Data Processing Addendum

Last updated: October 13, 2026

This Data Processing Addendum ("DPA") forms part of the CrossBatch Terms of Service between the merchant ("Merchant") and DrMaker3D LLC, a Connecticut limited liability company ("Processor"). It applies when Processor processes personal data on Merchant's behalf through CrossBatch.

1. Roles

Merchant is the controller of personal data about its customers. Processor processes that data only as Merchant's processor (or service provider under the CCPA). Processor is a controller only for Merchant's own account contact details and for the website waitlist.

2. Instructions

Processor processes personal data only to provide CrossBatch as described in the Terms and in Annex 1, and on Merchant's documented instructions, which include Merchant's configuration of the app. Processor will tell Merchant if it believes an instruction breaks data protection law. Processor does not sell or share personal data, and does not use it for its own purposes.

3. Confidentiality

Anyone Processor authorizes to process the data is bound by confidentiality. Today that is the owner of the business only.

4. Security

Processor keeps the technical and organizational measures in Annex 2 and may improve them, but won't reduce overall protection.

5. Subprocessors

Merchant authorizes the subprocessors in Annex 3. Processor will give at least 30 days' notice before adding or replacing a subprocessor, by updating this DPA and notifying Merchant in the app or by email. Merchant may object on reasonable data-protection grounds; if the parties can't resolve the objection, Merchant may stop using CrossBatch. Processor imposes data protection terms on each subprocessor that are no less protective than this DPA, and remains responsible for them.

6. Data subject requests

Customer requests reach Processor through Shopify's compliance webhooks (customers/data_request, customers/redact), which Processor acts on automatically. Processor will also help Merchant answer other requests to access, correct or delete data, to the extent Merchant can't do so itself.

7. Personal data breaches

Processor will notify Merchant without undue delay, and in any case within 72 hours, after becoming aware of a breach affecting Merchant's personal data. The notice will describe what happened, the data and people affected, likely consequences, and the steps taken. Processor will cooperate with Merchant's own notifications.

8. Assistance

Processor will give reasonable help with data protection impact assessments and consultations with regulators, where they relate to CrossBatch.

9. Deletion

When Merchant uninstalls CrossBatch, Shopify sends a shop/redact request about 48 hours later, and Processor deletes Merchant's personal data then. Backups roll off within Processor's backup retention period (currently 6 days for daily backups; manual snapshots are deleted or kept only as needed for recovery). Merchant may ask for a copy of its data before uninstalling.

10. Audits

Processor will make available the information needed to show compliance with this DPA, answering a reasonable written questionnaire no more than once a year, or more often if required by a regulator or after a breach.

11. International transfers

Processor hosts data in the United States. Where the law of Merchant's or its customers' location requires a transfer mechanism, the parties agree to the EU Standard Contractual Clauses (Module 2, controller to processor, or Module 3 where Merchant is itself a processor) and the UK Addendum, which are incorporated by reference.

12. Liability and precedence

Liability under this DPA is subject to the limits in the Terms. If this DPA conflicts with the Terms about personal data, this DPA controls.

Annex 1: Processing details

Subject matter and duration: providing CrossBatch while Merchant has it installed, plus the deletion period above.
Nature and purpose: importing orders (from Shopify, from Etsy sale emails Merchant forwards, from Etsy order files Merchant uploads, and from a direct Etsy connection where enabled), creating and managing production jobs, printing job sheets, sending proofs and status emails Merchant enables, posting fulfillment and tracking.
Data subjects: Merchant's customers and buyers on Shopify and Etsy.
Personal data: name, email address, shipping city and region, order number and contents, personalization text and files, proof images and the customer's approval or comments, email delivery status.
Special categories: none intended. Merchant should not put special-category data into personalization or notes.

Annex 2: Security measures

TLS for all traffic to the app, the database connection and email delivery.
Etsy access tokens encrypted with AES-256-GCM in the application. Shopify access tokens and order data stored in a managed PostgreSQL database with access restricted to the owner's authenticated Railway account.
Data and backups are hosted by Railway, which is SOC 2 Type II certified and encrypts all data at rest with AES-256.
Webhooks verified with HMAC signatures (Shopify) and signed payloads (Etsy, Resend); forged requests are rejected.
Least data: raw webhook payloads are cleared when processed and deleted after 30 days.
Separate development database; production data is not used for development or testing.
Daily database backups, plus manual snapshots before risky operations.
Customer redaction and shop deletion handled automatically through Shopify's compliance webhooks.
Access to production systems is limited to the owner's own accounts, each protected by a strong unique password and two-factor authentication.
Staff access to pages showing customers' personal data in the app is logged (staff member, page, time) and the log is kept for 90 days.
A written data loss prevention strategy: backups, restricted access, no bulk export of customer data, and automatic redaction.
A written incident response policy, including breach notification within 72 hours.

Annex 3: Subprocessors

Subprocessor	Purpose	Location
Railway Corporation	Application hosting and database	United States
Resend, Inc.	Sending emails the merchant enables; receiving Etsy sale emails the merchant forwards	United States
Cloudflare, Inc.	DNS for crossbatch.drmaker3d.com	Global

Shopify and Etsy are the sources of the data and the merchant's own platforms, not subprocessors of CrossBatch.

Contact: DrMaker3D LLC · 12 West Ledge, Burlington, CT 06013 · support@drmaker3d.com