Data Processing Agreement (DPA)
Data Processing Agreement (Article 28 GDPR)
between
8returns GmbH, Pappelallee 78/79, 10437 Berlin, Germany ("Processor")
and
the customer entity signing/accepting these clauses ("Controller" / "Customer")
This Data Processing Agreement ("DPA") forms part of and is incorporated into the parties' master services agreement/terms governing the use of the 8returns returns management platform (the "Agreement").
With regard to the obligations under Article 28 GDPR, the parties agree to the following standard contractual clauses approved by the EU Commission (Commission Implementing Decision (EU) 2021/915 of 4 June 2021).
1. Purpose and scope
1.1 The purpose of these standard contractual clauses (the "Clauses") is to ensure compliance with Article 28(3) and (4) GDPR.
1.2 These Clauses apply to the processing of personal data as specified in Annex I.
1.3 Annexes I to III form an integral part of the Clauses.
1.4 These Clauses are without prejudice to obligations to which the Controller is subject under the GDPR.
1.5 These Clauses do not by themselves ensure compliance with obligations related to international transfers under Chapter V GDPR.
2. Invariability of the Clauses
2.1 The parties undertake not to modify the Clauses, except for adding or updating information in the Annexes.
2.2 The parties may include these Clauses in a broader contract or add other clauses provided they do not contradict the Clauses or reduce protections for data subjects.
3. Interpretation
3.1 Terms defined in the GDPR have the same meaning in these Clauses.
3.2 These Clauses shall be interpreted in light of the GDPR.
3.3 These Clauses shall not be interpreted in a way that prejudices data subjects' rights.
4. Hierarchy
In case of conflict between these Clauses and other parts of the Agreement regarding data processing, these Clauses prevail.
5. Intentionally left blank
[Reserved]
6. Description of processing(s)
Details of processing operations, categories of personal data, and purposes are set out in Annex I.
7. Obligations of the Parties
7.1 Instructions
The Processor shall process personal data only on documented instructions from the Controller, unless required by applicable Union or Member State law. The Processor shall inform the Controller of such legal requirement unless prohibited by law. Subsequent instructions shall be documented. The Processor shall inform the Controller if instructions infringe the GDPR.
7.2 Purpose limitation
The Processor shall process personal data only for the purposes set out in Annex I, unless further instructed by the Controller.
7.3 Duration of processing
Processing shall occur for the duration specified in Annex I (including post-termination processing strictly necessary to comply with deletion/return obligations and agreed retention, where applicable).
7.4 Security of processing
The Processor shall implement at least the technical and organisational measures ("TOMs") specified in Annex II to ensure security, including protection against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access (personal data breach).
Access to personal data is limited to personnel who require it to perform, manage, or support the services and who are bound by confidentiality.
7.5 Sensitive data
The parties agree that the services are not intended to process special categories of personal data under Article 9 GDPR or data relating to criminal convictions/offences under Article 10 GDPR. The Controller shall not provide such data to the Processor unless explicitly agreed in writing and subject to appropriate safeguards.
7.6 Documentation and compliance
- (a) Each party shall be able to demonstrate compliance with these Clauses.
- (b) The Processor shall respond promptly to inquiries from the Controller about processing under these Clauses.
- (c) The Processor shall make available to the Controller all information reasonably necessary to demonstrate compliance with these Clauses and Article 28 GDPR.
- (d) The Controller may conduct audits at reasonable intervals, with reasonable notice, and in a manner that avoids undue disruption and protects confidentiality/security.
- (e) The Processor may satisfy audit requests through appropriate third-party reports/certifications and security documentation where available, unless the Controller demonstrates a specific reason for a deeper audit.
7.7 Use of sub-processors
- (a) The Controller grants the Processor general authorisation to engage sub-processors listed in Annex III.
- (b) The Processor shall inform the Controller of intended changes to the sub-processor list by adding or replacing sub-processors at least 30 days in advance, allowing the Controller to object on reasonable data protection grounds.
- (c) The Processor shall impose data protection obligations on sub-processors that are materially equivalent to those in these Clauses.
- (d) The Processor remains responsible for the performance of sub-processors.
7.8 International transfers
Where processing involves a transfer of personal data under Chapter V GDPR, the parties shall ensure such transfer is covered by a valid transfer mechanism (e.g., adequacy decision, SCCs) and supplementary measures where required. The Controller agrees that the Processor may use SCCs with relevant sub-processors to ensure compliance with Chapter V GDPR, where conditions are met.
8. Assistance to the Controller
8.1 The Processor shall promptly notify the Controller of any data subject request received and shall not respond unless authorised.
