WeShipYou Data Processing Agreement

Last updated on: 13^th of August, 2022

This WeShipYou Data Processing Agreement (the “DPA”) is an addendum to the WeShipYou Terms of Service (the “Terms of Service”) and WeShipYou Privacy Policy (the “Privacy Policy”) between you (“User(s)“, “you“) and WeShipYou. You enter into this DPA on behalf of yourself and, to the extent required under the Data Protection Laws, in the name and on behalf of its Authorized Affiliates (defined below).

The parties agree as follows:

1. Definitions

“Affiliate” means an entity that directly or indirectly Controls, is Controlled by or is under common Control with an entity.

“Authorized Affiliate” means any of User Affiliate(s) permitted to or otherwise receiving the benefit of the Services pursuant to the Agreement.

“Data Protection Law” means (i) Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such data (“General Data Protection Regulation” or “GDPR”); and (ii) Directive 2002/58/EC concerning the Processing of Personal Data and the protection of privacy in the electronic communications sector and applicable national implementations of it (in each case, as may be amended, superseded or replaced)

“Data Processor”, “Data Controller”, “Data Subject”, “Processing”, “Sub-processor”, and “Supervisory Authority” shall be interpreted in accordance with the General Data Protection Regulation;

“User Data” means any data that WeShipYou and/or its Affiliates processes on behalf of User in the course of providing the Services under the Terms of Service.

“Personal Data” means any User Data relating to an identified or identifiable natural person to the extent that such information is protected as personal data under applicable Data Protection Law, which WeShipYou Processes as a Data Processor or service provider in the course of providing Services to you.

“Privacy Shield” means the EU-US and Swiss-US Privacy Shield Frameworks, as administered by the U.S. Department of Commerce.

“Privacy Shield Principles” means the Privacy Shield Framework Principles (as supplemented by the Supplemental Principles) contained in Annex II to the European Commission Decision of 12 July 2016 pursuant to the Directive, details of which can be found atwww.privacyshield.gov/eu-us-framework

“Security Incident” means any unauthorized or unlawful breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access to Personal Data.

“Services” means any product or service provided by WeShipYou to User pursuant to and as more particularly described in the Terms of Service.

“Standard Contractual Clauses” means the standard contractual clauses issued pursuant to the European Commission Decision of February 5, 2010 on standard contractual clauses for the transfer of personal data to processors established in third countries under Directive 95/46/EC

All capitalized terms not defined in this DPA shall have the meanings set forth in the Terms of Service and Privacy Policy.

2. Data Protection

2.1 This DPA applies where and only to the extent that WeShipYou processes Personal Data on behalf of the User in the course of providing the Services and such Personal Data is subject to Data Protection Laws of the European Union, the European Economic Area and/or their member states, Switzerland and/or the United Kingdom. The parties agree to comply with the terms and conditions in this DPA in connection with such Personal Data.

2.2 Role of the Parties. As between WeShipYou and User, User is the Data Controller of Personal Data and WeShipYou shall process Personal Data only as a Data Processor on behalf of User. Nothing in the Terms of Service or this DPA shall prevent WeShipYou from using or sharing any data that WeShipYou would otherwise collect and process independently of User's use of the Services.

2.3 User Obligations. User agrees that (i) it shall comply with its obligations as a Data Controller under Data Protection Laws in respect of its Processing of Personal Data and any Processing instructions it issues to WeShipYou; and (ii) it has provided notice and obtained (or shall obtain) all consents and rights necessary under Data Protection Laws for WeShipYou to process Personal Data and provide the Services pursuant to the Terms of Service and this DPA.

2.4 WeShipYou Processing of Personal Data. As a Data Processor, WeShipYou shall process Personal Data only for the following purposes: (i) Processing to perform the Services in accordance with the Terms of Service; (ii) Processing to perform any steps necessary for the performance of the Terms of Service; and (iii) to comply with other reasonable instructions provided by User to the extent they are consistent with the terms of this Terms of Service and only in accordance with User’s documented lawful instructions. The parties agree that this DPA and the Terms of Service set out the User’s complete and final instructions to WeShipYou in relation to the Processing of Personal Data and Processing outside the scope of these instructions (if any) shall require prior written agreement between User and WeShipYou.

2.5 Nature of the Data. WeShipYou handles User Data provided by User. Such User Data may contain special categories of data depending on how the Services are used by User. The User Data may be subject to the following process activities: (i) storage and other Processing necessary to provide, maintain and improve the Services provided to User; (ii) to provide User and technical support to User; and (iii) disclosures as required by law or otherwise set forth in the Terms of Service.

2.6 WeShipYou Data. Notwithstanding anything to the contrary in the Terms of Service (including this DPA), User acknowledges that WeShipYou shall have a right to use and disclose data relating to and/or obtained in connection with the operation, support and/or use of the Services for its legitimate business purposes, such as billing, account management, technical support, product development and sales and marketing. To the extent any such data is considered personal data under Data Protection Laws, WeShipYou shall process such data in compliance with Data Protection Laws.

