Data processing agreement

Last updated: 9 November 2026. Part of the terms of service; it applies automatically when you install Trackrobin.

This agreement is between the merchant (“controller”) and WS SOLUTIONS LLC, 5830 E 2nd St, Casper, WY 82609, United States (“processor”), under Art. 28 GDPR, UK GDPR and comparable laws.

1. Subject and duration

The processor processes personal data of the controller's customers to provide order tracking, the tracking page and shipping notifications, for as long as the app is installed and until deletion under section 8.

2. Data and data subjects

Customers of the controller's store: name, email address, phone number, shipping country and address, order number, ordered items, tracking numbers and shipping events, and the messages they send through the tracking page (returns, reviews, claims).

3. Instructions

The processor processes the data only on documented instructions of the controller, given through the app settings and these terms, unless the law requires otherwise; it informs the controller if an instruction appears unlawful. The processor does not sell personal data or use it for its own purposes.

4. Confidentiality

Persons authorised to process the data are bound to confidentiality. Access is limited to the people who operate the service.

5. Security

The processor applies the measures described on the security page, including encryption in transit and at rest, encrypted backups, access control with two-factor authentication, logging and an incident response process.

6. Subprocessors

The controller authorises the subprocessors listed in section 4 of the privacy policy. New subprocessors are announced on that page at least 14 days in advance; the controller may object by email and uninstall the app. The processor imposes equivalent data protection obligations on its subprocessors. Transfers outside the EEA rely on adequacy decisions or the EU Standard Contractual Clauses.

7. Assistance

The processor assists the controller with data subject requests, security, breach notifications and data protection impact assessments, as far as the nature of the processing allows. Customer data requests and deletions are also handled automatically through Shopify's GDPR webhooks.

8. Deletion

Data is deleted as described in section 5 of the privacy policy, and in full within 48 hours of Shopify's shop-redact request after uninstall. Backups expire after 7 days.

9. Breaches

The processor notifies the controller without undue delay, at the latest within 48 hours, after becoming aware of a personal data breach affecting the controller's data, with the information the controller needs for its own notifications.

10. Audits

The processor makes available the information needed to demonstrate compliance and answers reasonable audit requests in writing.

Contact: privacy@trackrobin.com