Last updated on 14 Feb 2025
Provider: String (meetstring.com), Winnipeg, Manitoba, Canada
Security Contact: paul@meetstring.com
Agreement: This DPA supplements the String Terms and Conditions, effective February 14, 2025.
| Subprocessor | Country | Processing Task |
|---|---|---|
| ShipStation (Auctane LLC) | United States | Shipping order data access and updates via API |
| Google Cloud | United States | Infrastructure and data storage |
Provider will notify Customer at least 10 business days in advance of any changes to Approved Subprocessors. Customer has 30 days after such notice to object.
Service: String — automated ShipStation order management and rate shopping
Categories of Data Subjects: Customer’s end users and customers (recipients of shipments)
Categories of Personal Data:
Special Category Data: None
Frequency of Transfer: Continuous
Nature and Purpose of Processing:
Provider will process Customer Personal Data solely to provide the Service, which includes:
Provider will not process Customer Personal Data for any purpose other than providing the Service as described in the Agreement.
Duration of Processing: For as long as Customer maintains an active String account. Customer Personal Data will be deleted within 30 days of account termination unless retention is required by applicable law.
Provider implements the following technical and organizational measures to protect Customer Personal Data:
Upon becoming aware of any unauthorized access to or breach of Customer Personal Data, Provider will:
Notification of a security incident does not constitute an acknowledgment of fault or liability by Provider.
Provider will enable Customer to delete Customer Personal Data consistent with the functionality of the Service. Upon account termination, Provider will delete Customer Personal Data within 30 days unless further retention is required by applicable law.
To the extent the California Consumer Privacy Act (CCPA) applies, the parties acknowledge and agree that Provider is a service provider receiving Customer Personal Data solely to provide the Service as described in the Agreement. Provider will not sell or share any Customer Personal Data. Provider will not retain, use, or disclose Customer Personal Data except as necessary to provide the Service or as permitted by applicable law. Provider certifies that it understands and will comply with these restrictions.
Customer instructs Provider to process Customer Personal Data:
Provider will process Customer Personal Data only in accordance with these instructions and will inform Customer if it is unable to follow them.
Upon written request (no more than once per year), Provider will respond to reasonable requests for information to confirm Provider’s compliance with this DPA, including responses to security due diligence questionnaires.
Each party’s total cumulative liability arising out of or related to this DPA will be subject to the waivers, exclusions, and limitations of liability stated in the String Terms and Conditions.
This DPA is governed by the laws of the Province of Manitoba, Canada, consistent with the String Terms and Conditions.
This DPA forms part of and supplements the String Terms and Conditions. If there is any inconsistency between this DPA and the Terms and Conditions, this DPA will control with respect to data processing matters.
By using String, you acknowledge that you have read and understood this Data Processing Agreement, and you agree to be bound by them. If you have any questions or concerns, please contact us at paul@meetstring.com.
