Log inBook a demo

Supplier Data Processing Addendum

Last updated

This Supplier Data Processing Addendum (the “Supplier Data Processing Addendum” or “Supplier DPA”) is part of the Terms and Policies. We encourage you to review them. This Supplier DPA applies to Personal Data that Carro discloses to Supplier in connection with order fulfillment through the Services, and it can be modified as set forth below.

Supplier acknowledges that it receives Personal Data under this Supplier DPA through Carro’s authorized transmission of the applicable Retailer, and that Supplier processes such Personal Data as an independent recipient for its own order fulfillment purposes, and not as a Sub-processor or otherwise on behalf of or at the direction of Carro, regardless of how its relationship with the applicable Retailer was established.

This Supplier DPA is incorporated into and subject to the Terms and Policies. Capitalized terms not defined here have the meanings given to them in the Terms and Policies.

1. Definitions

“Carro” means GoVyrl, Inc., dba Carro.

“Consumer” means a customer of a Retailer who places an order for products that Supplier fulfills through the Services.

“Data Protection Laws” means all applicable laws and regulations relating to the Processing of Personal Data that apply to a party in connection with this Supplier DPA, including where applicable the GDPR, UK GDPR, CCPA/CPRA, and other applicable U.S. state privacy laws, as amended or replaced from time to time.

“Personal Data” means the Consumer information Carro discloses to Supplier under Section 2 below.

“Process” or “Processing” means any operation performed on Personal Data, including collection, storage, use, disclosure, and destruction.

“Retailer” means a retailer on the Carro platform whose orders Supplier fulfills.

“Services” means the Carro platform and related services made available to Supplier under the Terms and Policies.

2. Disclosure and Use of Personal Data

2.1. Data Disclosed

In connection with order fulfillment, Carro discloses to Supplier the Personal Data reasonably necessary to fulfill the applicable order, which may include Consumer name, shipping address, order items, and order ID. Consumer email address and phone number are disclosed only where enabled by a Retailer-level setting that is disabled by default.

2.2. Permitted Use

Supplier shall use Personal Data disclosed under this Supplier DPA solely to fulfill orders placed by Consumers, and for no other purpose, including no use for marketing, advertising, or any purpose unrelated to fulfilling the specific order for which the data was disclosed.

2.3. Prohibited Uses

Supplier shall not:

  • Sell, share, rent, or otherwise disclose Personal Data to any third party except as strictly necessary to fulfill the order (e.g., a shipping carrier);
  • Combine Personal Data received under this Supplier DPA with other data Supplier holds about the same individual, except as necessary to fulfill the order;
  • Retain Personal Data longer than necessary to fulfill the order and satisfy any applicable legal, tax, or accounting retention requirement.

2.4. Independent Processing

Supplier acknowledges that it Processes Personal Data disclosed under this Supplier DPA as an independent recipient, and not as a Processor, Service Provider, or Sub-processor of Carro. Supplier is solely responsible for its own compliance with Data Protection Laws with respect to its Processing of Personal Data following receipt, and Carro is not responsible or liable for Supplier's independent Processing of Personal Data following Carro's authorized transmission of such Personal Data to Supplier.

2.5. No Sale or Share

Carro's disclosure of Personal Data to Supplier under this Supplier DPA is made solely to enable order fulfillment, and not in exchange for monetary or other valuable consideration for the Personal Data itself.

2.6. Service Providers

Supplier shall not disclose Personal Data to any third party except as expressly permitted under Section 2.3. Where Supplier engages its own service providers to assist in fulfilling orders (such as shipping carriers), Supplier shall: (a) conduct reasonable due diligence to confirm that each such service provider is capable of protecting the Personal Data; and (b) enter into a written contract with each such service provider that imposes data protection and confidentiality obligations at least as protective as those set out in this Supplier DPA. Supplier remains responsible for its service providers’ Processing of Personal Data.

2.7. Consumer Requests

If Supplier receives a request from a Consumer or other individual seeking to exercise rights under applicable Data Protection Laws with respect to Personal Data received under this Supplier DPA, Supplier shall handle such request as required by applicable Data Protection Laws in its capacity as an independent recipient, and shall provide reasonable cooperation to Carro and the applicable Retailer in connection with any such request to the extent it relates to Carro’s or the Retailer’s own compliance obligations. This Section does not alter Supplier’s status as an independent recipient under Section 2.4.

3. Security

Supplier shall maintain reasonable technical and organizational measures designed to protect Personal Data against unauthorized access, disclosure, alteration, or destruction, consistent with the nature and sensitivity of the Personal Data it receives.

Upon becoming aware of an incident involving unauthorized access to or disclosure of Personal Data received under this Supplier DPA, Supplier shall notify Carro without undue delay and provide reasonably requested cooperation to support Carro's and the affected Retailer's response.

4. Deletion

Supplier shall delete or de-identify Personal Data received under this Supplier DPA once it is no longer needed to fulfill the applicable order and any related returns, warranty, or customer service window has closed and in any event shall delete or de-identify all such Personal Data within thirty (30) days following the earlier of (a) Supplier’s cessation of Processing of such Personal Data, (b) termination or expiration of Supplier’s relationship with Carro, or (c) Carro’s reasonable written request, except in each case where retention is required by applicable law. Upon Carro’s reasonable written request, Supplier shall confirm in writing that it has deleted or de-identified such Personal Data in accordance with this Section, except for copies that are required to be retained by applicable law or that reside solely in routine backup systems pending ordinary-course deletion, which copies shall remain subject to this Supplier DPA until deleted.

