Data processing summary for merchants

Effective date: 28 October 2026

This page summarises how Pakka COD processes buyer personal data on behalf of merchants. It forms part of our terms of service and should be read with the privacy policy. If you need a signed data processing agreement (for example with the EU Standard Contractual Clauses), email [email protected].

1. Roles

The merchant is the controller (GDPR) / Data Fiduciary (DPDP Act, 2023) for buyer data. Pakka COD (a sole proprietorship based in Bengaluru, India) is the processor / Data Processor and processes it only on the merchant's documented instructions, which are the app's settings and these terms.

2. Details of processing

Subject matter: Confirming cash-on-delivery orders over the merchant's WhatsApp account, checking addresses, scoring delivery risk, and tagging orders in Shopify.
Duration: While the app is installed, then until deletion as set out in section 6.
Data subjects: Buyers who place cash-on-delivery orders in the merchant's Shopify store.
Personal data: Phone number, first name (full name checked in memory only), shipping address (checked in memory; only a keyed hash stored), Shopify order and customer IDs, order number, amount and currency, risk score and reasons, confirmation status, delivery outcome, WhatsApp message metadata (no message contents), and a WhatsApp opt-out list (keyed phone hash only).
Special categories: None are requested or needed.
Operations: Receiving, storing, hashing, scoring, sending messages through the merchant's WhatsApp provider, writing tags and notes to Shopify, exporting and deleting.

3. Our commitments

Process buyer data only to provide the app to that merchant, never for our own purposes, advertising, sale, cross-merchant profiling or AI training.
Keep it confidential; access is limited to the operator.
Apply the security measures in section 12 of the privacy policy.
Use only the sub-processors listed in section 9 of the privacy policy, under written terms with data protection obligations, and update that list before adding a new one. Merchants can object by emailing us; if we cannot address the objection, the merchant can uninstall.
Help the merchant with buyers' rights requests: the app responds automatically when Shopify forwards a buyer's request for their data or for erasure.
Notify the merchant without undue delay after becoming aware of a personal data breach affecting their buyers' data, and help them meet their own notification duties (GDPR Articles 33–34; DPDP Act section 8(6) and Rule 7 of the DPDP Rules, 2025).
Provide the information reasonably needed to show compliance with these commitments, on written request.

4. Merchant commitments

Have a lawful basis for the processing and give buyers notice of it (for example in the store's privacy policy).
Obtain buyers' opt-in for WhatsApp messages and follow Meta's WhatsApp Business Messaging Policy.
Only connect a WhatsApp account and provider you are entitled to use; Meta or your provider processes messages under your agreement with them.

5. International transfers

Data may be processed in India, the USA and other countries where our providers operate. For EEA, UK and Swiss personal data we rely on the Standard Contractual Clauses in our providers' data processing terms and will sign Standard Contractual Clauses with merchants on request.

6. Deletion

Raw phone numbers and first names: erased 30 days after the order's confirmation finishes, and removed from data-request exports 30 days after each export.
WhatsApp message metadata: deleted after 90 days. Order records (risk scores and reasons, phone and address hashes, status) and data-request exports: deleted after 13 months.
A buyer's records, exports and opt-out entry: deleted when Shopify sends an erasure request for that buyer.
All store data: WhatsApp credentials and Shopify sessions deleted on uninstall; everything else deleted when Shopify sends the store erasure request (48 hours after uninstall), or by our own clean-up 25 days after uninstall if that request never arrives.