Effective date: October 23, 2026
This Data Processing Agreement ("DPA") is part of the 90Twenty Terms of Service (the "Terms") between 90Twenty, LLC [confirm legal entity name] ("90Twenty") and the customer that accepted the Terms ("Customer"). It applies whenever 90Twenty processes Personal Data contained in Customer Data on Customer's behalf. Capitalized terms not defined here have the meaning given in the Terms.
2.1 Customer is the controller or business, and 90Twenty is the processor or service provider, of Personal Data processed through the Service.
2.2 Nature and purpose of processing. Hosting, storing, syncing, displaying, transmitting to Third-Party Platforms, redacting, backing up, and deleting Personal Data so that Customer can operate its inventory, sales, purchasing, shipping, accounting, outreach, advertising, and drive-testing business through the Service.
2.3 Categories of data subjects. Customer's customers and prospective customers, marketplace buyers, vendors and suppliers, business contacts and leads, and Customer's own Users.
2.4 Categories of Personal Data. Names, business and shipping addresses, email addresses, phone numbers, order and return history, payment status (not card numbers), tracking numbers, company and job title, and communications sent through the Service. The Service is not designed to hold government identifiers, payment card numbers, health information, or other sensitive categories, and Customer agrees not to load them.
2.5 Duration. For the term of the Terms and the deletion period in Section 8.
3.1 Instructions. 90Twenty will process Personal Data only on Customer's documented instructions, which consist of the Terms, this DPA, Customer's configuration of the Service, and the actions Customer and its Users take in the Service. 90Twenty will inform Customer if it believes an instruction violates Data Protection Laws.
3.2 No sale or secondary use. 90Twenty will not sell or share Personal Data, retain, use, or disclose it outside the direct business relationship with Customer or for any purpose other than providing the Service, or combine it with Personal Data from other sources except as permitted for service providers under the CCPA. 90Twenty certifies that it understands and will comply with these restrictions.
3.3 Confidentiality. 90Twenty will ensure that personnel with access to Personal Data are bound by confidentiality obligations and receive appropriate training.
3.4 Security. 90Twenty will implement and maintain the technical and organizational measures described in Annex 1.
3.5 Assistance. Taking into account the nature of the processing, 90Twenty will assist Customer with reasonable requests to respond to data subject requests, data protection impact assessments, and consultations with supervisory authorities, at Customer's expense where the assistance is material.
3.6 Data subject requests. If 90Twenty receives a request from a data subject relating to Customer's Personal Data, it will direct the person to Customer and will not respond except as required by law or instructed by Customer. The Service provides export, redaction, and deletion features Customer can use to respond.
3.7 Compliance notification. 90Twenty will notify Customer if it determines that it can no longer meet its obligations under Data Protection Laws, and Customer may then take reasonable steps to stop and remediate unauthorized use of Personal Data.
4.1 Customer is responsible for the lawfulness of the Personal Data it loads into or syncs through the Service, including having a lawful basis and any required notices and consents.
4.2 Customer will comply with the data protection policies of every Third-Party Platform it connects, including marketplace policies that restrict the use and retention of buyer data.
4.3 Customer will use the Service's access controls to limit Users' access to Personal Data to what their role requires, and will promptly remove departed Users.
4.4 Customer will not instruct 90Twenty to process Personal Data in a way that violates Data Protection Laws.
5.1 Customer authorizes 90Twenty to engage the Subprocessors listed in Annex 2 and other Subprocessors as described below.
5.2 90Twenty will impose data protection obligations on each Subprocessor that are no less protective than those in this DPA, and remains responsible for each Subprocessor's performance.
5.3 90Twenty will give Customer at least 30 days' notice by email or in-product notice before adding a new Subprocessor that will process Personal Data. Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, Customer may terminate the affected Module and receive a pro-rated refund of prepaid fees for the remainder of the term.
6.1 90Twenty will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Security Incident affecting Customer's Personal Data.
6.2 The notice will describe, to the extent known, the nature of the incident, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed. 90Twenty may provide information in phases as it becomes available.
6.3 90Twenty will take reasonable steps to contain and remediate the incident and will cooperate with Customer's reasonable requests. Notification of a Security Incident is not an admission of fault or liability.
6.4 Customer is responsible for notifying data subjects, regulators, and Third-Party Platforms as Data Protection Laws and platform policies require, and 90Twenty will provide reasonable assistance.
7.1 On written request no more than once per year, 90Twenty will provide Customer with a written description of its security measures, the results of any third-party security assessment or penetration test it has obtained (in summary form), and written answers to a reasonable security questionnaire.
7.2 If Data Protection Laws require an on-site audit that the documentation above cannot satisfy, Customer may conduct one at its own expense, on at least 30 days' notice, during business hours, no more than once per year, subject to reasonable confidentiality and scope restrictions, and without access to other customers' data or 90Twenty's source code.
8.1 During the term and for 30 days after termination, Customer may export Personal Data through the Service's export features.
8.2 After that period, 90Twenty will delete Personal Data from active systems within 30 days and from backups within the ordinary backup retention period, unless retention is required by law. On written request, 90Twenty will certify deletion.
8.3 90Twenty may retain Personal Data that is redacted or aggregated so that it no longer identifies any person.
Personal Data is processed in the United States. Where Customer transfers Personal Data from the European Economic Area, the United Kingdom, or Switzerland, the parties agree that the EU Standard Contractual Clauses (Module Two: controller to processor) and the UK International Data Transfer Addendum are incorporated by reference, with Customer as data exporter and 90Twenty as data importer, and the information in this DPA completing the annexes. [Counsel to confirm whether any EU/UK customers are anticipated; if not, this section may be simplified.]
10.1 This DPA forms part of the Terms. In a conflict about Personal Data, this DPA controls. The limitation of liability in the Terms applies to this DPA, and the parties' combined liability under the Terms and this DPA is subject to that single cap.
10.2 Either party may propose amendments required by changes in Data Protection Laws, and the parties will negotiate them in good faith.
10.3 This DPA terminates automatically when 90Twenty has deleted or returned all Personal Data under Section 8.
| Subprocessor | Purpose | Location |
|---|---|---|
| Railway Corp. | Application hosting | United States |
| Neon, Inc. | Managed PostgreSQL database | United States |
| Postmark (ActiveCampaign, LLC) | Transactional and campaign email delivery | United States |
| Stripe, Inc. | Payment processing | United States |
| Anthropic, PBC | AI-assisted text features (drafts, classification, SEO suggestions) | United States |
| Cloudflare, Inc. | Website hosting and network security | United States |
| Google LLC | Maps address lookup, advertising and search data where the Customer connects those services | United States |
Third-Party Platforms that Customer chooses to connect (marketplaces, carriers, freight brokers, lead-data and inventory-data providers, and Customer's own email provider) receive data at Customer's direction and are independent controllers, not Subprocessors.