SOS LABELS — DATA PROTECTION ADDENDUM
Effective Date: October 15, 2026
This Data Protection Addendum (“DPA”) forms part of the Merchant Services Agreement or another written services agreement incorporating this DPA (“Agreement”) between SOS LABELS LLC (“SOS”) and the participating merchant identified in that Agreement (“Merchant”). It applies when SOS processes personal information on the Merchant’s behalf to provide the agreed Services (“Merchant Personal Data”).
This DPA takes effect through the Merchant’s recorded acceptance of the Agreement or separate express acceptance. Its obligations apply to the extent relevant data-protection law governs the processing. It does not represent that any particular statute applies to every Merchant or that SOS holds a security certification.
01. Roles and Scope
For Merchant Personal Data processed solely on the Merchant’s behalf, the Merchant determines the purposes and means of processing and SOS acts as a processor or service provider, as those roles are defined under applicable law.
SOS may also process limited information for purposes it independently determines, such as administering SOS’s own protection obligations, maintaining required financial records, handling legal claims, or meeting legal obligations. Those activities are governed by applicable law and the SOS Privacy Policy. Roles depend on the actual activity and applicable law; describing the parties’ roles here does not override that analysis.
SOS must not use a processor designation to avoid responsibilities applicable to processing it independently controls.
02. Processing Description
Subject matter and purpose: Operating the agreed Shopify integration and merchant reporting, identifying protected purchases, supporting claim review and customer communications, arranging replacement orders and fulfillment, and carrying out related merchant support.
Activities: Receiving, recording, organizing, accessing, using, transmitting, storing, correcting, returning, deleting, and de-identifying information as necessary for those purposes and lawful instructions.
Individuals: Customers, recipients of protected shipments, claim submitters, and merchant business representatives.
Data categories: Names and contact details; delivery addresses; order and protection identifiers; products, quantities, prices, discounts, and transaction confirmation; tracking and fulfillment data; replacement records; claim descriptions, relevant photographs and correspondence; and limited technical information necessary for the agreed Services.
Data not requested: Government identification documents, payment card numbers in claim materials, and unrelated sensitive information. The Merchant must not intentionally send unnecessary sensitive data. If such information is received inadvertently, the parties will take reasonable steps to restrict access and securely remove or otherwise lawfully handle it.
Duration: During the relationship and any necessary period for outstanding protected orders, followed by return, deletion, or legally permitted retention as described below.
03. Documented Instructions
SOS will process Merchant Personal Data only on documented lawful instructions, including the Agreement, this DPA, the agreed integration configuration, and authorized service requests, unless law requires otherwise. The Merchant is responsible for the lawfulness of its instructions and for providing required notices and obtaining any required permissions.
SOS will notify the Merchant if it reasonably believes an instruction infringes applicable data-protection law. The parties will cooperate to resolve the issue, and affected processing may be suspended while necessary. If processing is legally required beyond the instructions, SOS will inform the Merchant before that processing unless law prohibits notice.
SOS will not collect or retain more Merchant Personal Data than is reasonably necessary for the agreed purpose.
04. Confidentiality and Security
SOS must restrict access to authorized personnel and providers who need the information for permitted purposes and are subject to appropriate confidentiality obligations.
SOS must implement and maintain administrative, technical, and organizational measures appropriate to the risk, including access management, credential protection, protection of data in transit and storage, secure configuration and maintenance, incident handling, and secure deletion procedures. Measures must be assessed against the nature, scope, context, and purposes of processing and the risks to individuals.
Before production onboarding, SOS will provide the Merchant with a current description of the safeguards actually deployed and material processing locations. This DPA creates contractual obligations; it is not a statement that a particular encryption configuration, audit report, or certification has already been verified.
The Merchant remains responsible for its own store configuration, authorized users, lawful data collection, and secure use of the integration.
05. Subprocessors
SOS may use subprocessors reasonably necessary to provide the Services, subject to this section. Before transferring Merchant Personal Data to a subprocessor, SOS must impose written obligations providing materially equivalent protection for the relevant processing and remain responsible to the Merchant for the subprocessor’s performance of those obligations.
Before production onboarding, SOS must provide a current subprocessor register identifying each relevant provider, its function, and processing location. A Merchant’s separate platform or carrier is not automatically an SOS subprocessor merely because the Services interact with it; the role depends on the actual arrangement.
After the initial register is disclosed, SOS will give reasonable prior written notice of a proposed addition or replacement and a reasonable opportunity for the Merchant to object on substantiated data-protection grounds. The parties will seek a practical resolution before the new provider processes the affected data. If no resolution is available, the Merchant may terminate the affected service without a new termination charge, subject to lawful completion of existing customer obligations.
This DPA does not authorize use of undisclosed subprocessors before the required initial disclosure.
