Data Processing Terms
1. Scope and roles
These Data Processing Terms apply to personal information of buyers, recipients and other individuals that a client sends to Fourth Zodiac Inc. (“Fourth Zodiac”) or that Fourth Zodiac receives from a store platform or marketplace for the client (“Buyer Data”). The client decides why and how Buyer Data is processed and is the business, controller or personal-information handler. Fourth Zodiac processes Buyer Data on the client’s behalf as its service provider, contractor or processor.
2. Processing only on instructions
Fourth Zodiac processes Buyer Data only to provide the services: receiving orders, picking, packing, labeling, shipping, tracking, handling buyer returns, invoicing and meeting legal obligations, and as the client otherwise instructs through the Software or in writing. We will tell the client if we believe an instruction breaks the law.
3. Client responsibilities
The client confirms that it has a lawful basis for sending Buyer Data to Fourth Zodiac and has given buyers any notice the law requires. The client sends only the Buyer Data needed for the services, follows the data-protection rules of its marketplaces (for example the Amazon Data Protection Policy), and tells Fourth Zodiac in writing about any marketplace rule that sets a shorter retention period for Buyer Data.
4. US state privacy law terms
Fourth Zodiac will not: sell or share Buyer Data; retain, use or disclose it for any purpose other than the services, or outside the direct business relationship with the client; or combine it with personal information from other sources, except as those laws permit. Fourth Zodiac will comply with the California Consumer Privacy Act and other applicable US state privacy laws, give Buyer Data the same level of protection they require, notify the client if it can no longer meet these obligations, and let the client take reasonable steps to stop and fix unauthorized use.
5. Confidentiality and staff access
Only staff who need Buyer Data for their work can access it, and only through their permissions in the Software. All staff are bound by the Staff Systems Use & Confidentiality Agreement.
6. Security
Fourth Zodiac keeps reasonable technical and organizational measures to protect Buyer Data, including encryption in transit, role- and permission-based access, row-level security, two-step verification, logging with action IDs, and secure disposal of shipping labels and documents that carry Buyer Data.
7. Sub-processors
The client authorizes Fourth Zodiac to use these categories of sub-processors: carriers and last-mile partners; hosting, database and server providers; AI providers; messaging and email providers; and warehouse software providers. Fourth Zodiac binds each one by written data-protection terms and remains responsible for them. Fourth Zodiac announces a new category of sub-processor in the client portal; the client may object on reasonable data-protection grounds within 30 days, and the parties will discuss it in good faith.
8. Requests from individuals
If Fourth Zodiac receives a request from a buyer about Buyer Data, it will pass it to the client and not answer it directly unless the client asks or the law requires. Fourth Zodiac will help the client answer access and deletion requests, including through the privacy request tools in the Software.
9. Security incidents
Fourth Zodiac will notify the client without undue delay, and no later than 72 hours after confirming a security incident that affects the client’s Buyer Data, with the information it has, and will cooperate to contain the incident and meet any notification duties.
10. Retention and deletion
Fourth Zodiac keeps Buyer Data only as long as needed for the services, or for the shorter period the client tells Fourth Zodiac its marketplace rules require. When the services end, Fourth Zodiac will delete or de-identify Buyer Data within 90 days, except records it must keep by law, for a carrier claim or dispute, or under a legal hold; those stay protected under these terms until they are deleted.
11. Information and audits
Fourth Zodiac will give the client the information reasonably needed to show compliance with these terms. The client may audit once a year with 30 days’ written notice, during business hours, at its own cost, and without access to other clients’ data.
12. International transfers
Buyer Data is processed in the United States. If the client sends personal information from another country (for example from mainland China), the client is responsible for meeting that country’s requirements for the transfer, and Fourth Zodiac will sign the standard transfer terms reasonably required for it.
13. Precedence
For Buyer Data, these terms prevail over any other agreement between the client and Fourth Zodiac. Everything else stays governed by those agreements.