Data processing agreement

This data processing agreement (“DPA”) is part of the terms of service between the merchant that installs Returo (“the Store”, controller) and Flowett AB (org. no. 559518-8029), Sweden, which provides Returo (“Returo”, processor). It applies whenever Returo processes personal data of the Store’s customers on the Store’s behalf, and meets the requirements of article 28 of the EU General Data Protection Regulation (GDPR). By installing Returo the Store accepts this DPA.

1. What Returo processes and why

Purpose	Handling the Store’s returns and exchanges: order lookup in the returns portal, return labels, gift cards, refunds and exchanges through Shopify, emails about the return, and the Store’s own return statistics
Data subjects	The Store’s customers who start a return or exchange, and visitors to the returns portal
Personal data	Email address; Shopify customer ID; name and address; phone number (customs labels outside the EU only); order and return details; the customer’s free-text return reason; where the order came from (campaign, referring site); IP address (rate limiting only)
Special categories	None. Returo does not ask for or process special categories of data
Duration	As long as the Store uses Returo, and until the data is deleted under section 7

2. Instructions

Returo processes the personal data only on the Store’s documented instructions. The Store’s settings in the app, and this DPA, are those instructions. Returo does not use the data for its own purposes, does not sell it, and does not use it for advertising or profiling. If Returo is required by law to process the data otherwise, it tells the Store first unless the law forbids it. If Returo believes an instruction breaks data protection law, it tells the Store.

3. Confidentiality

Only Returo’s founding team has access to the personal data, and only as far as needed to run and support the app. Everyone with access is bound by confidentiality.

4. Security

Returo takes the technical and organisational measures required by article 32 GDPR, including:

• Encryption in transit (HTTPS for the app, the returns portal and every API; the database accepts encrypted connections only) and at rest (database and backups encrypted by Google Cloud).
• Daily backups and point-in-time recovery of the database.
• Separate development, test and production environments; production data is not copied elsewhere.
• Access limited to the founders, with strong unique passwords and two-factor authentication on every system that holds the data.
• Personal data kept out of application logs.
• A documented incident response procedure.

5. Sub-processors

The Store gives Returo general authorisation to use the sub-processors below. Returo binds each of them by contract to the same data protection obligations as this DPA, and remains responsible for them.

Sub-processor	What it does	Location
Google Cloud (Google Ireland Ltd)	Hosting and database	EU (Finland)
Resend, Inc.	Sending emails about the return to the customer and the Store	EU (Ireland)
The carrier the Store chooses in Returo (PostNord, Shipmondo, Shopify Shipping)	Creating the return label and finding drop-off points	EU

Shopify is not a sub-processor of Returo: the Store’s data lives in Shopify under the Store’s own agreement with Shopify, and Returo reads and writes it there through Shopify’s APIs.

Returo tells the Store at least 30 days before adding or replacing a sub-processor, by updating this page and emailing the Store’s contact address. The Store may object on reasonable data protection grounds; if the parties cannot agree, the Store may stop using Returo.

6. Transfers outside the EU/EEA

Personal data is stored and processed in the EU. Resend, Inc. is a US company; Returo uses its EU region, and any access from outside the EU/EEA is covered by the European Commission’s Standard Contractual Clauses, or by the EU–US Data Privacy Framework where the sub-processor is certified.

7. Deletion and return of data

• When Shopify sends Returo a customer erasure request (customers/redact), Returo removes that customer’s email, customer ID, label and drop-off points from its records and deletes their draft and pending returns. Return records stay, without the identifying data, for the Store’s accounting.
• When the Store uninstalls Returo, Shopify asks Returo to erase the Store’s data (shop/redact, 48 hours after uninstall) and Returo deletes everything it holds for the Store.
• Data the Store needs in return is the Store’s own Shopify data (orders, returns, customers, gift cards), which stays in Shopify.
• Backups are overwritten within 7 days.

8. Helping the Store

Returo helps the Store, as far as it reasonably can, to answer data subjects exercising their rights (access, correction, erasure, restriction, portability, objection), and with security, breach notification, impact assessments and prior consultation (articles 32 to 36 GDPR). Shopify’s standard data request and erasure mechanisms reach Returo automatically.

9. Personal data breaches

Returo tells the Store without undue delay, and at the latest within 48 hours, after becoming aware of a personal data breach affecting the Store’s customers, with what is known about the breach, its likely consequences and the measures taken. Returo then keeps the Store informed.

10. Audits

Returo makes available to the Store the information needed to show it meets this DPA, and allows reasonable audits, on 30 days’ written notice, at the Store’s cost, at most once a year unless a breach or a supervisory authority requires otherwise.

11. Liability, term and law

Liability under this DPA follows the terms of service, except where the GDPR provides otherwise. This DPA lasts as long as Returo processes personal data for the Store. It is governed by Swedish law, and disputes are settled by Swedish courts.

Contact for data protection: support@returo.io.