Data Processing Addendum

1. We use your customers' data only to run your operations, never to sell, share, market or train AI.
2. Everyone who touches it is named, bound by confidentiality and uses multi-factor authentication.
3. We tell you within 24 hours of becoming aware of an incident, so you can meet your own platform deadlines.
4. You get 15 days' notice of any new subprocessor, with a right to object.
5. When we stop, we return or delete your data within 30 days and confirm it in writing.

You are the business and the controller of the data. Ecomrelays LLC is your service provider and processor, and handles personal data only on your behalf and on your documented instructions: the DPA, the Master Services Agreement, each statement of work and your written instructions. If we believe an instruction breaks a privacy law, we tell you and may pause that processing until you confirm or change it.

The DPA's security annex summarizes our Access and Security Policy, which applies in full.

• Named users only, multi-factor authentication on every account, least-privilege permissions and never your owner credentials.
• Each client worked in its own isolated environment on company-managed devices with screen lock, current updates and disk encryption. No personal devices.
• Credentials in a company-approved password manager, never sent by email or chat.
• Work done in your systems where possible; minimal exports, stored encrypted and deleted within 30 days of their purpose.
• Written confidentiality and data agreements for every team member, with security onboarding before access and a yearly refresher.
• Quarterly access reviews on monthly plans, and access removed within 24 hours of a team change or the end of the work.

More detail is on our security and access page.

Personal data stays in your accounts and in US-hosted systems wherever possible. Part of our team works outside the US, as one managed team with a named US-facing lead. Team members may access personal data remotely to do the work, always under the DPA, through isolated environments on company-managed devices and without storing it locally beyond the minimum needed.

Platforms such as Amazon, Walmart and Shopify, and tools held in your own name, are your providers, not our subprocessors. Our subprocessors are our email and document provider, our password manager and the individual contractors on our managed team, each bound by a written agreement. Any company through which those contractors are engaged, and any helpdesk or automation tool we hold in our own name rather than yours, is named in the subprocessor list too. We give you at least 15 days' written notice before adding a new subprocessor. If you object on reasonable data protection grounds and we cannot resolve it, you may end the affected services without penalty and receive a refund of prepaid fees for work not yet performed.

If one of your customers asks us about their personal data, we pass the request to you within 3 business days and do not answer it ourselves unless you instruct us to. We help you respond to requests to access, correct, delete or port data, or to opt out, within the time the law allows.

If we become aware of an incident affecting your customers' personal data, we notify you without undue delay and in any event within 24 hours. The notice says what is known, which data and people are affected, what we have done and who to contact for updates. We contain and investigate the incident, send a written report within 5 business days of containment and help you meet any duty to notify customers, regulators or platforms. We do not notify your customers or regulators ourselves without your consent unless the law requires it.

On reasonable request we provide the information you need to show compliance. Once in any 12-month period, and after an incident, you or an independent assessor bound by confidentiality may assess our compliance on at least 30 days' notice. We first answer a written security questionnaire, which you may accept instead of an on-site review. We do not hold SOC 2 or ISO 27001 certification and do not claim to.

When the services end, we return or delete the personal data we hold within 30 days, at your choice, remove all access to your accounts within 24 hours and confirm deletion in writing on request. During the services, order reports containing buyer information are deleted no later than 30 days after the orders are delivered, unless you instruct otherwise.

The full DPA is available as a PDF to review and sign. It is included in every paid engagement, and we will sign it before a Profit Leak Scan if you ask. To request a copy for signature, use our contact page. See also our privacy policy and terms of service.

Ecomrelays LLC · 597 Mountcastle Dr, Rockwall, TX 75087 · contact@ecomrelays.com · +1 (469) 331-3129