TB3 Log  /  Data Processing Addendum

Data Processing Addendum

Last updated: October 2026

This Data Processing Addendum ("DPA") is an agreement between TB3 LOG CORP, a Florida corporation (Florida document no. P26000036331) located at 2000 NW 133rd Avenue, Unit 2, Miami, FL 33178, USA ("TB3 Log", "we", "us"), and each merchant ("Merchant", "you") that installs or uses the TB3 Log app for Shopify (the "App"). It explains how we process personal data on your behalf when your orders reach us through the App, when our Miami fulfillment center picks, packs and ships them, and when the tracking information goes back to Shopify.

1. Scope and acceptance

This DPA applies to the personal data that we process on your behalf through the App or to provide the Services ("Merchant Personal Data"). It forms part of the App Terms and supplements your Service Agreement, which includes our Terms of Service (together, the "Agreement").

You accept this DPA when you accept the App Terms or sign a Service Agreement that refers to it. It applies however the App is made available to you: as a custom app created for your Store and installed through a link that we send you, or, once available, as a public app on Shopify, including one available only through a direct link. If you need a signed copy of this DPA, write to support@tb3log.com.

2. Definitions

• "Services" means the logistics and fulfillment services that TB3 Log provides to you, such as receiving, storage, pick and pack, shipping and returns.
• "Service Agreement" means your quote or service agreement with TB3 Log for the Services, together with our Terms of Service.
• "Store" means each Shopify store on which you install the App.
• "Recipients" means the people to whom your orders are shipped, usually your customers.
• "Subprocessor" means a third party that we engage to process Merchant Personal Data on our behalf.
• "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration or unauthorized disclosure of, or access to, Merchant Personal Data.
• "Data Protection Laws" means the privacy and data protection laws that apply to the processing of Merchant Personal Data. Depending on where you and your customers are, they may include the EU General Data Protection Regulation (Regulation (EU) 2016/679, the "GDPR"), the UK GDPR and the UK Data Protection Act 2018, the California Consumer Privacy Act, as amended, and its regulations (the "CCPA"), other U.S. state privacy laws, and Brazil's General Data Protection Law (Law No. 13,709/2018, the "LGPD").
• "SCCs" means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021, and "UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner, in the version in force.
• Terms such as "controller", "processor", "data subject", "personal data", "processing", "business", "service provider", "sell" and "share" have the meanings given to them in the applicable Data Protection Laws. "Personal data" includes "personal information" as defined in the CCPA.

3. Roles and responsibilities

For Merchant Personal Data, you are the controller (the "business" under the CCPA and the "controlador" under the LGPD), and TB3 Log is your processor (your "service provider" under the CCPA and your "operador" under the LGPD). If you act as a processor for another company, we act as your subprocessor, and you confirm that the other company has authorized your instructions to us.

You are responsible for:

• having a lawful basis for the processing and giving your customers the notices, and obtaining any consents, that Data Protection Laws require, including for sharing their order details with TB3 Log and the carriers and for the delivery contact described in section 5;
• making sure that your instructions to us comply with Data Protection Laws;
• sending us only the personal data that we need; for example, do not include your customers' personal data in emails to our support team unless it is needed to solve a problem, and never send payment card details or other sensitive personal data;
• your Store's settings, including whether Shopify notifies your customers when an order ships.

We act as an independent controller only for the limited personal data that we need to run our own business, such as the contact details of the people who manage your account, contract and invoices. Our Privacy Policy describes that processing.

4. Processing on your instructions

We process Merchant Personal Data only on your documented instructions, including with regard to international transfers, unless the law requires us to do otherwise. In that case, we will tell you before the processing, unless the law prohibits it. Your documented instructions are the Agreement, this DPA, your use and settings of the App, and the written requests that you send to support@tb3log.com.

You instruct us to process Merchant Personal Data for the purposes listed in Annex 1: to receive and prepare your orders, create shipping labels and dispatch shipments, coordinate deliveries, returns and claims with carriers, send tracking information back to Shopify, support you, keep the App and the Services secure and auditable, and comply with legal obligations. We will tell you promptly if we believe that an instruction infringes Data Protection Laws, and we may suspend the affected processing until you confirm or change the instruction.

