Data Processing Agreement
This page summarises the Data Processing Agreement (DPA) between you, the merchant, and the administrator of the cartabandon.com service. The DPA applies automatically with every subscription. The full signed version is available in the panel under Settings, Legal. Questions go to support@cartabandon.com. Last updated 14 October 2026.
You are the controller, we are the processor
For shopper data that your store sends to CartAbandon, you are the controller and we are the processor. We process that data only to deliver the service you configure and only on your documented instructions. Your settings in the panel, these terms and the DPA together form those instructions.
For your own account and billing data we act as controller, as described in our Privacy Policy.
What the agreement covers
| Item | Details |
|---|---|
| Subject matter | Running abandoned cart recovery and related flows for your store |
| Nature and purpose | Collecting store events, deciding channel, timing and offer per cart, drafting and sending messages, syncing retargeting audiences, reporting recovered revenue |
| Duration | For as long as your subscription runs, plus the deletion period after it ends |
| Data subjects | Your shoppers (visitors and customers) and your store staff who use the panel |
| Data categories | Contact details (email, phone, name), cart and order data, browsing and checkout events, payment decline codes (never full card numbers), device and time zone, consent records, message history, staff names and work emails |
| Sensitive data | Not required and not to be sent |
What we commit to as your processor
- Instructions. We process shopper data only on your instructions and tell you if we believe an instruction breaks the law.
- Confidentiality. Everyone with access to shopper data is bound by confidentiality.
- Security. We apply technical and organisational measures, including encryption of shopper contact data at rest, encrypted store access tokens, role-based access, logged staff access, and on Plus SSO (SAML) and an audit log. More on our security page.
- Sub-processors. We use sub-processors by category: hosting provider in the EU and the US, payment operator, email delivery provider, SMS and WhatsApp messaging provider, AI model provider for drafting messages, and error monitoring. Each is bound by a written contract with the same level of protection. We give you notice of new or replaced sub-processors before they start, and you can object.
- AI models. Shopper data is not used to train AI models.
- Data subject requests. We help you answer requests for access, correction, erasure, restriction, portability and objection, through panel tools and support. Requests that reach us are forwarded to you.
- Impact assessments. We give you the information you need for data protection impact assessments and prior consultations.
- Breach notification. We notify you of a personal data breach without undue delay and within 48 hours of becoming aware of it, with the facts we have at that time.
- End of service. When your subscription ends, you can export your data. We then delete or return shopper data within 30 days, unless the law requires us to keep it.
- Audits. We show compliance through documentation, such as security descriptions and answers to reasonable questionnaires. On-site audits are possible where the law requires them, on reasonable notice.
What you commit to as the controller
You make sure you have a lawful basis for the data you send, including recorded consent for marketing email, SMS and WhatsApp where the law requires it. You give shoppers the privacy information they need and you keep your instructions lawful. CartAbandon supports this with consent records per contact and channel, one-click unsubscribe, the STOP keyword for SMS, the WhatsApp opt-out and quiet hours by time zone.
International transfers use standard contractual clauses
Some sub-processors operate outside the European Economic Area, including in the US. Where there is no adequacy decision, transfers rely on the standard contractual clauses of the European Commission, with extra safeguards such as encryption. On the Plus plan you can choose where your data is stored: the EU or the US.
How to accept and download the DPA
You do not need to sign anything to be covered. The DPA becomes part of your contract as soon as your subscription starts and stays in force as long as we process shopper data for you. A copy signed by us can be downloaded at any time in the panel under Settings, Legal. If your legal team needs extra details, write to support@cartabandon.com.
The full terms of the service are in our Terms of Service.
Last updated 14 October 2026.