Data Processing Annex

• Processor role: for the personal data described in Schedule A ("Merchant Data"), the Merchant is the controller and Pircel is the processor.
• Scope: this covers data that Pircel processes when the Merchant uses the Pircel platform, including through Pircel Shipping for Shopify and Pircel's other e-commerce plugins.
• Controller role: Pircel is a controller for its own account, billing, security and accounting data, as its Privacy Policy describes. This Annex doesn't cover that data.
• Couriers: couriers receive Merchant Data as independent controllers for the delivery. They process it for their own purposes, keep it under their own retention rules and statutory duties, and publish their own privacy notices.
• Google: Google receives address text for address checks as an independent controller, under its Maps Platform terms (EEA Terms of Service §4.5; Controller-Controller Data Protection Terms §4.1(a)). It isn't Pircel's sub-processor.

• Schedule A describes these, with the data and the data subjects.
• Processing lasts for the term of the Agreement, plus the period in clause 10.

• Documented instructions only: Pircel processes Merchant Data only on the Merchant's documented instructions, including for transfers to third countries. These are:
  • the Agreement and this Annex, including the retention periods in Schedule A;
  • the Merchant's settings in the Pircel dashboard and in Pircel's apps.
• Legal requirements: the exception is where EU or Member State law requires Pircel to process the data. Pircel then tells the Merchant first, unless that law forbids it.
• Infringing instructions: Pircel tells the Merchant at once if it thinks an instruction infringes data protection law, and may pause that instruction until the Merchant confirms or changes it.
• Retention periods: the period the Merchant sets for its recipients' details in its settings, from 7 to 60 months, is its documented instruction. The Merchant decides it as controller, for purposes of its own. Before a period over 24 months takes effect, the dashboard tells the Merchant that a period that long needs a purpose of the Merchant's own, and records the setting, its date and the user who chose it. That notice is Pircel's information under the bullet above. Saving the setting after it is the Merchant's confirmation.

• Only people who need Merchant Data for the service may access it.
• Each of them is bound by a written confidentiality obligation, or a statutory one.

• Pircel applies the measures in Schedule B.
• Pircel may update them, but must not lower the overall level of protection, except through clause 13.

• Authorisation: the Merchant gives general written authorisation for the sub-processors in Schedule C, and for later changes made under this clause.
• Notice of changes: Pircel gives as much notice as it receives of an added or replaced sub-processor, and at least 30 days where Pircel's own agreements allow. It updates its Sub-processors page and emails every Merchant's account contact. A subscription to page updates may be offered as well, never instead of the email.
• Notification address: the Merchant keeps its account contact's email address current.
• Objections:
  • The Merchant may object on reasonable data protection grounds within the notice period.
  • The new sub-processor doesn't process that Merchant's data until the objection is resolved or the Merchant ends the affected service.
  • Where that isn't possible, because the change is to hosting or to a database, Pircel says so in the notice, and the Merchant may end the affected service, with a refund of fees prepaid for it, before the change takes effect.
• Flow-down: Pircel binds each sub-processor by written terms at least as protective as those Pircel owes the Merchant under this Annex, and, for data received from Shopify, as those Pircel owes Shopify.
• Liability: Pircel stays liable to the Merchant for each sub-processor's performance.

Taking into account the nature of the processing and the information Pircel has, Pircel helps the Merchant:

• (a) Data subject requests: to answer requests under Chapter III GDPR.
  • The Merchant may ask Pircel for help with a request at privacy@pircel.com.
  • Requests the Merchant receives through Shopify also reach Pircel through the app, as Schedule A sets out. That is an additional channel, not the only one.
  • Requests sent to Pircel: Pircel forwards a request it receives directly to the Merchant, tells the person who sent it that it has done so, and doesn't answer it itself unless the Merchant instructs it to.
• (b) Articles 32–36: to meet its obligations on security, breach notification, impact assessments and prior consultation.
• Cost: Pircel helps with routine requests free of charge. For a request that is manifestly unfounded or excessive, in particular because it repeats, Pircel may charge a reasonable fee based on its costs, and tells the Merchant the fee before it starts.

• Notice: Pircel notifies the Merchant without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Merchant Data. Where Pircel cannot provide all the information in Article 33(3) within that period, it provides what it has and the remainder in phases without further undue delay.
• Merchant's decisions: the Merchant decides on notifying the supervisory authority and the data subjects. Pircel doesn't notify them for the Merchant unless the Merchant asks or the law requires it.

• Merchant Data is transferred outside the EEA only as Schedule C shows, and only under Chapter V GDPR.
• To Pircel's sub-processors: Pircel is the exporter. It relies on the EU–US Data Privacy Framework where the recipient is certified, and otherwise on the Standard Contractual Clauses (Decision (EU) 2021/914), Module Three.
• Rate quotes: a rate quote sends couriers no street, name or contact details, only what's needed to price the parcel, such as the postcode, town, region and country, so it transfers no Merchant Data outside the EEA.
• Bookings, through the Merchant's own courier account: the Merchant is the controller and the exporter of what it discloses to its courier, and Pircel transmits it as the Merchant's processor, on the Merchant's instruction to use that courier. The facts support this: the Merchant's own account and credentials, the Merchant's own agreement with the courier, and no carriage contract between Pircel and the courier. Where the courier entity that contracts with the Merchant is outside the EEA, the safeguard is the Merchant's to put in place, under its agreement with that courier. Each courier may transfer the data onward under its own arrangements.
• To Google, for address checks: Pircel discloses address text to Google LLC, an independent controller. The transfer relies on Google's own EU–US Data Privacy Framework certification and the Standard Contractual Clauses in its controller terms.

• The Merchant's choice: when the Agreement ends, the Merchant may ask Pircel, at privacy@pircel.com, to return Merchant Data or to delete it. Pircel does so within 30 days of the request. It keeps only its own charge records, which hold no names or contact details of the Merchant's customers.
• Otherwise: the retention periods in Schedule A keep applying after the end, and Merchant Data is deleted as they run out. Backups expire up to 8 days later.
• Confirmation: Pircel confirms the deletion in writing on request.
• During the term: Pircel applies the retention periods in Schedule A.

• Information on request: Pircel makes available the information needed to show compliance with Article 28. On request, at most once a year unless a breach or a supervisory authority requires more, Pircel:
  • answers a reasonable security questionnaire;
  • provides its hosting providers' current third-party reports (such as SOC 2 or ISO 27001), where they publish them. Pircel holds no certification of its own.
• Audits: where that information isn't enough, the Merchant, or an auditor it mandates who is bound by confidentiality, may audit, on 30 days' written notice, during business hours, and limited to the processing of Merchant Data.
• Cost: the Merchant bears the cost, unless the audit finds a material breach by Pircel.

• The cap: each party's total liability to the other, under this Annex and the Agreement together, is limited to the fees the Merchant paid Pircel in the 12 months before the event that gave rise to the claim. It's the one cap of the Customer Agreement, not a second one. It is never less than €250 and never more than €10,000. The same cap applies to Pircel and to the Merchant.
• What that means in euros:
  • a Merchant paying €40 a month has paid €480 in those 12 months, so the cap is €480;
  • a Merchant paying €15 a month has paid €180, so the floor applies and the cap is €250;
  • a Merchant paying €1,000 a month has paid €12,000, so the ceiling applies and the cap is €10,000.
• What the cap doesn't limit:
  • (a) harm caused intentionally or by gross negligence, by a party or by its staff, sub-processors or other helpers (Civil Code Art. 332(1) and 334(2));
  • (b) death, personal injury, or harm to health, liberty or honour (Art. 332(2));
  • (c) liability for defective products (Law 2251/1994 Art. 6(12));
  • (d) any other liability that applicable law doesn't allow to be excluded or limited, including in standard terms;
  • (e) breaches of confidentiality.
• The cap governs the claim that one party has against the other under Article 82(5) GDPR, after paying a data subject compensation for damage the other caused. It doesn't limit anyone's liability to data subjects under Article 82(1).
• On data protection matters, this Annex prevails over the rest of the Agreement. The SCCs, where they apply, prevail over this Annex.

• Pircel may change this Annex only for one of these reasons: a change in the law, or in a supervisory authority's guidance; a security need; or a new or changed service.
• A change that only adds protections, or that the law requires, takes effect on notice by email to the Merchant's account contact. It takes effect at least 30 days after the email, or sooner only where the law requires it. Any other change applies to a Merchant only once the Merchant accepts it, in the Pircel dashboard, as clause 10 of the Customer Agreement sets out. A Merchant that doesn't want a change may end the Agreement before it applies, at no cost.
• Every version is kept unchanged at a permanent dated address. Pircel records, for each Merchant account, each version the Merchant accepts and when. Until the Merchant accepts a later version, the version in force when its account was opened applies, or the one it last accepted.

• Rate quotes: the Merchant's privacy notice covers the price check at checkout, which happens before an order exists. It names Pircel as its processor, and says couriers may transfer data onward outside the EEA under their own arrangements. Pircel publishes a paragraph the Merchant may use, and shows it in the dashboard and in its emails.
• Special categories: the Merchant doesn't set up free-text fields that invite special categories of data, and tells shoppers not to enter such data.

