ParcelWrenData Processing Agreement (UK GDPR Article 28)
Last updated: 31 October 2026. This agreement forms part of the Terms of Service.
Parties: the merchant who installs the App (the "Controller") and ACTIVEDOTS LTD, company number 17234408 (the "Processor").
1. Scope
| Subject matter | Sending the Controller's Shopify orders to the Controller's Royal Mail Click & Drop account and updating Shopify with fulfilment and tracking. |
| Duration | While the App is installed, plus the deletion period in section 9. |
| Nature and purpose | Reading order data from Shopify, transmitting it to Royal Mail Click & Drop, reading back despatch status and tracking, and showing order status to the Controller. |
| Personal data | Customers' names, company names and shipping addresses; email address and phone number only if the Controller enables them; order numbers and contents. |
| Data subjects | The Controller's customers (order recipients). |
| Storage | The Processor does not store customers' names, addresses, emails or phone numbers. It stores order IDs, order numbers, statuses, tracking numbers, error messages and a one-way address fingerprint. |
2. Instructions
2.1 The Processor processes personal data only on the Controller's documented instructions. These are: the Terms of Service, this DPA, and the Controller's settings in the App. It does so unless UK law requires otherwise, in which case it tells the Controller first unless the law forbids that. 2.2 Sending data to Royal Mail is done on the Controller's instruction, to the Controller's own Click & Drop account. Royal Mail is not the Processor's sub-processor; Royal Mail's processing is governed by the Controller's agreement with Royal Mail.
3. Confidentiality
Anyone the Processor authorises to process the data is bound by confidentiality.
4. Security (Article 32)
The Processor applies the measures in its information security measures, including encryption in transit (TLS) and at rest, encryption of Click & Drop API keys (AES-256-GCM), not storing customer contact details, log redaction, least-privilege access with two-factor authentication, and 90-day retention.
5. Sub-processors
5.1 The Controller authorises these sub-processors:
| Sub-processor | Purpose | Location of processing |
|---|---|---|
| Shopify | Platform the App runs in | per Shopify's terms |
| Supabase Inc. | Database hosting | London, UK |
| Fly.io, Inc. | Application hosting | London, UK |
| Resend (Plus Five Five, Inc.) | Emails to merchants (merchant email, order numbers) | United States |
5.2 The Processor will give at least 30 days' notice (in the App or by email) before adding or replacing a sub-processor. The Controller may object on reasonable data protection grounds; if not resolved, the Controller may uninstall the App. 5.3 The Processor has written terms with each sub-processor that protect the data at least as well as this DPA.
6. International transfers
Where a sub-processor processes personal data outside the UK, the Processor relies on an adequacy regulation or the UK International Data Transfer Agreement / UK Addendum to the EU Standard Contractual Clauses, as offered by that sub-processor.
7. Data subject rights
The Processor assists the Controller in responding to requests, including Shopify's customers/data_request and customers/redact notices, which the App handles automatically (data requests are emailed to the Controller; redactions delete matching records).
8. Personal data breaches
8.1 The Processor notifies the Controller without undue delay, and aims to within 48 hours, after becoming aware of a personal data breach affecting the Controller's data. The notice includes what is known about the nature of the breach, likely consequences, and measures taken. 8.2 The Processor assists the Controller with any notification to the ICO or data subjects. This follows the Processor's incident response policy.
9. Deletion
On uninstall, Shopify sends shop/redact after 48 hours and the Processor then deletes all data for the store. Records of finished orders are deleted after 90 days during normal use. Backups held by sub-processors expire on their normal cycle (normally within days).
10. Audits and information
The Processor makes available the information reasonably needed to show compliance with Article 28, and allows audits by the Controller (or an auditor it appoints) on reasonable notice, at the Controller's cost, no more than once a year unless required by a regulator or after a breach.
11. Assistance
The Processor gives reasonable help with data protection impact assessments and prior consultations, taking into account the nature of the processing and the information available to it.