Data Processing Agreement (DPA) summary
This summary sets out Giyimport's obligations as processor of recipient data imported from customers' marketplace stores. A signed agreement is available on request.
Last updated: 2026-11-07 · Values in square brackets will be filled in by the company before publication.
Parties and roles
The customer (seller) is the controller; Giyimport is the processor. The marketplace's own data protection terms (e.g. Temu, Trendyol) separately bind the seller.
Subject and purpose
- Data subjects: marketplace buyers (consumers).
- Data categories: name, address, phone, email, order information.
- Purpose: viewing and fulfilling orders; stock reservation.
- Duration: term of service; recipient data deleted 30 days after the order closes.
Giyimport commitments
- Process data only on the customer's instructions and for the purpose above.
- Store data encrypted with AES-256-GCM and use TLS 1.2+ in transit.
- Limit access by role to those who need to know and log every access.
- Remove access of leavers or role changers immediately.
- Notify the customer within 24 hours of becoming aware of a personal data breach.
- Publish sub-processor changes on the Sub-processors page.
- Delete data at the end of service or on request and confirm deletion.
- Support audits and information requests with reasonable notice.
International transfer
Data is processed on a server in the Netherlands (Amsterdam metro area).