Log inBook a demo

Supplier Data Processing Addendum

Last updated

This Supplier Data Protection Addendum (“Addendum”) forms part of the Supplier Terms of Service (together with the other documents applicable to Supplier in the Terms and Policies, the “Agreement”) between GoVyrl, Inc. (dba Carro) (“Carro”) and the merchant or distributor identified at signup (“Supplier”), and applies to Personal Data that Carro discloses to Supplier in connection with order fulfillment through the Services.

Supplier acknowledges that it receives Personal Data under this Addendum through Carro’s authorized transmission of the applicable Retailer, and that Supplier processes such Personal Data as an independent recipient for its own order fulfillment purposes, and not as a Sub-processor or otherwise on behalf of or at the direction of Carro, regardless of how its relationship with the applicable Retailer was established.

This Addendum is incorporated into and subject to the Agreement. Capitalized terms not defined here have the meanings given to them in the Agreement.

1. Definitions

“Carro” means GoVyrl, Inc., dba Carro.

“Consumer” means a customer of a Retailer who places an order for products that Supplier fulfills through the Services.

“Data Protection Laws” means all applicable laws and regulations relating to the Processing of Personal Data that apply to a party in connection with this Addendum, including where applicable the GDPR, UK GDPR, CCPA/CPRA, and other applicable U.S. state privacy laws, as amended or replaced from time to time.

“Personal Data” means the Consumer information Carro discloses to Supplier under Section 2 below.

“Process” or “Processing” means any operation performed on Personal Data, including collection, storage, use, disclosure, and destruction.

“Retailer” means a retailer on the Carro platform whose orders Supplier fulfills.

“Services” means the Carro platform and related services made available to Supplier under the Agreement.

2. Disclosure and Use of Personal Data

2.1. Data Disclosed

In connection with order fulfillment, Carro discloses to Supplier the Personal Data reasonably necessary to fulfill the applicable order, which may include Consumer name, shipping address, order items, and order ID. Consumer email address and phone number are disclosed only where enabled by a Retailer-level setting that is disabled by default.

2.2. Permitted Use

Supplier shall use Personal Data disclosed under this Addendum solely to fulfill orders placed by Consumers, and for no other purpose, including no use for marketing, advertising, or any purpose unrelated to fulfilling the specific order for which the data was disclosed.

2.3. Prohibited Uses

Supplier shall not:

  • Sell, share, rent, or otherwise disclose Personal Data to any third party except as strictly necessary to fulfill the order (e.g., a shipping carrier);
  • Combine Personal Data received under this Addendum with other data Supplier holds about the same individual, except as necessary to fulfill the order;
  • Retain Personal Data longer than necessary to fulfill the order and satisfy any applicable legal, tax, or accounting retention requirement.

2.4. Independent Processing

Supplier acknowledges that it Processes Personal Data disclosed under this Addendum as an independent recipient, and not as a Processor, Service Provider, or Sub-processor of Carro. Supplier is solely responsible for its own compliance with Data Protection Laws with respect to its Processing of Personal Data following receipt, and Carro is not responsible or liable for Supplier's independent Processing of Personal Data following Carro's authorized transmission of such Personal Data to Supplier.

2.5. No Sale or Share

Carro's disclosure of Personal Data to Supplier under this Addendum is made solely to enable order fulfillment, and not in exchange for monetary or other valuable consideration for the Personal Data itself.

2.6. Service Providers

Supplier shall not disclose Personal Data to any third party except as expressly permitted under Section 2.3. Where Supplier engages its own service providers to assist in fulfilling orders (such as shipping carriers), Supplier shall: (a) conduct reasonable due diligence to confirm that each such service provider is capable of protecting the Personal Data; and (b) enter into a written contract with each such service provider that imposes data protection and confidentiality obligations at least as protective as those set out in this Addendum. Supplier remains responsible for its service providers’ Processing of Personal Data.

2.7. Consumer Requests

If Supplier receives a request from a Consumer or other individual seeking to exercise rights under applicable Data Protection Laws with respect to Personal Data received under this Addendum, Supplier shall handle such request as required by applicable Data Protection Laws in its capacity as an independent recipient, and shall provide reasonable cooperation to Carro and the applicable Retailer in connection with any such request to the extent it relates to Carro’s or the Retailer’s own compliance obligations. This Section does not alter Supplier’s status as an independent recipient under Section 2.4.

3. Security

Supplier shall maintain reasonable technical and organizational measures designed to protect Personal Data against unauthorized access, disclosure, alteration, or destruction, consistent with the nature and sensitivity of the Personal Data it receives.

Upon becoming aware of an incident involving unauthorized access to or disclosure of Personal Data received under this Addendum, Supplier shall notify Carro without undue delay and provide reasonably requested cooperation to support Carro's and the affected Retailer's response.

4. Deletion

Supplier shall delete or de-identify Personal Data received under this Addendum once it is no longer needed to fulfill the applicable order and any related returns, warranty, or customer service window has closed and in any event shall delete or de-identify all such Personal Data within thirty (30) days following the earlier of (a) Supplier’s cessation of Processing of such Personal Data, (b) termination or expiration of Supplier’s relationship with Carro, or (c) Carro’s reasonable written request, except in each case where retention is required by applicable law. Upon Carro’s reasonable written request, Supplier shall confirm in writing that it has deleted or de-identified such Personal Data in accordance with this Section, except for copies that are required to be retained by applicable law or that reside solely in routine backup systems pending ordinary-course deletion, which copies shall remain subject to this Addendum until deleted.