3. Subprocessing

3.1 Authorized Sub-processors. User agrees that WeShipYou may engage Sub-processors to process Personal Data on User's behalf. A current list of Sub-processors (the “List of Sub-processors”) may be found online at:https://www.easyship.com/legal/data-usage-and-cookies. If you object to the appointment of a Sub-processor you may terminate this agreement in accordance with our Terms of Service.

3.2 Sub-processor Obligations. WeShipYou shall: (i) enter into a written agreement with the Sub-processor imposing data protection terms that require the Sub-processor to protect the Personal Data to the standard required by Data Protection Laws; and (ii) remain responsible for its compliance with the obligations of this DPA and for any acts or omissions of the Sub-processor that cause WeShipYou to breach any of its obligations under this DPA.

4. Security

4.1 WeShipYou shall implement and maintain appropriate technical and organizational security measures to protect Personal Data from Security Incidents and to preserve the security and confidentiality of the Personal Data.

4.2 Confidentiality of Processing. WeShipYou shall ensure that any person who is authorized by WeShipYou to process Personal Data (including its staff, agents and subcontractors) shall be under an appropriate obligation of confidentiality (whether a contractual or statutory duty).

4.3 Security Incident Response. Upon becoming aware of a Security Incident, WeShipYou shall notify User without undue delay and shall provide timely information relating to the Security Incident as it becomes known or as is reasonably requested by User.

4.4 Updates to Security Measures. User acknowledge that the Security Measures are subject to technical progress and development and that WeShipYou may update or modify the Security Measures from time to time provided that such updates and modifications do not result in the degradation of the overall security of the Services purchased by the User.

5. International Transfers

5.1 Processing Locations. WeShipYou may transfer and process User Data in the United States and anywhere in the world where WeShipYou, its Affiliates and/or its Sub-processors maintain data Processing operations. WeShipYou shall implement appropriate safeguards to protect the Personal Data, wherever it is processed, in accordance with the requirements of Data Protection Laws.

5.2 Transfer Mechanism: Notwithstanding Section 5.1, to the extent WeShipYou processes or transfers (directly or via onward transfer) Personal Data under this DPA from the European Union, the European Economic Area and/or their member states and Switzerland (“EU Data”) in or to countries which do not ensure an adequate level of data protection within the meaning of applicable Data Protection Laws of the foregoing territories, the parties agree that WeShipYou shall be deemed to provide appropriate safeguards for such data by virtue of: (a) having certified its compliance with the Privacy Shield and Processing such data in compliance with the Privacy Shield Principles; (b) WeShipYou having reasonably provided other appropriate safeguards under the Data Protection Laws of the foregoing territories; or (c) only if and to the extent neither 5.2(a) nor 5.2(b) are sufficiently appropriate under the Data Protection Laws of the foregoing territories, WeShipYou shall rely on EU approved Standard Contractual Clauses for the transfer of personal data. User hereby authorizes any transfer of EU Data to, or access to EU Data from, such destinations outside the EU subject to any of these measures having been taken. Notwithstanding the foregoing, the Standard Contractual Clauses shall not apply and have no legal effect if WeShipYou adopts an alternative appropriate safeguard or means for the transfer of EU Data described in this section during the term of this DPA.

6. Return or Deletion of Data

6.1 Upon deactivation of the Services, all Personal Data shall be deleted, save that this requirement shall not apply to the extent WeShipYou is required by applicable law to retain some or all of the Personal Data, or to Personal Data it has archived on back-up systems, which such Personal Data WeShipYou shall securely isolate and protect from any further Processing, except to the extent required by applicable law.

7. Miscellaneous

7.1 In the event of any conflict or inconsistency between the provisions of the Terms of Service and this DPA, the provisions of this DPA shall prevail. For avoidance of doubt and to the extent allowed by applicable law, any and all liability under this DPA, including limitations thereof, will be governed by the relevant provisions of the Terms of Service. You acknowledge and agree that WeShipYou may amend this DPA from time to time by posting the relevant amended and restated DPA on WeShipYou’s website, available at https://www.easyship.com/legal/dpa and such amendments to the DPA are effective as of the date of posting. Your continued use of the Services after the amended DPA is posted to WeShipYou’s website constitutes your agreement to, and acceptance of, the amended DPA. If you do not agree to any changes to the DPA, do not continue to use the Service.

7.2. IF any provision of this DPA is held illegal or unenforceable in a judicial proceeding, such provision shall be severed and shall be inoperative, and the remainder of this DPA shall remain operative and binding on the parties.

7.3 In no event shall any party limit its liability with respect to any individual's data protection rights under this DPA or otherwise.

7.4 The terms of this DPA shall be governed by and interpreted in accordance with the laws of the State of New York, without regard to principles of conflicts of laws. The parties irrevocably and unconditionally submit to the exclusive jurisdiction of the courts of New York with respect to any dispute or claim arising out of or in connection with this DPA.

You can find more information about how WeShipYou protects your privacy, how WeShipYou is GDPR complaint, and how WeShipYou is certified for the Privacy Shield Framework for both the EU-US and the Swiss-US Frameworks through the below links: