Data processing agreement

Draft. This agreement will be reviewed by a lawyer before launch and may still change. You accept it when you sign up. If the Dutch and English versions differ, the Dutch version prevails.

1. Roles

You (the customer) are the controller for the personal data of your own customers. Zendhal is the processor and only processes that data to ship your orders and handle returns.

2. Which data

Name, address, postal code, city, country and (if you send them) the email address and phone number of the recipient, plus the contents of the order.

3. Arrangements

• We only process the data on your instructions and according to this agreement.
• Everyone who can access the data is bound by confidentiality.
• We take appropriate security measures: encrypted connections, access only after logging in (admin access with two-step verification), each customer only sees their own data, and a log of admin actions.
• Sub-processors: see the privacy policy. We tell you about a new sub-processor in advance; you can object.
• Data stays in the EU.
• Liability is governed by article 12.4 of the terms.

4. Data breaches

We report a data breach without undue delay, and in any case within 48 hours of discovering it, with the information you need to report it to the Dutch Data Protection Authority.

5. Retention and deletion

We anonymise recipient addresses 2 years after shipping. After the agreement ends and the period in article 13.9 of the terms, we delete the data or return it to you, except what we are legally required to keep.

6. Rights of data subjects

If one of your customers asks to access or delete their data, we help you with that.