06. Individual Requests
SOS will promptly inform the Merchant of a request relating to Merchant Personal Data where the Merchant is responsible for responding, unless law prohibits notice. SOS will provide reasonable assistance with access, correction, deletion, portability, objections, restrictions, and other applicable rights, taking account of the processing and available information.
SOS will not independently resolve a request on the Merchant’s behalf unless instructed or legally required. Requests involving information SOS independently controls will be addressed by SOS under its Privacy Policy and applicable law.
Verification should use relevant order, account, or request information. Government-issued identification is not part of SOS’s standard claims process.
07. Personal Data Incidents
SOS will notify the Merchant without undue delay after becoming aware of a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Merchant Personal Data processed under this DPA.
The notice will include available information reasonably needed for the Merchant’s response, including the nature of the incident, affected data and individuals where known, likely consequences, mitigation measures, and a contact for follow-up. Information may be provided in phases as reasonably available.
SOS will investigate, contain, remediate, preserve relevant evidence, and cooperate with legally required notifications. Notice is not an admission of liability. Neither party may delay a notification required by law while awaiting the other party’s approval. Routine unsuccessful attempts that do not compromise personal information do not automatically constitute a reportable personal data breach.
08. Compliance Assistance and Verification
Taking account of the processing and information available to it, SOS will reasonably assist the Merchant with applicable security obligations, breach response, data-protection impact assessments, and required regulator consultations.
SOS will make available information reasonably necessary to demonstrate compliance with this DPA and permit proportionate audits or inspections required by applicable law. The parties will first use relevant documentation where sufficient. Any further review must protect other customers’ information, confidentiality, and system security and avoid unreasonable disruption. These arrangements must not prevent a legally required audit or regulator access.
The parties may agree reasonable logistics and responsibility for exceptional audit costs in advance; no unspecified fee prevents an individual-rights response or other legally required assistance.
09. Retention, Return, and Deletion
SOS will follow documented lawful return or deletion instructions for data processed on the Merchant’s behalf, subject to ongoing protected-order obligations and legally required retention. Upon termination, the Merchant may request return or deletion. Data no longer necessary for an authorized purpose must not be retained indefinitely.
The standard schedule in the SOS Privacy Policy provides for deletion or de-identification of detailed customer and order information 12 months after delivery or final claim resolution, whichever is later, and deletion of claim evidence and correspondence 12 months after final resolution. A shorter applicable legal deadline or valid instruction must be honored unless retention is lawfully required or otherwise justified under the parties’ actual roles.
Financial, tax, dispute, and legal-hold records may be retained only to the extent and for the period reasonably necessary or required. SOS must identify the retained categories and basis when responding to a relevant Merchant request, unless disclosure is prohibited by law.
Restricted backups may retain deleted data until normal expiration, without ordinary business use. If restored, applicable deletion instructions must be reapplied. SOS will confirm completion of a lawful deletion or return request on reasonable request, identifying any permitted retention exception.
10. International Transfers
SOS is based in the United States. Processing locations and provider locations must be disclosed as part of onboarding and maintained accurately.
Where a transfer requires an adequacy decision, approved contractual terms, or another lawful transfer mechanism, the parties must document and implement that mechanism and any required supplementary measures before the affected transfer begins. This DPA does not itself execute EU Standard Contractual Clauses, a UK transfer addendum, or a certification-based transfer mechanism. Those instruments require the appropriate parties, completed details, and a valid basis for use.
SOS must not initiate an affected transfer until its applicable requirements are satisfied. Supporting global merchants does not remove location-specific requirements.
11. U.S. Service-Provider Restrictions
Where U.S. privacy law treats SOS as a processor, contractor, or service provider, SOS will process Merchant Personal Data only for specified contractual business purposes and other purposes expressly permitted by law.
SOS will not sell Merchant Personal Data, share it for cross-context behavioral advertising, use it for targeted advertising, or retain, use, or disclose it outside the permitted relationship or purposes. SOS will not combine it with personal information from other sources except as permitted by applicable law for the agreed Services.
SOS will provide the required level of privacy protection, inform the Merchant if it can no longer comply, and permit reasonable steps to verify compliant use and stop and remediate unauthorized processing. SOS understands and must comply with the restrictions applicable to its role.
12. Records, Changes, and Priority
Each party will maintain records necessary for its obligations under applicable law. Material changes to purposes, data categories, provider arrangements, or transfer locations require updated disclosures and any required instructions or agreements before the change.
This DPA prevails concerning Merchant Personal Data processed on the Merchant’s behalf. It does not reduce nonwaivable individual rights or customer protection benefits. Termination does not eliminate obligations concerning information still lawfully retained.
13. Privacy Contact
SOS LABELS LLC
30 W Hillsdale Ave
Long Branch, New Jersey 07740
United States
[email protected]
https://www.soslabels.com