5. Confidentiality

Supplier shall treat Personal Data received under this Supplier DPA as confidential and limit access to personnel with a business need to know it in order to fulfill orders. Where Personal Data also constitutes Confidential Information under the Terms and Policies, the exclusions from the definition of Confidential Information in the Terms and Policies do not apply to, and do not reduce Supplier’s obligations with respect to, such Personal Data, and the use and protection requirements of this Supplier DPA control to the extent more restrictive. Supplier’s obligations with respect to Personal Data survive for as long as Supplier retains such Personal Data, notwithstanding any shorter survival period applicable to Confidential Information generally.

6. No Sub-processor Relationship

For the avoidance of doubt, Supplier is not a Sub-processor of Carro, and this Supplier DPA does not create a controller-processor or business-service-provider relationship between Carro and Supplier of the type described in Carro's Retailer Data Processing Addendum. Supplier's independent legal obligations to Consumers and Retailers, if any, are unaffected by this Supplier DPA.

7. Audit and Cooperation

Upon reasonable written request, and no more than once per calendar year absent a suspected incident, Supplier shall provide Carro with information reasonably necessary to confirm compliance with this Supplier DPA. Supplier shall cooperate in good faith with Carro or the applicable Retailer if either reasonably requests that Supplier enter into additional agreements reasonably necessary to protect Personal Data or to comply with applicable Data Protection Laws.

8. Liability

The parties' respective liabilities in connection with this Supplier DPA shall be subject to the limitations of liability, exclusions, and disclaimers set forth in the Terms and Policies.

9. Miscellaneous

9.1. Precedence

In the event of a conflict between this Supplier DPA and the Terms and Policies, this Supplier DPA controls solely with respect to the Processing of Personal Data described herein.

9.2. Amendment

Carro may update this Supplier DPA from time to time, including, but not limited, to reflect changes in Data Protection Laws or Carro's practices. This Supplier DPA will be considered to be amended upon Carro replacing it with a new or modified Supplier DPA, and you continuing to use or access the Service after that posting of that new or modified Supplier DPA, at which point you will be deemed to have agreed to that new or modified Supplier DPA; provided that Carro will provide Supplier at least 30 days' advance notice of any material change to this Supplier DPA via email to the Supplier's account contact before the change takes effect. Notices under this Supplier DPA are sent from an address that does not accept replies; any objection must be made as described in Section 9.3.

9.3. Acceptance, Objection and Non-Compliance

  • (a) Material Change Notices. With respect to material changes to this Supplier DPA for which Carro provides Supplier with at least 30 days' advance notice, no action is required from Supplier. If Supplier does not object as described below before the end of that notice period, those material changes to the Supplier DPA will take effect for Supplier at the end of that period, and Supplier's continued use of the Services constitutes its acceptance of this Supplier DPA and, after such 30 days, such material changes thereto.
  • (b) Objections. Supplier may object to a material change notified under Section 9.2, by written notice to privacy@getcarro.com before the end of the applicable notice period. Objections sent by any other means, including by reply to a notice email, are not effective.
  • (c) Effect of objection. If Supplier objects as described in Section 9.3(b) above, the material changes will not take effect for Supplier, and Carro may, within a reasonable time after receiving the objection, disable Supplier's account and remove Supplier's product listings from Retailers' stores. From that point, Carro may stop making Personal Data relating to new orders available to Supplier through any channel, including transmission to Supplier's systems, the Supplier dashboard, or any API.
  • (d) Non-compliance. If Supplier fails to comply with this Supplier DPA, Carro may stop making Personal Data relating to new orders available to Supplier, while leaving Supplier's existing product listings in place, until the non-compliance is remedied. This is in addition to any other right or remedy available to Carro under the Terms and Policies. If the non-compliance is not remedied within a reasonable time, Carro may apply the measures described in Section 9.3(c).
  • (e) No retroactive effect. Carro may not withdraw orders placed, or recover Personal Data made available to Supplier, before an objection under Section 9.3(b) or a measure under Section 9.3(d) takes effect. Such Personal Data remains subject to Supplier's obligations under the Terms and Policies and, where applicable, this Supplier DPA, including Section 4.
  • (f) Reinstatement. A Supplier that has objected may later accept this Supplier DPA by written notice to the address in Section 9.3(b), after which Carro will restore Supplier's account and listings within a reasonable time. Objection does not result in a permanent loss of access to the Services.
  • (g) Independent marketplace exposure. Carro has no technical ability to prevent Supplier from continuing to offer or sell products sourced through the Services on Supplier's own independent sales channels (including Supplier's own website or third-party marketplace listings) outside the Services. While Supplier's account is disabled under Section 9.3(c), Supplier shall not offer, list, advertise, or sell any products sourced through the Services on any sales channel outside the Services.

9.4. Governing Law

This Supplier DPA shall be governed by the laws and jurisdiction provisions set forth in the Terms and Policies.