# Data Processing Agreement (DPA) summary

> Giyimport's commitments as processor of marketplace recipient data: purpose, instructions, security, sub-processors, deletion and audit.

This summary sets out Giyimport's obligations as processor of recipient data imported from customers' marketplace stores. A signed agreement is available on request.

Last updated: 2026-11-07

### Parties and roles

The customer (seller) is the controller; Giyimport is the processor. The marketplace's own data protection terms (e.g. Temu, Trendyol) separately bind the seller.

### Subject and purpose

- Data subjects: marketplace buyers (consumers).
- Data categories: name, address, phone, email, order information.
- Purpose: viewing and fulfilling orders; stock reservation.
- Duration: term of service; recipient data deleted 30 days after the order closes.

### Giyimport commitments

- Process data only on the customer's instructions and for the purpose above.
- Store data encrypted with AES-256-GCM and use TLS 1.2+ in transit.
- Limit access by role to those who need to know and log every access.
- Remove access of leavers or role changers immediately.
- Notify the customer within 24 hours of becoming aware of a personal data breach.
- Publish sub-processor changes on the Sub-processors page.
- Delete data at the end of service or on request and confirm deletion.
- Support audits and information requests with reasonable notice.

### International transfer

Data is processed on a server in the Netherlands (Amsterdam metro area).