Data Processing Agreement

1. What this agreement covers

It covers the personal data of your customers and parcel recipients that Forto handles on your behalf to run the service. It does not cover your own account and billing data, or the tax and customs records Forto must keep itself where it carries an obligation on an order (for example as seller of record or as your import VAT intermediary). For those, Forto is a controller, as described in our Privacy Policy.

2. The processing

• Purpose: quoting shipping, duties and taxes; buying shipping labels; preparing customs paperwork; tracking parcels; handling returns; and sending the emails that go with them.
• People concerned: your customers, the recipients of your parcels, and people who request returns.
• Personal data: name, shipping and billing address, email address, phone number, what was ordered and its value, tax identifiers where customs needs them, tracking events, and return requests. Forto does not process special categories of personal data.
• Duration: for as long as your store uses Forto, and then until the data is deleted as described in section 9.

3. Your instructions

We process the data only on your documented instructions. Your instructions are these Terms, this agreement, and the settings you choose in Forto. If the law requires us to process data in another way, we tell you first unless the law forbids it. If we believe an instruction breaks data protection law, we tell you.

4. Confidentiality

Only people who need the data to run the service can access it, and each of them is bound to keep it confidential.

5. Security

We protect the data with measures that fit the risk, including:

• encryption of all traffic to and from Forto;
• encryption of the database and its backups where they are stored;
• access limited to the people who need it, and every merchant request checked against a signed-in session or a Shopify session;
• card details held by Stripe, never by Forto;
• daily backups, so data can be restored after a failure.

We review these measures at least once a year and when the service changes.

6. Sub-processors

You allow us to use the following sub-processors. Each is bound by data protection terms at least as protective as this agreement, and we remain responsible to you for their work.

• Hosting and processing: Vercel, Supabase, Upstash, Inngest and Render.
• Email: Resend and Google Workspace.
• Shipping: the carriers and shipping platforms that carry each parcel, such as UPS, DHL, FedEx, PostNord, GLS and Shippo.
• Tax and customs: Airwallex, and the tax compliance partners that file on your behalf when your plan includes it (Numeral; TaxCloud for US sales tax).

Product details are sent to OpenAI and Anthropic to suggest customs codes; customer details are never sent to them. Before we add or replace a sub-processor, we tell you by email at least 30 days ahead. If you object, you can stop using Forto before the change takes effect.

7. Transfers outside the EEA

Some sub-processors process data outside the European Economic Area, for example in the United States. Those transfers rely on the EU–U.S. Data Privacy Framework where the provider is certified, or on the European Commission’s standard contractual clauses.

8. Helping you meet your obligations

• Customer requests: when a customer asks your store for their data or asks for it to be erased, Shopify forwards the request to us and we send you everything we hold about that customer, or erase it.
• Breaches: if a personal data breach affects your data, we tell you without undue delay and at most 48 hours after we become aware of it, with what we know, what we are doing about it, and what you may need to do.
• Assessments: we give you the information you reasonably need for a data protection impact assessment or a consultation with a supervisory authority.

9. When you stop using Forto

When your store uninstalls Forto, Shopify tells us 48 hours later. We then remove your store’s Shopify access and your customers’ personal details, keeping only the records the law requires us to keep, for as long as it requires.

10. Audits

We give you the information needed to show that we meet this agreement. You, or an auditor bound to confidentiality, may audit our compliance once a year on 30 days’ written notice, at your cost, or at any time after a breach that affects your data.

11. Everything else

Liability under this agreement follows the limits in the Terms of Service. If this agreement and the Terms disagree about personal data, this agreement applies. It is governed by the laws of Denmark, and disputes go to the courts of Copenhagen, as the Terms set out. When this agreement changes, the version and date at the top change with it, and we tell merchants by email before a material change takes effect.

12. Contact

RLD Solutions, trading as Forto
CVR 41171790
Denmark
Email: legal@forto.app