Data processing agreement
Melsho · Last updated: 2026-10-22
This is a translation for your convenience. The Spanish version is the binding one and prevails over this translation in case of any discrepancy.
This agreement is part of the Terms of service and governs the processing that Melsho ("the processor") carries out on behalf of each customer store ("the controller") on the personal data of its end customers.
Purpose and instructions
The processor processes the data only to provide Orbit according to the controller’s settings and actions, and does not use it for its own purposes.
Confidentiality and security
The people authorized to access the data are bound by confidentiality. The processor applies technical and organizational measures: separation per store, encryption of credentials, role-based access control, logging of sensitive access, backups and monitoring.
Sub-processors
The controller authorizes the use of the sub-processors needed for the service (hosting, backups, platform email and AI provider). The processor will give reasonable advance notice of relevant changes so the controller can object.
Assistance
The processor will assist the controller in handling requests from data subjects and will notify it without undue delay, and within 72 hours of becoming aware of it, of any security incident affecting its data.
End of the service
When the service ends, the processor will make a full export available to the controller for 30 days and then delete the data, unless the law requires it to be kept.
Audit
The controller may request the information needed to verify compliance with this agreement by writing to privacidad@melsho.com.