This Data Processing Addendum (“DPA”) applies when a merchant installs and uses the Cosmetic Wholesale Sync app. It supplements the CW Sync privacy appendix and the general website privacy policy.
1. Parties
- Controller: the merchant operating the online store that installs the app.
- Processor: Distraal B.V. trading as Cosmetic Wholesale (“we”, “us”).
2. Subject matter
Processing of end-customer personal data (name, email, phone, address) from paid store orders solely to create and fulfil Cosmetic Wholesale dropship orders and related operational tracking.
3. Duration
From app install until uninstall or shop redaction, plus limited retention for retries and support as described in the privacy appendix (contact fields blanked on successful delivery; remaining contact blanked after 90 days by default).
4. Nature and purpose
- Receive paid-order webhooks from the merchant’s store platform
- Transmit order and shipping contact data to Cosmetic Wholesale fulfilment systems
- Store queue/retry records in the app database until delivery or retention purge
- Honour platform privacy/compliance webhooks (data request, customer redact, shop redact)
5. Types of personal data
Name, email, phone, shipping/billing address as provided on the order; order identifiers; line items (EAN/SKU, quantity). We do not require payment card numbers for this processing.
6. Subprocessors
- Cloud host and managed database (e.g. DigitalOcean) under our configuration
- The merchant’s store platform (Shopify) as the source of order events
- Cosmetic Wholesale warehouse / OMS systems used to pick, pack, and ship
The subprocessors list may be updated with notice via this page or partner communications.
7. Security
- TLS in transit (HTTPS)
- Provider encryption at rest where enabled
- Access limited to authorised staff; access to personal data is logged where implemented
- Separate staging and production databases for Sync apps
Further detail: Data loss prevention and Security incident response.
8. Assistance with data subject requests
We assist the Controller via platform compliance webhooks and the support channel privacy@cosmeticwholesale.eu. End customers should contact the merchant first for purchase-related requests.
9. Deletion and return
On shop redaction or uninstall, shop-scoped app data is deleted as implemented. Order contact fields are cleared or blanked per the retention statement on the privacy appendix. Order references and status may remain for reconciliation without shipping contact.
10. Contact
This page supports App Store Protected Customer Data requirements. It is not a substitute for independent legal advice. Counsel may replace this text with a signed PDF; the URL will stay the same or redirect.