We do not:

• sell or share Merchant Personal Data, as "sell" and "share" are defined in the CCPA;
• use Merchant Personal Data for our own purposes, such as advertising, or send marketing to Recipients;
• use your data or your customers' data to create, train or improve artificial intelligence or machine learning models;
• make automated decisions about individuals that have legal or similarly significant effects.

5. Recipients' contact details

We do not contact Recipients directly. If a delivery needs attention, we contact you. You authorize us to give each Recipient's phone number and email address to the carrier of that shipment, so that the carrier can send delivery notices and reach the Recipient about the delivery. We never use Recipients' contact details for marketing or for any other purpose.

6. Confidentiality and security

Only TB3 Log personnel who need access to provide the App and the Services can access Merchant Personal Data. They are bound by confidentiality obligations that continue after their work with us ends, and they are instructed on how to handle personal data under this DPA.

We implement and maintain the technical and organizational measures described in Annex 2 to protect Merchant Personal Data against Security Incidents. We may update these measures over time, but we will not reduce the overall level of protection that they provide.

7. Subprocessors

You give us a general authorization to engage Subprocessors in the categories listed in Annex 3. We will:

• bind each Subprocessor by a written contract that limits its use of Merchant Personal Data to providing its services to us and imposes data protection obligations at least as protective as those in this DPA, as they apply to its services;
• remain responsible to you for each Subprocessor's performance of its obligations;
• send you the list of our current Subprocessors on request, and publish it in Annex 3 before the App becomes publicly available on Shopify;
• notify you of any new or replacement Subprocessor at least 30 days before it starts processing Merchant Personal Data, by email to your Store's contact email and by a notice in the App.

You may object to a new or replacement Subprocessor on reasonable data protection grounds by writing to support@tb3log.com within the notice period. We will discuss your objection in good faith and, where possible, offer an alternative. If we cannot resolve it before the change takes effect, you may stop using the App and end the affected Services by written notice. Fees for Services already performed remain due.

8. Carriers, Shopify and public authorities

Carriers. USPS, UPS, FedEx and DHL Express are not our Subprocessors. They are independent third parties that carry shipments under their own terms, their own privacy notices and the laws that apply to them. When you instruct us to ship an order, we give the carrier of that shipment only the data needed to deliver it: the Recipient's name, company, delivery address, phone number and email address, the package details and, for international shipments, the customs information that the shipment requires.

Shopify. On your instruction, the App sends the carrier, tracking number and tracking link of each shipment back to your Store. Shopify then marks the order as fulfilled and, depending on your settings, notifies your customer, under your own agreement with Shopify.

Public authorities. We disclose Merchant Personal Data to public authorities only when the law requires it, for example customs information for international shipments or a valid legal order. If a public authority asks us for Merchant Personal Data, we will notify you promptly, unless the law prohibits it, and disclose only what we are legally required to disclose. Where the SCCs apply, we will also follow their Clause 15.

9. Requests from individuals

As the controller, you are responsible for responding to requests from your customers and other individuals about their personal data. Taking into account the nature of the processing, we help you as follows:

• if an individual contacts us directly about Merchant Personal Data, we forward the request to you without undue delay and do not respond to it ourselves, other than to confirm that we have forwarded it, unless you ask us to or the law requires it;
• when Shopify forwards a customer's request for their data, we give you the data that we hold about that customer, in a structured, commonly used and machine-readable format, within 30 days;
• when Shopify sends us a request to delete a customer's data, we delete it within 30 days, unless the law requires us to keep it (section 12);
• when you send us other requests at support@tb3log.com, for example to access, correct or delete an individual's data, we act without undue delay and respond within 30 days, or sooner where the law requires, and may ask for information to confirm your identity.

10. Impact assessments and consultations

Taking into account the nature of the processing and the information available to us, we give you reasonable assistance, including information about our processing and security measures, so that you can carry out the data protection impact assessments, risk assessments and prior consultations with supervisory authorities that Data Protection Laws require of you.

