Data Processing Agreement
Last updated: May 29, 2026
This DPA describes how Littles Fulfillment, LLC processes personal data on behalf of partner brands. It is designed to meet the GDPR Article 28 obligations B2B partners typically request, alongside US state-privacy (e.g., CCPA/CPRA) requirements. Partners who need a counter-signed copy can request one at dpa@littlesfulfillment.com.
1. Roles and subject matter
This DPA governs Littles Fulfillment, LLC’s (“Processor”) processing of personal data on behalf of a partner brand (“Controller”) under the parties’ master services agreement (“MSA”). Processor processes personal data only on Controller’s documented instructions, including those given through the Littles platform and portal.
2. Nature and purpose of processing
Receiving, storing, picking, packing, and shipping orders; processing returns; managing inventory; and providing partner-facing reporting and support. Processor does not use personal data for its own marketing and does not sell personal data.
3. Categories of personal data
End-customer name, postal/shipping address, order line items, and an email address or phone number where a carrier requires it for delivery. Processor does not collect or store payment-card data, Social Security numbers, government identifiers, or special-category data.
4. Categories of data subjects
End customers who place orders through Controller’s storefront.
5. Duration
Processing continues for the term of the MSA, plus the retention window described in §6, after which data is deleted or de-identified.
6. Retention
End-customer addresses are retained for the active delivery and return window (typically 30–90 days, configurable per Controller), then deleted or de-identified. Aggregated, de-identified order data may be retained for analytics. On termination, data is exported or destroyed per §12.
7. Sub-processors
Controller authorizes Processor to engage the sub-processors listed at /legal/sub-processors — including our cloud host (Google Cloud Platform), our warehouse management system (SKUSavvy), our transactional-email provider, and the carriers Controller authorizes (such as USPS and FedEx). Processor imposes data-protection obligations on each sub-processor no less protective than this DPA and gives Controller at least 30 days’ notice before adding or replacing a sub-processor, during which Controller may object on reasonable data-protection grounds.
8. Security measures
Encryption in transit (TLS 1.2+) and at rest (AES-256), role-based access controls, least-privilege production access with audit logging, and a regular security review. Current posture is summarized at /security.
9. Data subject requests
Processor will, taking into account the nature of processing, assist Controller in responding to data-subject requests (access, correction, deletion, portability, objection), and will honor requests passed through Controller — including Shopify’s data-request and redaction flows — within 30 days of receipt. End-customer requests should be initiated through Controller.
10. Breach notification
Processor will notify Controller without undue delay, and in any case within 72 hours, after becoming aware of a personal-data breach affecting Controller data, and will provide a post-incident report and cooperate on remediation and required notifications.
11. International transfers
Personal data is stored in the United States. Where personal data originates in the EEA, UK, or Switzerland, the parties rely on Standard Contractual Clauses (and the UK Addendum where applicable), incorporated by reference and completed in the MSA or an exhibit to this DPA.
12. Audits
Processor will make available information reasonably necessary to demonstrate compliance with this DPA. Controller may audit on at least 30 days’ notice, no more than once per year except where required by a supervisory authority or following a confirmed incident.
13. Return and deletion
On termination, at Controller’s election, Processor will return or delete Controller personal data within 90 days, except where retention is required by law; residual copies in backups expire under our standard backup-retention schedule.
14. Contact
DPA and data-protection matters: dpa@littlesfulfillment.com.