Data processing agreement
Last updated 19 October 2026
In short
- When you use Vervoro, you are the controller of your buyers' personal data and Vervoro is your processor.
- We act only on your instructions, keep only what is needed to ship, protect it, and remove it 30 days after delivery.
- You accept this agreement before connecting your first marketplace. It forms part of our terms of service.
1. Parties and scope
This agreement is between Vervoro Limited (company number 17524562, registered office 81 Chorefields, Kidlington, OX5 1SY, England; "Vervoro", the "processor") and the business that uses Vervoro (the "customer", the "controller"). It applies to personal data that Vervoro processes for the customer in providing the Vervoro service ("customer personal data"), and it meets the requirements of Article 28 of the UK GDPR and, where it applies, the EU GDPR.
If this agreement conflicts with the terms of service about customer personal data, this agreement wins.
2. Details of the processing
| Subject matter and purpose | Receiving the customer's marketplace and shop orders, and using the delivery details to pick, pack, label, dispatch and invoice those orders, handle returns and answer buyers' requests, as the customer directs through the service |
|---|---|
| Duration | The term of the customer's subscription, then until erasure under section 11 |
| Data subjects | Buyers and recipients of the customer's orders |
| Categories of data | Recipient name; delivery address and phone number; order note and gift message; for a business buyer, company name and VAT number; a keyed hash of an eBay buyer's user id; tracking numbers and shipping labels |
| Not processed | Buyers' email addresses, payment details or special category data. Vervoro does not build buyer profiles or combine buyer data across orders, marketplaces or customers |
| Location | Stored in the EU (see the sub-processor list) |
3. Instructions
Vervoro processes customer personal data only on the customer's documented instructions. The customer's instructions are this agreement, the terms of service, and the settings and actions the customer's users take in the service. Vervoro will tell the customer if it believes an instruction breaks data protection law, and need not follow it. If the law requires Vervoro to process customer personal data otherwise, Vervoro will tell the customer first unless the law forbids it.
Where a marketplace's rules for its data are stricter than this agreement, Vervoro follows the marketplace's rules, and the customer instructs Vervoro to do so.
4. The customer's responsibilities
The customer is responsible for having a lawful basis to collect customer personal data and give it to Vervoro, for the accuracy of its instructions, and for answering its buyers. The customer chooses and contracts its own carriers; sending an address to the customer's carrier is done on the customer's instruction, and the carrier is not Vervoro's sub-processor.
5. Confidentiality and access
- Everyone at Vervoro or a sub-processor who can reach customer personal data is bound to confidentiality.
- No one at Vervoro has standing access to a customer's data. An operator may look inside a customer's company only through a time-limited grant (at most 8 hours) with a recorded reason, which the customer is told about at once and can end. Buyer data stays masked during a grant unless the customer's owner or admin switches it on.
- Developers have no access to production data.
- Access is removed within 24 hours of a person leaving or changing role, and reviewed every quarter.
6. Security
Vervoro maintains at least the following measures, and may improve them:
- Encryption in transit (TLS 1.2 or higher) and at rest; every buyer field also encrypted on its own (AES-256-GCM) under a key unique to the customer's company, wrapped by a key held outside the database and rotated yearly.
- Each company's data kept apart from every other company's, enforced by the database.
- Data minimisation: only the fields in section 2; buyer data never in logs, analytics, URLs, caches, emails, queue messages, the user's device storage or AI requests.
- Access by role and order state: warehouse users see an address only while its order is being packed and shipped; every view of buyer data is logged in the customer's audit log.
- Two-factor sign-in for every user; sessions of at most 24 hours.
- Central security logs kept 12 months; monthly vulnerability scans; a yearly independent penetration test; a written incident response plan reviewed every six months.
- No real buyer data in development, test or demonstration systems.
7. Sub-processors
- The customer gives Vervoro general authorisation to use the sub-processors on the sub-processor list.
- Vervoro will give at least 30 days' notice before adding or replacing a sub-processor that processes customer personal data. If the customer objects on reasonable data protection grounds, it may end its subscription before the change takes effect.
- Vervoro imposes data protection terms on each sub-processor that are no less protective than this agreement, and remains responsible to the customer for its sub-processors.
8. International transfers
Customer personal data is stored in the EU. Where a sub-processor processes it outside the UK or the EEA, Vervoro ensures the transfer is covered by an adequacy decision or by appropriate safeguards, such as the EU Standard Contractual Clauses with the UK International Data Transfer Addendum.
9. Helping the customer
- Buyers' requests. Vervoro gives the customer tools to answer them: an erasure is carried out at once; data for an access request is prepared within 7 days; a correction is saved at once and is not overwritten by later marketplace reads.
- Retention. Buyer data is anonymised automatically 30 days after delivery (after dispatch where no delivery date is known; after cancellation for an order cancelled before dispatch; and within 30 days of a marketplace connection ending). An issued VAT invoice is kept unchanged for the period tax law requires, and, for an order delivered outside the UK, the carrier, tracking number and delivery event are kept as export evidence for the statutory period.
- Impact assessments. Vervoro gives reasonable help with the customer's data protection impact assessments and consultations with regulators.
10. Personal data breaches
Vervoro will tell the customer of a personal data breach affecting customer personal data without undue delay and within 24 hours of becoming aware of it, with the information the customer needs to meet its own duties, and will keep the customer updated. Vervoro will also tell any marketplace whose data is involved, as that marketplace requires. Vervoro speaks only for itself: it does not notify regulators or buyers on the customer's behalf unless the customer asks.
11. Deletion at the end
When the customer's company closes, the customer may export its data for 30 days. Vervoro then erases all customer personal data, except what the law requires it to keep, by destroying the company's data key and removing its data. Erasure reaches backups when they expire, within 30 days; until then, any restore re-applies every erasure before the data can be used. The customer may ask for earlier erasure.
12. Information and audits
Vervoro will make available the information reasonably needed to show compliance with this agreement, including summaries of penetration test results. If that is not enough, the customer may carry out an audit, at its own cost, on reasonable notice, during business hours, no more than once a year (unless a regulator requires it or after a breach), under confidentiality, and without access to other customers' data.
13. General
Each party's liability under this agreement is subject to the limits in the terms of service, except where the law does not allow them. This agreement is governed by the law of England and Wales. Questions: [email protected].