8.2 The Processor shall assist the Controller with data subject rights requests taking into account the nature of processing and the information available to the Processor.
8.3 The Processor shall also assist the Controller with DPIAs and prior consultation where required, and with Article 32 obligations, to the extent applicable and reasonable.
8.4 The scope of assistance and practical process is described in Annex II (and/or support procedures).
9. Notification of personal data breach
In the event of a personal data breach, the Processor shall notify the Controller without undue delay after becoming aware of it and provide reasonably available information to support the Controller's obligations under Articles 33 and 34 GDPR.
10. Non-compliance and termination
10.1 If the Processor is in breach of these Clauses, the Controller may instruct the Processor to suspend processing until compliance is restored or the Agreement is terminated.
10.2 The Controller may terminate the Agreement to the extent it concerns processing under these Clauses in case of substantial or persistent breach.
10.3 The Processor may terminate if the Controller insists on unlawful instructions after being informed.
10.4 Deletion or return at end of provision of services
Following termination or expiry of the Agreement, the Processor shall, at the Controller's choice, delete or return personal data processed on behalf of the Controller and delete existing copies unless retention is required by Union or Member State law.
Retention note (8returns default): Unless otherwise agreed in writing, the Processor will retain Controller data for up to 2 years after contract expiration, then delete or anonymise it. The Controller may instruct the Processor to delete earlier at any time (subject to legal holds/exceptions permitted by law). The Processor will document completion of deletion upon request.
10.5 Governing law and venue
This DPA is governed by the laws of Germany. Venue: Berlin, Germany.
Annex I – Description of the Processing
1. Categories of data subjects
- Shoppers/end-consumers of the Controller (returns initiators)
- Employees/representatives of the Controller (merchant admin users)
- Other authorised users designated by the Controller (e.g., customer support staff)
2. Categories of personal data processed (typical)
- Shopper: name, postal address, email/phone (if used), order/return identifiers, return status information
- Merchant users: name, business contact details, login/account identifiers, role/permissions
- Technical data: user IDs, event/admin logs, IP address (as applicable)
3. Special categories of data (Art. 9)
Not intended/expected. The Controller shall avoid providing such data to the Processor unless explicitly agreed and safeguarded.
4. Nature of the processing
Provision of a SaaS returns management platform: collection, storage, organisation, retrieval, display, transmission (e.g., to carriers/notification providers), deletion/anonymisation as instructed.
5. Purposes of processing (on behalf of Controller)
- Enable shoppers to initiate and manage returns
- Generate labels / support logistics workflows (as applicable)
- Send return status notifications (email/SMS if enabled by Controller)
- Provide merchant admin console and reporting
- Provide customer support related to the service
6. Duration of processing
For the term of the Agreement, plus post-termination processing necessary to meet deletion/return obligations and agreed retention:
- Default retention: up to 2 years after contract expiration, then deletion/anonymisation
- Earlier deletion: upon Controller instruction (unless legal exception applies)
Annex II – Technical and Organisational Measures (TOMs) + Assistance
A) TOMs (security of processing)
8returns maintains documented TOMs aligned with GDPR Article 32 and ISO/IEC 27001. The current TOMs summary is provided in "8returns_TOM_2025" and made available to the Controller upon request. TOMs include, as applicable:
- Access controls (least privilege, administrative access controls, MFA)
- Encryption in transit and at rest where applicable; secrets management
- Logging/monitoring of security-relevant events and admin actions
- Secure development and change management practices
- Incident response and breach notification process
- Backup and recovery measures (incl. limited backup retention)
B) Assistance process (practical)
- Data subject requests: Controller submits requests via support channel; Processor assists with retrieval/export/deletion within reasonable timeframes.
- Deletion requests: Controller may instruct early deletion; Processor logs and confirms completion.
- Security/breach: Processor notifies Controller without undue delay after becoming aware; provides reasonable cooperation and information.
Annex III – List of Sub-Processors
The Processor is authorised to use the sub-processors listed below for the purposes described in Annex I. The list is maintained and updated, with advance notice of changes.
Initial list:
| Sub-processor | Purpose |
|---|---|
| AWS / Heroku | Cloud hosting/infrastructure |
| Intercom | Support tooling |
| HubSpot | CRM (controller context) |
| Retool | Internal admin/BI tooling |
| Google Workspace | Email/workspace for operational communications |
| EasyPost, SendCloud, ShipCloud | Logistics/label providers |
Public subprocessor list option: The Processor may publish and maintain a current list of sub-processors at a Trust Center/URL and treat that list as Annex III, provided Controllers receive change notifications per Clause 7.7.