Data Processing Agreement

1. 1. Roles

You are the controller of your customers' personal data. ResReturn is your processor and processes that data only to provide the returns service and only on your documented instructions, which are given through your use and configuration of ResReturn.

ResReturn is operated by YourSizer, Gümüşsuyu Mahallesi İnönü Caddesi Ulusal Apt. No:5 D:5, 34437 Beyoğlu/İstanbul, Türkiye (contact@resreturn.com).

2. 2. Subject matter and purpose

Subject matter: processing returns, exchanges, refunds and store credit for orders placed in your store.

Data subjects: your customers who place orders or request returns.

Categories of personal data: name, email address, phone number, shipping address, order details, return reasons and notes, chosen resolution, bank details where a customer provides them for a bank refund, optional body measurements given with explicit consent, and messages exchanged with the returns assistant.

Duration: for as long as ResReturn is installed on your store, followed by deletion as described in section 8.

3. 3. Our obligations

We process personal data only on your instructions, keep it confidential, and ensure that our staff with access are bound by confidentiality.

We do not sell personal data and do not use it for our own purposes.

4. 4. Security

We protect personal data with appropriate technical and organisational measures, including encryption in transit (TLS), encrypted backups, access limited to authorised staff with audit logging, rate-limited and signed customer access to returns, short-lived access tokens, and request-level access logs.

5. 5. Sub-processors

You authorise us to use the following sub-processors. We will inform you of changes by updating this page before the change takes effect.

Hetzner Online GmbH (Germany) — hosting of the application and database.

Google LLC — Gemini API, only when the returns assistant is enabled; and Google Drive for encrypted backups.

Resend, Inc. (United States) — sending transactional emails, where email notifications are enabled.

Each sub-processor is bound by data protection obligations equivalent to this DPA. Transfers outside the EEA are made under the European Commission's Standard Contractual Clauses or another valid transfer mechanism.

6. 6. Data subject requests

Customer data requests reach us through Shopify. When a customer asks for their data, the request appears in ResReturn under Settings → Privacy requests so you can download and provide it. When a customer asks to be forgotten, we delete their personal data automatically. We respond within 30 days.

7. 7. Personal data breaches

We notify you without undue delay, and in any case within 72 hours of becoming aware of a personal data breach affecting your customers' data, and provide the information you need to meet your own obligations. See our data breach policy.

8. 8. Deletion

When you uninstall ResReturn, Shopify asks us 48 hours later to delete your store's data; we then delete your customers' personal data and the store connection. Financial records of past returns are kept without personal data where required by law.

While ResReturn is installed, we apply these retention periods: customer details on orders without a return — 180 days; bank details — 90 days after the return is closed; identifiable data in closed return records — up to 3 years.

9. 9. Information and audits

On request we provide the information necessary to demonstrate compliance with this DPA.

10. 10. General

This DPA is governed by the same law and jurisdiction as our Terms of Service. If this DPA conflicts with the Terms of Service regarding personal data, this DPA prevails.