subject to applicable law and any stricter agreed deadline. Provide available details about affected information, likely impact, investigation and mitigation, with further updates as information becomes available. Responsibility for regulatory and individual notices follows applicable law.

Each party must maintain a written security program appropriate to its activities and information risk. For Etail access, agreed safeguards must cover individual accounts, restricted permissions, multifactor authentication, protected devices, encrypted transmission and storage, access records, staff instruction, incident response and disposal. Any alternative must be documented, lawful and provide appropriate protection. Provider controls do not replace safeguards for Etail staff, devices or exports.

The processing record must describe the safeguards in place, who operates them and how they are checked. Etail must assess providers entrusted with information and require suitable written safeguards. A provider’s certification does not certify Etail’s systems or practices.

An initial incident notice must not wait for a complete investigation. Cooperate on containment, evidence preservation, recovery and required notices. Notification or cooperation is not an admission of fault. Costs follow responsibility and the accepted agreement, not an automatic charge to the customer.

Provider changes must follow the process in the agreed processing record. Etail must require equivalent privacy and security duties in its written contracts with appointed processors. Etail remains responsible to the customer for their covered processing as if Etail performed it itself, subject to the accepted service agreement and applicable law.

Etail must give at least 30 days’ advance notice before adding or replacing a processor it appoints, unless an urgent lawful requirement prevents that period. The customer may raise a reasonable data protection objection. The parties must resolve it or lawfully end the affected processing before the change where required. Independently acting banks and networks do not become Etail’s subprocessors under this clause.

Access outside the United States requires a lawful arrangement and any required notice or transfer measures. The processing record must identify the countries in which information may be stored or accessed.

For each authorized recipient, the processing record must identify its legal entity, who appoints it, its function and role, the information it can access, and the countries where it stores or accesses information. Etail must have written protection terms in place before an appointed processor receives information processed on the customer’s instructions. Linking to a provider’s public terms does not make that provider a party to this agreement or release Etail from its duties.

Any provider change procedure that differs from these terms must be expressly addressed in the agreement before acceptance. Services for United States merchants may involve access or storage outside the United States. Required transfer safeguards must cover the parties and processing involved; a provider’s certification or legal status does not extend to Etail.

Etail must promptly forward privacy requests about information it processes on the customer’s instructions to that customer, unless law requires a direct response. Each party must provide reasonable assistance with requests, security inquiries and legally required assessments using information within its control.

Respond lawfully to government requests. Limit disclosure and notify the other party where permitted. Reasonable evidence of compliance may be supplied through documentation and agreed review arrangements without exposing another customer’s confidential information or weakening security.

For information processed on a customer’s instructions, Etail may verify a requester’s identity or direct the request to the customer. Etail must not decide the customer’s response without lawful instructions, except as law requires. Etail handles requests about information it uses for its own purposes. Verification must protect other people’s information.

A confidentiality or audit restriction cannot defeat a legal obligation to provide further inspection or corrective action. Protect other customers’ records while supplying the evidence reasonably needed for a lawful, proportionate review.

When processing ends, Etail must return or delete information in accordance with the processing record and the customer’s lawful instructions, except for information required for a continuing obligation or legal retention. Etail must identify any retained categories, their purpose and access restrictions. Backups follow the documented deletion cycle. Retained information, including backups, remains protected after the service ends and until deletion, with access limited to the purpose requiring retention.

For each category of information, the parties must agree on a retention period or a measurable condition for deletion, the legal or service reason for retention, a review date and the deletion method. Each party must keep only the information needed for that purpose, document any legal hold and limit use accordingly. Identity and bank documents must not be kept indefinitely simply because they were once accessible.

The processing record must specify the format for returning information, the time allowed for return or deletion and the backup deletion cycle. Etail must document completion and any permitted exception. Removing account access does not delete the information. Independently acting recipients remain responsible for their own lawful retention.

These terms control the covered data processing if inconsistent with general service wording, subject to mandatory law. Fees, funding, liability and dispute resolution remain in the accepted Service Order and service terms unless expressly amended.

Only provider documents expressly incorporated into the accepted service agreement form part of this processing arrangement.

• Merchant privacy notice
• Security responsibilities

The processing record may be included in your Service Order or supplied as a separate schedule. Both parties must receive and accept it before the covered processing begins. It limits the purposes, information and activities covered. Changes require documentation and acceptance where applicable.

Access within a provider system does not by itself permit downloads, separate storage or onward disclosure. The agreed arrangements must describe actual safeguards and retention. An activity, recipient, location or use that has not been authorized is not permitted merely because account access is available.

Parties and account

The arrangements identify Etail Depot US, Inc., your business or platform, the service and the account concerned.

People and information

You must be told which representatives, owners or other people are affected, which information and document types are involved, and their sources. Access to application, identity and bank documents does not authorize access to other information.

Activities and roles

Each agreed task is limited by its purpose, duration, information, your instructions and the parties’ roles. Any independent use must be identified separately with its applicable privacy notice.

Systems and permissions

The agreed arrangements identify the systems and operators, authorized staff actions, access controls, and any permitted download or separate storage.

Recipients and locations

You must receive the identity and role of each recipient, who appoints it, the service and information involved, and the countries of storage or access. Applicable document versions and the change notice procedure must be provided.

Safeguards and incidents

The arrangements describe the safeguards in place and who operates and verifies them. They identify incident response responsibilities, secure contacts, provider escalation and applicable notice duties and deadlines.

Retention and deletion

Retention is limited by the category, purpose, legal or service basis, approved period or deletion condition, and review date. You must receive the applicable return format, completion period, backup deletion cycle and legal hold arrangements. Completion and lawful exceptions must be documented.

Notices and requests

You must receive the applicable privacy information for the service and at collection, including how requests are handled, applicable rights and exemptions, and notices from independently acting providers.

Acceptance and changes

Both parties must receive the version accepted by their authorized representatives, including its date and any approved changes. Later versions do not silently replace the accepted arrangements.

Send legal notices and questions to compliance@etaildepot.com or Etail Depot US, Inc., 2001 L Street NW, Suite 500, Washington DC 20036, United States. Identify your business, service and the document concerned. Do not send identity documents, passwords or complete bank or card numbers by ordinary email.

• Contact compliance