11. Security incidents

• We notify Shopify within 24 hours after becoming aware of an actual or suspected incident affecting merchant or customer data, as Shopify's terms require.
• We notify you without undue delay, and no later than 72 hours after confirming a Security Incident that affects your Merchant Personal Data, by email to your Store's contact email. We also give any other notice that the law requires of us.
• Our notice describes, as far as we know at the time, what happened and when, the categories and approximate number of individuals and records affected, the likely consequences, the measures taken or proposed, and a contact person. If we do not have all the information at once, we provide it in phases.
• We take reasonable steps to contain, investigate and mitigate the incident, keep you informed and keep a record of it.
• Unless the law requires us to notify them, you decide whether to notify supervisory authorities and the affected individuals, and we give you the information that you need to do so.

Our notice of a Security Incident is not an admission of fault or liability.

12. Retention, deletion and return

While you use the App and the Services, we keep Merchant Personal Data only for as long as it is needed:

• Recipients' personal data (name, address, phone number and email address): up to 24 months after delivery, to handle returns, carrier claims and disputes.
• Documents for international shipments: up to 5 years, when U.S. export rules require us to keep them.
• Order records from which the Recipient's details and tracking numbers have been removed may be kept for as long as we need them for our billing, accounting and legal records.

At the end of these periods, the data is deleted or anonymized automatically.

Deletion requests. We complete the deletion requests that we receive through Shopify, for a customer or for your Store, within 30 days, unless the law requires us to keep the data.

Uninstalling the App or end of the Services. When you uninstall the App, we delete the data that we received through the App within 30 days of the uninstall. When the Services end, we delete the rest of the Merchant Personal Data within 30 days. In both cases, we keep only what the law requires us to keep. Shopify also sends us a deletion request for your Store 48 hours after you uninstall the App. If you would like a copy of the data first, ask us at support@tb3log.com before you uninstall the App or before the Services end, and we will send it to you in a structured, commonly used and machine-readable format.

Data that the law requires us to keep. If the law requires us to keep part of the data, such as documents for international shipments, we keep only that part, protect it under this DPA, use it only for the purpose required by law and delete it when the requirement ends.

13. Information and audits

On request, we make available the information reasonably necessary to demonstrate our compliance with this DPA, such as a description of our security measures, our list of Subprocessors and answers to reasonable security questionnaires.

If that information is not enough, or if a supervisory authority requires it, you or an independent auditor that you appoint may audit our processing of your Merchant Personal Data, under these conditions:

• you send a written request at least 30 days in advance and agree the scope with us;
• audits take place no more than once every 12 months, unless a supervisory authority requires it or a Security Incident has affected your Merchant Personal Data;
• the auditor is bound by confidentiality and is not a competitor of TB3 Log;
• audits take place during business hours, without disrupting our operations or exposing other clients' data;
• you bear the costs of the audit.

These conditions also apply, as far as the law allows, to audits under the SCCs and to the reasonable and appropriate steps that the CCPA allows you to take.

14. International transfers

We host the App and its database in the United States. Our operations and support team works in Brazil and accesses Merchant Personal Data remotely, with the protections described in Annex 2.

European Union. Where the GDPR applies to a transfer of Merchant Personal Data to us, the SCCs are incorporated into this DPA by reference, with you as data exporter and TB3 Log as data importer, as follows:

• Module Two (controller to processor) applies when you are a controller, and Module Three (processor to processor) applies when you act as a processor;
• Clause 7 (docking clause) and the optional language in Clause 11(a) do not apply;
• in Clause 9(a), Option 2 (general written authorization) applies, with the notice period set out in section 7;
• in Clause 13, the competent supervisory authority is the one identified in Annex 1;
• in Clause 17, Option 1 applies, and the SCCs are governed by the law of Ireland; in Clause 18(b), disputes are resolved by the courts of Ireland;
• Annexes I, II and III of the SCCs are completed with the information in Annexes 1, 2 and 3 of this DPA.

United Kingdom. Where the UK GDPR applies to a transfer of Merchant Personal Data to us, the SCCs apply as amended by the UK Addendum. Tables 1 to 3 of the UK Addendum are completed with the information in this DPA and its Annexes, and, in Table 4, neither party may end the UK Addendum when the approved Addendum changes.

