The merchant is the controller or business and PODJST is the processor or service provider for merchant customer fulfillment data.
PODJST processes that data only on documented instructions needed to provide the agreed services or comply with law.
These Terms cover confidentiality, security, subprocessors, international transfers, data-subject assistance, incidents, and deletion.
Scope and Roles
These Terms apply to personal data submitted through an account, connected store, API, CSV, manual order, support request, or other approved workflow for product setup, production, packing, shipping, tracking, and issue handling.
The merchant determines the purpose and lawful basis for processing its customer data. PODJST processes that data on the merchant's documented instructions, including these Terms, approved orders, platform settings, and written support instructions.
Processing Details
Processing continues for the service relationship and any limited retention period described in the Privacy Policy or required by law.
- Data subjects: merchant customers, recipients, store users, support contacts, and persons shown in submitted content.
- Data types: names, contact details, addresses, order identifiers, products, variants, artwork, packaging notes, platform identifiers, tracking, support records, and technical logs.
- Purpose: account connection, order synchronization, product customization, production, quality control, packing, delivery, support, fraud prevention, and legal compliance.
- Sensitive data: not required. Merchants must not submit government identifiers, payment card credentials, health data, biometric data, or other sensitive information unless PODJST expressly agrees in writing.
Merchant Obligations
The merchant must have a lawful basis to collect and send the data, provide required privacy notices, honor individual rights, keep data accurate, use appropriate platform permissions, and limit instructions to lawful purposes.
The merchant must not submit more personal data than the service requires and remains responsible for its store, customer relationship, marketplace obligations, and instructions to PODJST.
PODJST Obligations
PODJST will process merchant customer data only for the agreed services, ensure authorized personnel are subject to confidentiality, maintain appropriate safeguards, and notify the merchant if an instruction appears to violate applicable data protection law.
PODJST will not sell or share merchant customer data for cross-context behavioral advertising and will not combine it with unrelated personal data except as instructed or legally required.
Security and Incidents
PODJST maintains measures appropriate to the nature of the data and service, including access restrictions, protected credentials, production transport encryption, logging, provider controls, and incident procedures.
After confirming a personal data breach affecting merchant data, PODJST will notify the affected merchant without undue delay and provide reasonably available information needed for the merchant's legal assessment and notices.
Subprocessors
The merchant authorizes the subprocessors listed on the PODJST Subprocessor List. PODJST requires subprocessors to protect personal data through written or platform terms appropriate to their role.
PODJST remains responsible for its subprocessor obligations to the extent required by applicable law and the merchant agreement. Material changes are published on the Subprocessor List, and a merchant can raise a reasonable data-protection objection by email.
International Transfers
The merchant instructs PODJST to transfer data to locations needed for the approved production and delivery route. Where law requires a transfer safeguard, the parties will use applicable standard contractual clauses, an adequacy mechanism, or another lawful transfer basis.
Rights Requests and Compliance Assistance
Taking account of the processing and available information, PODJST will provide reasonable assistance with verified data-subject requests, security obligations, impact assessments, regulator inquiries, and platform compliance requests relating to PODJST processing.
PODJST may refer a person to the merchant when the request concerns merchant-controlled customer data. The merchant remains responsible for responding to the person unless law requires PODJST to respond directly.
Return and Deletion
On termination or a valid instruction, PODJST will delete or de-identify merchant personal data that is no longer required for the service, unless law requires retention. Where feasible, PODJST will confirm completion on written request.
Platform-specific deletion requests, including Shopify compliance requests, are handled within the applicable legal or platform deadline after identity and request validity are verified.
Information, Audit, and Order of Terms
PODJST will provide information reasonably necessary to demonstrate compliance, subject to confidentiality, security, legal, and third-party restrictions. A formal audit requires reasonable notice, an independent qualified auditor, confidentiality, limited scope, and reimbursement of unreasonable or repetitive costs.
If these Terms conflict with general Terms and Conditions on personal data processing, these Data Processing Terms control. The governing law in the applicable merchant agreement applies.
Contact JST COMMERCE LIMITED, operating as PODJST, at support@podjst.com, +852 64203057, or RM D07, 8/F, KAI TAK FTY BUILDING, NO. 99 KING FUK STREET, SAN PO KONG, HK.
Questions or requests?
Contact JST COMMERCE LIMITED, operating as PODJST, and include the policy or request type.
