WaveGo is operated by Växthuset Utemiljö i Täby AB (org. no. 5565899167). This DPA forms part of the WaveGo Terms and applies to the processing WaveGo performs on the Retailer's behalf. It is accepted when the Retailer activates a supplier.
The Retailer is the controller of its end customers' personal data. WaveGo acts as processor on the Retailer's documented instructions, and as an independent controller only for its own account, billing, security and legal purposes. A Supplier is not automatically classified as a WaveGo subprocessor. Its role is determined by the actual processing, its purposes and the applicable agreement.
WaveGo processes end-customer order and delivery data to receive Shopify orders, display them to the Retailer, facilitate supplier payment, transmit confirmed orders to the selected supplier, and receive fulfilment and tracking status, for the term of the Retailer's account.
Name; delivery address (street, postal code, city, country); telephone number; order line items, SKU, variants and quantities; order references; fulfilment status; carrier and tracking reference. No payment-card data. No special-category data. Data subjects: the Retailer's end customers.
WaveGo processes the data only on the Retailer's documented instructions (this DPA, the Terms, the Retailer's configuration and supplier activation, and the act of submitting an order for transmission), unless required by law, and informs the Retailer if an instruction appears to infringe data-protection law.
Persons authorised to process the data are bound by confidentiality. WaveGo applies appropriate technical and organisational measures taking into account the risk. WaveGo's obligations extend to processing within its own platform and control.
The Retailer gives general authorisation for WaveGo to use the sub-processors listed in the WaveGo Subprocessor List, under equivalent data-protection obligations, and WaveGo notifies the Retailer of intended changes so the Retailer may object on reasonable grounds. A Supplier is not automatically classified as a WaveGo subprocessor; its role is determined by the actual processing, its purposes and the applicable agreement (see section 1).
Taking into account the nature of processing and information available, WaveGo assists the Retailer, as far as possible, with data-subject requests and with the Retailer's obligations regarding security, breach notification, DPIA and prior consultation. The Retailer remains the primary contact for its customers.
WaveGo notifies the Retailer without undue delay after becoming aware of a personal data breach affecting the Retailer's data processed by WaveGo.
On termination, WaveGo deletes or, at the Retailer's choice, returns the personal data processed on the Retailer's behalf and deletes existing copies, unless storage is required by law.
WaveGo makes available information reasonably necessary to demonstrate Article 28 compliance and supports proportionate audits (limited in frequency, on notice, under confidentiality, without access to other customers' data), and may satisfy such requests with existing documentation and attestations.
WaveGo is responsible for the processing performed within its own platform and under its control. Each retailer and supplier remains responsible for its own processing, systems, personnel, instructions and legal obligations. WaveGo is not responsible for processing independently performed by the retailer, the selected supplier, carriers or other parties outside WaveGo's reasonable control.
Nothing in these terms excludes or limits responsibility where such exclusion or limitation is prohibited by applicable law.
Data-protection enquiries: info@wavego.eu