By accepting this DPA, you and TB3 Log are treated as having signed the SCCs and, where it applies, the UK Addendum, including their annexes. If they conflict with this DPA, the SCCs and the UK Addendum prevail. If a transfer mechanism stops being valid, we will work with you to adopt a valid alternative.

15. California and other U.S. state privacy laws

For personal information subject to the CCPA, TB3 Log is your service provider. You disclose personal information to us only for the limited and specified business purposes listed in Annex 1. We will not:

• sell or share the personal information;
• retain, use or disclose it for any purpose, including any commercial purpose, other than those business purposes, or as otherwise permitted by the CCPA;
• retain, use or disclose it outside the direct business relationship between you and TB3 Log;
• combine it with personal information that we receive from or on behalf of anyone else, or that we collect from our own interactions with consumers, except as the CCPA permits for a business purpose.

We will comply with the obligations that the CCPA places on service providers and provide the same level of privacy protection that the CCPA requires of businesses. We will notify you if we determine that we can no longer meet these obligations. You may take reasonable and appropriate steps to ensure that we use the personal information in a manner consistent with your obligations under the CCPA, including through the information and audits in section 13, and, after notifying us, to stop and remediate any unauthorized use. Our Subprocessors are bound by the same restrictions (section 7).

Where other U.S. state privacy laws apply, TB3 Log acts as your processor under this DPA.

16. Brazil (LGPD)

The LGPD may apply to the processing carried out in Brazil, including remote access by our team there. Where it applies, you are the controller (controlador) and TB3 Log is the processor (operador). We will process Merchant Personal Data according to your lawful instructions and the LGPD, apply the security measures in Annex 2, notify you of Security Incidents as described in section 11 so that you can meet any obligation to notify the Brazilian data protection authority (ANPD) and data subjects, and help you respond to data subjects' requests as described in section 9. If the LGPD requires a specific mechanism for an international transfer related to the App or the Services, such as the standard contractual clauses approved by the ANPD, we will work with you to put it in place.

17. Liability and order of precedence

TB3 Log's liability under this DPA is subject to Section 16 of the App Terms, except where Data Protection Laws or the SCCs do not allow liability to be limited, such as liability towards data subjects under the SCCs.

If there is a conflict about the processing of personal data, the following order applies: first, the SCCs and the UK Addendum, where they apply; second, this DPA; and third, the App Terms and the Service Agreement, including our Terms of Service. In all other respects, the Agreement remains unchanged.

18. Duration, changes and governing law

This DPA applies from the time we first process Merchant Personal Data and remains in effect for as long as we process it, including during the retention and deletion periods in section 12.

We may update this DPA, for example to reflect changes in the law, in the App or in our Subprocessors. We will notify you of important changes by email to your Store's contact email and by a notice in the App, at least 30 days before they take effect, whenever possible. Changes required by law may take effect sooner. If you do not agree with a change, you may stop using and uninstall the App before the change takes effect.

This DPA is governed by the laws of the State of Florida, USA, and the state and federal courts located in Miami-Dade County, Florida, have exclusive jurisdiction over disputes about it, except where Data Protection Laws or the SCCs require a different governing law or forum.

19. Contact

For questions about this DPA, requests about personal data or to report a security concern, contact TB3 LOG CORP, 2000 NW 133rd Avenue, Unit 2, Miami, FL 33178, USA, at support@tb3log.com or by WhatsApp at +55 21 97533-7316 (calls and messages). Our support hours are on our Support page.

Annex 1. Details of the processing

Data exporter. The merchant that uses the App, identified by its Store and by the contact details in the App and in the Service Agreement. Contact: the Store's contact email. Role: controller, or processor on behalf of another controller.

Data importer. TB3 LOG CORP, 2000 NW 133rd Avenue, Unit 2, Miami, FL 33178, USA. Contact: support@tb3log.com. Role: processor and service provider.

Subject matter. The fulfillment of the merchant's orders: receiving them through the App; picking, packing and shipping them from the TB3 Log fulfillment center in Miami; coordinating deliveries, returns and claims with carriers; and sending tracking information back to Shopify.

