Data Processing Agreement for WooCommerce Scanner

1. Parties and electronic acceptance

The merchant identified by the Radius account and connected WooCommerce store accepting this Agreement is the Controller. The Processor is Multikapitał Sp. z o.o., ul. Krośnieńska 24, 87-100 Toruń, Poland; VAT/NIP PL9562302202; KRS 0000448302; REGON 341398889. Contact: hello@radiusdelivery.app.

This Agreement forms part of the Radius service contract and prevails for processing on the Controller's behalf. An authorized representative accepts it electronically for the identified store. The acceptance record identifies the account, store URL, version, document fingerprint, language and time. Acceptance does not grant marketing permission.

2. Instructions, purpose and duration

Documented instructions consist of the merchant's authorized connection, pickup configuration, staff permissions, order preparation, scanning, collection confirmation, reports, notification requests and verified support instructions. Processing supports paid local-pickup verification, QR credentials, prevention of duplicate handover, collection history, bulk operations and reconciliation of uncertain collection results.

The Processor uses the entrusted data only for these instructions and does not sell it or use it for unrelated advertising. Processing continues while necessary for the authorized service and the return or deletion process below. The Controller determines the lawful basis and provides information to customers and personnel. The Processor informs the Controller if it considers an instruction unlawful. Legally required processing is notified before it occurs unless the law prohibits notification.

3. People, data and operations

Data subjects are pickup customers and merchant personnel using the service. Data includes store and order identifiers/numbers, payment and order eligibility, shipping-method and pickup-point identifiers, customer names and ordered products/quantities read for verification, staff names and identifiers, permissions, pickup credentials, collection status, timestamps, operation identifiers and technical error states.

Customer names and product lists are retrieved from WooCommerce for authorized verification and display; they are not stored in the central pickup-record database. Stored pickup records contain order references and verification fingerprints, point and employee references, status and collection evidence. Bulk records contain order references, processing states and errors. The order interface does not send full card details, customer billing addresses or customer email addresses to the hosted Scanner service.

Operations include retrieval, validation, display, restricted storage of operational metadata, credential generation, transmission of collection instructions, reporting, export and deletion. The Controller must not include unnecessary special-category data in fields supplied to the service.

4. Confidentiality and security

The Processor limits access to authorized personnel bound by confidentiality and maintains measures appropriate to the processing risk. Current measures include verified merchant accounts, confirmation of control of the WordPress store, signed HTTPS requests, replay prevention, store and pickup-point access checks, revocable staff credentials, restricted sessions and encryption of integration secrets and recoverable private credentials.

The hosted service uses SQLite on a persistent Render disk in Frankfurt, Germany. Render encrypts persistent disks and their snapshots at rest. Access to the hosting environment, encryption keys and database copies must be restricted to authorized operators. Exports are supplied through a secure channel to a verified representative. Application error logging must avoid customer payloads and active credentials. Camera frames are used locally for QR reading and are not sent to the hosted Scanner as video.

5. Subprocessors and transfers

The Controller authorizes Render to provide hosting, persistent storage and recovery infrastructure for the entrusted operational data. Render is a US provider; Frankfurt hosting does not guarantee that all support or infrastructure processing occurs only in the EEA. The Processor must maintain the required processing arrangements and applicable safeguards for restricted international transfers, such as appropriate adequacy coverage or Standard Contractual Clauses. Acceptance of this Agreement is not itself a transfer safeguard. Render information: https://render.com/dpa and https://render.com/security.

Before adding or replacing a subprocessor for this processing, the Processor gives at least 30 days' notice through the application or the merchant's designated contact, with the proposed provider and purpose. The Controller may object on reasonable data-protection grounds. The parties seek an alternative; if unresolved, the affected processing may be terminated with return or deletion. Equivalent processing duties must be imposed on subprocessors, and the Processor remains responsible for their performance.

The merchant chooses its WordPress hosting and delivery of customer messages from WooCommerce under its own arrangements. Radius does not send those customer messages through Zoho CRM. Processing of merchant account, support, CRM and billing information for the provider's own administrative purposes is described in the Privacy Policy. Paddle billing terms and notices remain applicable to the merchant's software purchase.

6. Rights, assistance and incidents

Requests concerning customers' purchases and pickup records should normally go to their merchant. The Processor forwards requests concerning entrusted data to the Controller and assists with access, correction, export, restriction and deletion on verified instructions. A support request identifies the store and necessary record references; it must not include passwords, active pickup codes or unrelated customer information. Return of entrusted data through support does not depend on a paid reporting plan.

The Processor assists, taking account of the processing and information available, with security obligations, breach assessment, impact assessments and consultation with supervisory authorities. It notifies the Controller without undue delay after becoming aware of a personal-data breach, providing available incident details, affected data, likely consequences, measures and contact, with updates as information becomes available. Each party remains responsible for its own notifications and legal obligations.

7. Information and audits

The Processor provides information necessary to demonstrate compliance with the processing obligations and allows and contributes to audits and inspections by the Controller or its authorized auditor. Practical arrangements protect system security and other merchants' confidentiality without preventing statutory audit rights. The parties coordinate scope, timing and secure handling of evidence.

8. Retention, return and deletion

Operational history is retained while needed for the authorized service, reporting, collection verification or resolution of a documented issue. The merchant should review obsolete records and may instruct earlier deletion through verified support. This WooCommerce release does not automatically purge pickup history after a fixed number of days. Pending or uncertain collection operations require resolution and an appropriate retention decision; the Processor must not use an unresolved state as a reason for indefinite storage.

Revoking a staff link blocks further use. Disconnecting or uninstalling the connector blocks its integration but does not automatically erase historical pickup records in the hosted service, cancel a Paddle subscription or delete the merchant's WooCommerce orders and local order metadata. To end processing and obtain a return or erasure, the Controller submits a verified instruction to hello@radiusdelivery.app and states whether a return is required before deletion.

On termination of the entrusted processing, at the Controller's choice the Processor returns or deletes the entrusted data and deletes existing controlled copies unless law requires specific retention. The operator verifies authority, stops affected processing, resolves uncertain operations, provides a requested export, removes the store's operational pickup, staff and bulk data and records completion. Support instructions and exports exclude integration secrets and reusable access credentials.

Recovery copies are restricted to disaster recovery. Render disk snapshots follow the provider's applicable retention cycle; the provider currently states that snapshots are available for at least seven days, which is not a seven-day maximum. Separately created SQLite backups must be inventoried and removed when no longer needed and handled under verified deletion instructions. Erasure instructions must be recorded outside a restored database copy; a restore occurs in isolation and repeats applicable erasures before normal processing resumes.

Merchant account, installation eligibility, billing and acceptance evidence processed for the provider's own administrative or legally required purposes is kept separately from erased operational customer and personnel records, with access restricted and retention limited to the applicable documented purpose or legal requirement. A preservation requirement applies only to the necessary data and period; the Processor explains an applicable restriction on deletion unless law prohibits it.

9. Continuing duties and changes

Confidentiality, security and required assistance continue while entrusted data remains. This Agreement does not reduce mandatory rights or obligations under applicable data-protection law, including Article 28 GDPR. Material changes to processing, safeguards or retention are communicated before they take effect and reflected in a new version for acceptance where required.