Data processing agreement

This version applies from 21 augustus 2026.

This is a translation, provided so you can read what you are agreeing to. If the English and the Dutch text differ, the Dutch version is the one that counts. Ordly is a Dutch company and Dutch law applies.

1. Who is who

You are the controller for your buyers' personal data. Ordly is the processor: we process that data only on your instructions and only to deliver the service you buy.

2. What we process it for

• Fetching your orders from bol and showing them in your portal.
• Creating invoices and credit notes and sending them to bol.
• Sending review emails through your mail service, according to bol's rules.
• Tracking returns and holding back the matching review email.

Nothing else. We do not use this data for our own purposes, not for research, and not to learn anything from it.

3. Which data this concerns

• Name and town. Readable in the database, because you need to be able to search on it and it goes on the invoice.
• Address, postcode and email address. Encrypted with AES-256-GCM, using a key that is separate per customer.
• What was ordered. Item, quantity, amount. Needed for the invoice and the review email.

4. How we secure it

• One database per customer. Your data does not sit in the same table as another seller's; there is no query that can accidentally reach past it.
• Encryption per customer. Buyers' address, postcode and email address go into the database with AES-256-GCM, using a key that is separate per customer. The master key lives outside the data directory and is not included in the backup.
• Over https only, with a valid certificate. The portal refuses unencrypted traffic.
• We do not look at your data. There is no admin screen on which we can browse through your orders. If we do have to look somewhere to fix a fault, we ask you first and tell you afterwards what we saw.
• Backups are encrypted and kept in a different location from the server.

5. Where it is kept

On a server in Germany, at Hetzner. Within the European Economic Area, so there is no transfer to a country outside the EEA.

6. Who we bring in

Only parties needed to deliver the service, and only under the same agreements as set out here. At present: Hetzner (the server), and the mail service you choose and set up yourself. If a party is added, we tell you at least a month in advance and you can object; that is then a reason to cancel without notice.

7. If a buyer asks something

If a buyer asks for access or deletion, that is your request to handle. We help you get at it, free of charge, within a week.

8. If something leaks

We tell you within 24 hours of finding out, with everything you need to judge for yourself whether you have to report it to the Dutch Data Protection Authority. Reporting to the authority and to your buyers is your job, because you are the controller; we supply the facts.

9. If you stop

You can export everything up to thirty days after your last day. After that we delete your environment, including your buyers' data, except what we are legally required to keep. If you want it gone sooner, say so and it happens within a week.

10. Audits

Once a year you may ask how we do this, and we answer with evidence. If you want an external audit, that is possible at your expense and at a time we agree together.