Nature of the processing. Receiving, recording, storing, organizing, viewing, using, disclosing to carriers and to Shopify, and deleting or anonymizing data. The App uses only the access that the merchant approves when installing it: reading orders, reading and updating fulfillment orders (those managed by the merchant and those assigned to TB3 Log) and creating fulfillments with tracking information. It does not request access to the merchant's products or customer list. Order permissions also cover payment details; the App uses only whether an order is paid and does not read card or other payment details.

Purposes (the business purposes under the CCPA).

• Receiving and preparing orders.
• Creating shipping labels and dispatching shipments.
• Coordinating deliveries, returns and claims with carriers, including sharing Recipients' contact details with carriers as described in section 5.
• Sending tracking information back to Shopify.
• Supporting the merchant.
• Keeping the App and the Services secure and auditable.
• Complying with legal obligations.

Categories of data subjects. The merchant's customers and other Recipients of its orders.

Categories of personal data.

• Order data: order number, items, variants, SKUs, quantities, shipping method and fulfillment status.
• Recipient data: name, company, delivery address, phone number and email address.
• Shipment data: carrier, tracking number and tracking link.
• Activity records: records of which orders were viewed or changed in our internal system, and when.
• Communications: Recipient details that you include in support requests sent to us by email or WhatsApp.

We process your Store's details and the contact details of your staff as an independent controller (section 3), so they are not listed here.

Sensitive data. None is intended. The App does not request special categories of personal data. In some cases, the products in an order may indirectly reveal information about a Recipient; we use that information only to fulfill the order.

Frequency. Continuous, as orders are received.

Duration and retention. For as long as we provide the App and the Services, subject to the retention and deletion rules in section 12.

Subprocessors. See Annex 3.

Competent supervisory authority. Where the SCCs apply, the supervisory authority determined under their Clause 13, based on where the merchant is established or, if it is not established in the European Union, where its representative in the European Union is established or where the data subjects concerned are located. Where the UK Addendum applies, the UK Information Commissioner.

Annex 2. Technical and organizational measures

• Encryption. Data is encrypted in transit (TLS) and at rest, including backups.
• Need-to-know access. Only personnel who need Merchant Personal Data for their work can access it, and only to the extent needed. Access is removed when it is no longer needed.
• Individual accounts. One account per person, with no shared logins, a strong password and two-step verification.
• Access logs. We record who viewed or changed each order, and when, and we review these records every month.
• Data loss prevention. No bulk exports of names and addresses.
• Data minimization. The App requests only the access it needs and does not request access to the merchant's products or customer list. Order permissions also cover payment details; the App uses only whether an order is paid and does not read card or other payment details.
• Separate environments. Test data is kept separate from production data, and real orders are not copied into test or development environments.
• Retention. Personal data is deleted or anonymized automatically at the end of the retention periods in section 12.
• Remote access. Our team in Brazil works under the same controls: individual accounts with two-step verification, encrypted connections, need-to-know access, access logs and no bulk exports.
• Incident response. An incident response plan sets out severity levels, responsibilities, evidence collection and the notices to Shopify and to affected merchants described in section 11.
• Personnel. Personnel with access are bound by confidentiality and instructed on these measures.
• Subprocessors. Subprocessors are bound by written contracts with security obligations appropriate to their services (section 7).

Annex 3. Subprocessors

We list our Subprocessors by category. The names of the providers that we use are available on request at support@tb3log.com and will be published in this Annex before the App becomes publicly available on Shopify. Changes are notified as described in section 7.

• Cloud hosting. Runs the App and our internal system. Location: United States. Data: the categories in Annex 1.
• Database and backups. Stores the App's data and its encrypted backups. Location: United States. Data: the categories in Annex 1.
• Email and messaging services, including WhatsApp. Used by our team to communicate with you. Location: stated in the list of providers. Data: contact details and the content of messages, which may include Recipient details that you send us.

Carriers (USPS, UPS, FedEx and DHL Express) and Shopify are not our Subprocessors (see section 8).