Data processing agreement
DRAFT — under review, version 2026-09-25. Not reviewed by a lawyer and not in force. Article references are to the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"). Points still to be settled are marked <<DECIDE>>.
Between Motif Labs, a sole proprietorship (eenmanszaak) of Mike Bonenkamp, trading as Pikamon EU and Heimdall TCG, Molendijk 3A, 4156 AR Rumpt, the Netherlands, Chamber of Commerce (KvK) 72633565, VAT NL002417068B69, info@pikamon.eu ("Processor", "we"), and the organisation that has an account on the shipping portal ("Controller", "you").
This agreement is part of the terms of service and prevails over them on anything about personal data.
1. Roles
You are the controller of your buyers' personal data. We process it only to run the shipping portal for you. We are a controller in our own right for one thing only — the accounts of your staff who sign in — and that is covered by the privacy notice, not by this agreement.
2. Subject matter, data and purposes (Annex 1)
| |
|---|
| Subject matter | the shipping portal: preparing, buying and printing parcel labels for your orders |
| Data subjects | your buyers and the people parcels are addressed to; your own staff who use the portal |
| Personal data | name, company name, street, postcode, city, country, phone, email; order lines, values and currency; parcel weight, box and declared value; carrier, service, tracking number and label; customs description and tariff code for parcels leaving the EU |
| Special categories | none. Do not put special-category data (Art. 9) in an order note or address field |
| Purposes | comparing carrier rates, buying labels, producing labels, packing slips and customs invoices, printing them, and keeping the record of what was shipped |
| Duration | the term of the service, plus the retention in §7 |
3. Our obligations (Art. 28(3))
- Instructions. We process your data only on your documented instructions. Using the portal is the instruction; anything else is agreed in writing. If we think an instruction breaks data protection law we say so before carrying it out.
- Confidentiality. Everyone with access is bound to confidentiality.
- Security. We keep the measures in §6.
- Sub-processors. §5.
- Data subject requests. We help you answer them. The portal can export all of one organisation's shipping data and erase the personal data in it; a request for a single buyer is handled by us on request.
- Your other duties. We help with your obligations under Art. 32–36 (security, breach notification, impact assessments, prior consultation) as far as the information is ours to give.
- End of the service. §7.
- Audits. We give you the information you need to show that this agreement is kept, and accept one audit a year on 30 days' notice, by you or an auditor bound to confidentiality, at your cost unless it finds a material breach
<<DECIDE: audit terms>>.
4. Personal data breaches
We notify you without undue delay and at most 48 hours after becoming aware of a personal data breach affecting your data, with what we know: what happened, which data, roughly how many people, and what we are doing about it. We do not notify your supervisory authority or your buyers — that is yours to decide, and your 72 hours run from our notice.
5. Sub-processors
You give general authorisation for the sub-processors on the sub-processor list. We may engage another one on 30 days' written notice (email and an update of that list). You may object on reasonable data protection grounds within that period; if we cannot resolve the objection, you may end the affected service without penalty.
Every sub-processor is bound to data protection terms no less protective than these. We remain responsible to you for what they do.
A carrier is different. Once a parcel is booked, the carrier delivering it acts as a controller in its own right for the delivery — it has to, to run a delivery network. We pass the recipient's details to the carrier your parcel is booked with; what it does with them after that is governed by its own terms and privacy notice.
6. Security measures (Art. 32)
What is in place today:
- The portal runs in a container on an EU host with a private storage volume; personal data is not kept on anyone's laptop.
- Sign-in with Google or GitHub, or with a password protected by a rate limit; every sign-in is recorded and visible to the operator.
- Data is separated per organisation: orders, history, labels, print devices and print jobs are only answered for the signed-in organisation, and another organisation's records read as "not found".
- Label files are stored per organisation; a file path cannot be used to read another organisation's label.
- Label buying can be switched off per organisation at once, and carrier calls are rate-limited per organisation.
- An organisation's data can be exported in full and its personal data erased.
- Nightly backups, encrypted with a key only we hold before they leave the host, kept for 14 days (daily) and 90 days (weekly), with an encrypted copy in object storage in Western Europe.
- Every change passes an automated test suite and review before it is deployed.
Known limits:
- We hold no ISO 27001 or SOC 2 certification.
- The data is on one host in one region, with no hot standby. Recovery is from the nightly backup, which has been test-restored.
- The portal is operated by a very small team.
7. Return and deletion
When the service ends, or on request, we give you an export of your data if you ask for it, then delete your personal data within 30 days and confirm it in writing. Two exceptions:
- Backups. A backup cannot be edited. Deleted data disappears from backups as they age out — 90 days at most — and until then it could only be restored as a whole, which we would not do without telling you.
- What the law makes us keep. A bought label is a line on an invoice, and Dutch tax law requires seven years of records. The shipment record — what was shipped, to which country, when, for how much — is kept for that period (Art. 6(1)(c)). Recipient names, street addresses, phone numbers and emails are not needed for it and are erased
<<DECIDE with the accountant: whether the customs invoice, which carries a name and address, must be kept>>.
8. Transfers outside the EEA
We keep your data in the European Economic Area: the portal runs on an EU host and the backup copy is stored in Western Europe, encrypted before upload.
Some features of the portal that use an AI service outside the EEA — reading an address from a screenshot, and reading an uploaded invoice — are switched off for your organisation, so your data is not sent to it. No shipping function depends on them.
A carrier delivering a parcel to a country outside the EEA necessarily passes the recipient's details to that country; that follows from your instruction to ship there (see §5 on carriers).
If any other transfer ever becomes necessary we tell you first under §5 and rely on an adequacy decision or the EU Standard Contractual Clauses.
9. Law and courts
This agreement is governed by the law of the Netherlands. Disputes go to the competent court in <<DECIDE: Rotterdam?>>, without prejudice to a data subject's rights under Art. 79.
Annex 1 is §2 above. Annex 2 is the sub-processor list.