5. Confidentiality

Supplier shall treat Personal Data received under this Addendum as confidential and limit access to personnel with a business need to know it in order to fulfill orders. Where Personal Data also constitutes Confidential Information under the Agreement, the exclusions from the definition of Confidential Information in the Agreement do not apply to, and do not reduce Supplier’s obligations with respect to, such Personal Data, and the use and protection requirements of this Addendum control to the extent more restrictive. Supplier’s obligations with respect to Personal Data survive for as long as Supplier retains such Personal Data, notwithstanding any shorter survival period applicable to Confidential Information generally.

6. No Sub-processor Relationship

For the avoidance of doubt, Supplier is not a Sub-processor of Carro, and this Addendum does not create a controller-processor or business-service-provider relationship between Carro and Supplier of the type described in Carro's Retailer Data Processing Addendum. Supplier's independent legal obligations to Consumers and Retailers, if any, are unaffected by this Addendum.

7. Audit and Cooperation

Upon reasonable written request, and no more than once per calendar year absent a suspected incident, Supplier shall provide Carro with information reasonably necessary to confirm compliance with this Addendum. Supplier shall cooperate in good faith with Carro or the applicable Retailer if either reasonably requests that Supplier enter into additional agreements reasonably necessary to protect Personal Data or to comply with applicable Data Protection Laws.

8. Liability

The parties' respective liabilities in connection with this Addendum shall be subject to the limitations of liability, exclusions, and disclaimers set forth in the Terms of Service.

9. Miscellaneous

9.1. Precedence

In the event of a conflict between this Addendum and the Agreement, this Addendum controls solely with respect to the Processing of Personal Data described herein.

9.2. Amendment

Carro may update this Addendum from time to time to reflect changes in Data Protection Laws or Carro's practices. Carro will provide Supplier at least 30 days' advance notice of any material change to this Addendum via email to the Supplier's account contact before the change takes effect. Notices under this Addendum are sent from an address that does not accept replies; any objection must be made as described in Section 9.3(c).

9.3. Acceptance, Objection and Non-Compliance

  • (a) New Suppliers. This Addendum takes effect for a new Supplier upon Supplier's acceptance of it at account registration, by means of a dedicated checkbox, linking to this Addendum, presented alongside acceptance of Carro's Privacy Policy.
  • (b) Existing Suppliers. For a Supplier that accepted the Agreement before this Addendum was first made available, Carro will provide at least 30 days' advance notice of this Addendum via email to the Supplier's account contact, in the same manner as a material change under Section 9.2. No action is required from the Supplier. If Supplier does not object under Section 9.3(c) before the end of that notice period, this Addendum takes effect for Supplier at the end of that period, and Supplier's continued use of the Services constitutes its acceptance of this Addendum. The same applies to any material change notified under Section 9.2.
  • (c) Objection. Supplier may object to this Addendum, or to a material change notified under Section 9.2, by written notice to privacy@getcarro.com before the end of the applicable notice period. Objections sent by any other means, including by reply to a notice email, are not effective.
  • (d) Effect of objection. If Supplier objects under Section 9.3(c), this Addendum, or the applicable updated version, does not take effect for Supplier, and Carro will, within a reasonable time after receiving the objection, disable Supplier's account and remove Supplier's product listings from Retailers' stores. From that point, Carro will not make Personal Data relating to new orders available to Supplier through any channel, including transmission to Supplier's systems, the Supplier dashboard, or any API.
  • (e) Non-compliance. If Supplier fails to comply with this Addendum, Carro may stop making Personal Data relating to new orders available to Supplier, while leaving Supplier's existing product listings in place, until the non-compliance is remedied. This is in addition to any other right or remedy available to Carro under the Agreement. If the non-compliance is not remedied within a reasonable time, Carro may apply the measures described in Section 9.3(d).
  • (f) No retroactive effect. Carro will not withdraw orders placed, or recover Personal Data made available to Supplier, before an objection under Section 9.3(c) or a measure under Section 9.3(e) takes effect. Such Personal Data remains subject to Supplier's obligations under the Agreement and, where applicable, this Addendum, including Section 4.
  • (g) Reinstatement. A Supplier that has objected may later accept this Addendum by written notice to the address in Section 9.3(c), after which Carro will restore Supplier's account and listings within a reasonable time. Objection does not result in a permanent loss of access to the Services.
  • (h) Independent marketplace exposure. Carro has no technical ability to prevent Supplier from continuing to offer or sell products sourced through the Services on Supplier's own independent sales channels (including Supplier's own website or third-party marketplace listings) outside the Services. While Supplier's account is disabled under Section 9.3(d), Supplier shall not offer, list, advertise, or sell any products sourced through the Services on any sales channel outside the Services.

9.4. Governing Law

This Addendum shall be governed by the laws and jurisdiction provisions set forth in the Agreement.