• On a shopper's erasure request, Pircel removes the shopper's name, contact details, street address, notes and labels from their shipments, and keeps the rest of each shipment's record for the period Schedule A sets out.
• Article 17(3)(b) is the Merchant's to rely on, as controller. Pircel keeps a record under it only on the Merchant's instruction.
• For a live or foreseeable dispute (a lost parcel, a disputed cash-on-delivery amount, a chargeback), the Merchant may instruct Pircel to keep the details needed under Article 17(3)(e), for no longer than the limitation period for that claim.

• This Annex is published in Greek and in English.
• For a Merchant established in Greece, the Greek text is binding, and the English text is a translation for convenience.
• For any other Merchant, the English text is binding.
• A Merchant's place of establishment is the one recorded in its Pircel account. Where none is recorded, the Greek text is binding.

• Hosting: Heroku, Europe region; MongoDB Atlas in Paris. Pircel runs no servers of its own.
• Physical security: inherited from the hosting providers, and covered by their third-party reports.
• Encryption at rest: the database provider encrypts storage and its backups. The app also seals stored Pircel connection keys with its own key.
• Encryption in transit: TLS for all connections. Plain-HTTP requests are redirected to HTTPS, with HSTS.
• Network: Pircel's API runs on Heroku's managed platform. Its processes accept traffic only through Heroku's router and can't be reached directly. The database accepts only encrypted connections that present a valid database user and password.
• Staff access:
  • Access to production systems and Merchant Data is granted on a least-privilege basis, only to named individuals whose role requires it, through individual accounts protected by multi-factor authentication.
  • Access is reviewed at least every six months and revoked within one working day of a change of role or departure.
  • Shared accounts are not used.
  • Every staff account uses multi-factor authentication, and a password manager with a 16-character minimum.
  • The app's database users can read and write their own database only.
• Access logging: reads of shipment records are logged with who and when, using identifiers, not values. So are administrative actions: every change an administrator makes through the API, and every run of the shared data scripts, with who, when, the ids touched and the outcome, never the values sent. Pircel's software can only add entries to these logs, never change them, and they're removed automatically after 12 months. They're reviewed monthly by the security owner and the deputy. Direct edits in the database provider's own console aren't logged, because the database tier Pircel uses doesn't offer database auditing, so staff with direct access to the database could alter the logs without it being recorded.
• Detecting incidents: error monitoring emails alerts on high-priority issues, and a scheduled end-to-end test runs every 6 hours, with an alert if it doesn't complete. An hourly check alerts the security owner at once on a bulk read of personal data, a burst of refused sign-ins, or an administrative action outside 07:00–22:00 Athens time. Each alert has an owner and a deputy in the incident plan.
• Updates: dependencies (npm packages and GitHub Actions) are scanned weekly, with updates proposed automatically. Runtime versions are pinned.
• Data minimisation and data loss prevention:
  • the app reads only the order fields it needs;
  • error reports and logs are configured to exclude personal data, and the configuration is reviewed periodically;
  • logs record identifiers, not personal data values;
  • production data is never copied to test systems.
• Test and production separation: separate hosting, databases and app records; test systems use test courier accounts and test stores.
• Backups:
  • daily snapshots in production, of which the last 8 are kept;
  • restoration from a snapshot is tested twice a year;
  • Pircel keeps no other copies of production data. Data a Merchant exports from the dashboard, for example as CSV, is held by the Merchant.
• Staff: bound by written confidentiality, with periodic data protection training. Staff devices are encrypted, locked and kept updated.
• Review: Pircel reviews and tests these measures periodically.
• Incident response: a written plan with an owner and a deputy for each of three notices, and written criteria for when a breach is suspected:
  • to Shopify, within 24 hours of an actual or suspected breach of data from Shopify;
  • to the Merchant, as clause 8 sets out;
  • to the Hellenic Data Protection Authority, within 72 hours, where Pircel is the controller.
• Sub-processors: each one is bound by a data processing agreement.

Independent recipients (not sub-processors):

• the courier chosen for each shipment;
• FedEx and UPS:
  • for rate quotes, they receive no street, name or contact details, only what's needed to price the parcel, such as the postcode, town, region and country;
  • for bookings, through the Merchant's own account: FedEx through its Greek company, and UPS through UPS of Greece, Inc., a US company with a branch in Greece. The Merchant is the controller and exporter of what it discloses (clause 9), and each courier may transfer data onward under its own arrangements;
• Google LLC (Google Maps Platform: the Geocoding, Address Validation and Places APIs), for address checks and lookups: an independent controller under its Maps Platform terms (EEA Terms of Service §4.5; Controller-Controller Data Protection Terms §4.1(a)). United States, on Google's own Data Privacy Framework certification and the Standard Contractual Clauses in its controller terms;
• the Merchant's own Shopify store.