Importify legal

Data Processing Agreement

Version of October 10, 2026.

This Data Processing Agreement ("DPA") is between the merchant using Importify ("Controller") and Importify Limited, Unit 1603, 16th Floor, The L. Plaza, 367 - 375 Queen's Road Central, Sheung Wan, Hong Kong, provider of the Importify service ("Processor"). It forms part of the terms under which the Controller uses Importify (the "Service") and applies for as long as the Processor processes personal data for the Controller.

This DPA applies without signature. A signed copy is available on request from supportimportify.com.

1. Scope and roles

  1. Terms such as "personal data", "processing", "controller", "processor" and "personal data breach" have the meanings given in Regulation (EU) 2016/679 ("GDPR").
  2. "Customer Personal Data" means the personal data of the Controller's store customers that the Processor processes to provide the Service, as described in Annex 1.
  3. The Controller is the controller of Customer Personal Data and the Processor is its processor.
  4. Account, billing and contact data of the Controller itself is not covered by this DPA. The Processor handles it as a controller under the Importify Privacy Policy.

2. Processor obligations

The Processor shall:

  1. process Customer Personal Data only on the Controller's documented instructions, including for transfers outside the EEA, unless the law requires otherwise, in which case it will inform the Controller first where the law allows. Installing, configuring and using the Service is the Controller's instruction;
  2. tell the Controller if it believes an instruction infringes data protection law;
  3. ensure that everyone authorised to process Customer Personal Data is bound by confidentiality;
  4. apply the security measures in Annex 2;
  5. help the Controller, as far as reasonably possible, to respond to requests from individuals exercising their rights, and forward to the Controller any such request it receives directly;
  6. help the Controller meet its obligations on security, breach notification and data protection impact assessments, taking into account the information available to the Processor;
  7. not sell Customer Personal Data or use it for its own purposes.

3. Controller obligations

  1. The Controller is responsible for having a lawful basis for the processing and for informing its own customers, including that order details are shared with the suppliers that fulfil their orders.
  2. The Service is not designed for special categories of personal data (GDPR Article 9), and the Controller will not use it to process them.

4. Subprocessors

  1. The Controller authorises the Processor to use the subprocessors listed in Annex 3.
  2. The Processor will inform the Controller by email before adding or replacing a subprocessor. The Controller may object within 14 days. If the objection cannot be resolved, the Controller may stop using the Service.
  3. The Processor binds each subprocessor to data protection obligations equivalent to this DPA and remains responsible for its performance.

5. International transfers

  1. The Processor is established in Hong Kong. Customer Personal Data is hosted in the United States by the subprocessors in Annex 3.
  2. Where the Controller's transfer of Customer Personal Data to the Processor is subject to the GDPR and is not covered by an adequacy decision, the Standard Contractual Clauses in Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor), are incorporated into this DPA by reference. The Controller is the data exporter and the Processor is the data importer. Annexes 1 to 3 of this DPA are the annexes to those Clauses, section 4 of this DPA is the general authorisation for subprocessors, and the Clauses are governed by the law and courts of the EU member state in which the Controller is established. Where the transfer is subject to UK data protection law, the International Data Transfer Addendum issued by the UK Information Commissioner applies to those Clauses in the same way.
  3. Transfers to the subprocessors in Annex 3 rely on the subprocessor's certification under the EU-US Data Privacy Framework or on the Standard Contractual Clauses.

6. Personal data breaches

The Processor will notify the Controller without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and will share the information the Controller needs to meet its own obligations.

7. Information and audits

The Processor will make available the information needed to show compliance with this DPA. The Controller, or an independent auditor bound by confidentiality, may audit that compliance once a year on 30 days' written notice, at the Controller's cost and without unreasonably disrupting the Processor's business.

8. Return and deletion

After the Controller stops using the Service, the Processor will delete or return Customer Personal Data, at the Controller's choice, within 30 days of the Controller's written request to supportimportify.com, unless the law requires it to be kept.

9. General

  1. If this DPA conflicts with the terms that govern the Service, this DPA prevails on data protection matters.
  2. Liability under this DPA is subject to the limits in the Terms of Use, except where the law does not allow liability to be limited.

Annex 1: Details of the processing

ItemDescription
PurposeTo show the Controller the orders of its store, to place an order with the supplier the Controller chooses, and to return tracking information to the store.
DurationWhile the Controller uses Importify, and until deletion under section 8.
IndividualsCustomers of the Controller's store who place orders.
Personal dataName, delivery address and phone number as contained in the order; order contents and identifiers; tracking numbers. Importify's database keeps order identifiers, statuses and tracking numbers. Names, addresses and phone numbers are read from the store when they are needed.
Special categoriesNone.

Annex 2: Security measures

  • All connections to the Service use HTTPS (TLS).
  • Server and database access is limited to one named administrator, over encrypted connections (SSH).
  • Data is backed up regularly by the hosting provider.
  • Payment card data is handled by the payment providers and store platforms and never reaches Importify.

Annex 3: Subprocessors

SubprocessorPurposeDataLocation
Cloudways LtdManaged hostingAll Customer Personal DataMalta
DigitalOcean LLCCloud serversAll Customer Personal DataUnited States (New York region)

Shopify, Wix, WooCommerce, BigCommerce and Jumpseller are the Controller's own store platforms and are not subprocessors of Importify. Suppliers and marketplaces such as AliExpress receive order details on the Controller's instruction when the Controller places an order with them, and are not subprocessors of Importify.

Contact

Importify Limited
Unit 1603, 16th Floor, The L. Plaza, 367 - 375 Queen's Road Central, Sheung Wan, Hong Kong.
Email: supportimportify.com
Website: https://www.importify.com/