Effective from September 25, 2026In order to provide the Service to its Users, Cargo processes data of customers or visitors of the Users’ site or service (herein: “User Customers”). The processing of such data by Cargo is hereinafter referred to as “Processing”. The following Data Processing Agreement (“DPA”) sets forth the terms of such Processing by Cargo.
This DPA forms part of the Cargo Terms of Use, Privacy Policy and any other applicable Cargo terms governing the use of the Service (herein the, “Terms of Use”, “Privacy Policy” and, collectively, the “Cargo Policies”). The terms of the Cargo Policies shall apply to this DPA as applicable. In the event of contradiction between this DPA and any of Cargo Policies, the provisions of this DPA shall govern. Any capitalized term not defined herein, shall have the meaning ascribed to it in the Cargo Policies.
To the extent User Customer Data is Processed by Cargo on behalf of the User, the User acknowledges and agrees that Cargo will process personal data as necessary to provide the Services under the DPA and by using the Cargo Services, the User has instructed Cargo to process such Personal Data on his/her/its behalf pursuant to this DPA.
Definitions
For the purpose of this DPA, the following terms have the following meaning
The terms “Controller”, “Data Subject”, “Personal Data”, “Personal Data Breach”, “Processing”, and “Processor”, as used in these DPA, have the meanings given in the GDPR and as specified in other applicable regulations as set forth in Annex 2 (together, the “Applicable Data Protection Regulations”).
“Standard Contractual Clauses” or “Clauses” means the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission in Implementing Decision (EU) 2021/914 of 4 June 2021, as completed in Annex 1 of this DPA. The Clauses are incorporated into and form part of this DPA.
“Sub-processor” means any third party engaged by Cargo to Process User Customer Data on Cargo’s behalf. The current list of Sub-processors and their processing locations is published at cargo.site/sub-processors and forms Annex 3 of this DPA.
User Customer Data means the Personal Data of User Customers as Processed by Cargo on behalf of the Users.
Terms of Personal Data Processing by Cargo
Cargo shall
Process User Customer Data for the provision of the Services to Cargo Users and according to the Cargo Policies.
Process User Customer Data only on the specific instructions of the User, including with regard to overseas transfers of Personal Data to a third country.
Ensure that any person acting under its authority who has access to User Customer Data Processes it only on the instructions of the User, unless required to do so by applicable law.
Ensure that its personnel have committed themselves to appropriate contractual or statutory obligations of confidentiality.
Implement appropriate technical, organizational and security measures to protect the privacy and security of the User Customer Data, as described in Annex 1.
Users shall:
Collect, use and process Personal Data in accordance to the Applicable Data Protection Regulations.
Have sole responsibility for the accuracy, quality, and legality of User Customer Data and the means by which it was obtained.
Ensure the appropriate level of security when using Cargo Services, taking into consideration any risks with respect to User Customer Data.
Any storage and/or transfer of User Customer Data by User to any third-party or platform other than Cargo shall be at the sole risk and responsibility of the User.
Sub-processors. The User hereby grants Cargo general authorization to engage Sub-processors without obtaining any further written, specific authorization from the User. Cargo will specifically inform the User in writing of any intended addition or replacement of a Sub-processor at least 30 days before the new Sub-processor begins Processing User Customer Data. The User may object to Cargo’s appointment of a new Sub-processor on reasonable data protection grounds by notifying Cargo within that notice period, and Cargo will not use the objected-to Sub-processor to Process Personal Data on behalf of the User while the objection remains unresolved. Cargo shall enter into a written agreement with each Sub-processor imposing data protection obligations as required by Applicable Data Protection Regulations. Cargo shall remain fully responsible to the User for the performance of each Sub-processor’s data protection obligations in connection with the Processing of User Customer Data.
If Cargo becomes aware of a Personal Data Breach affecting User Customer Data, Cargo will notify the affected User without undue delay and provide information concerning the Personal Data Breach as reasonably available to Cargo and required by Applicable Data Protection Regulations.
Upon reasonable written request, Cargo will make available to the User information necessary to demonstrate compliance with its obligations under this DPA and Applicable Data Protection Regulations.
Taking into account the nature of the Processing, Cargo shall assist the User by appropriate technical and organisational measures, insofar as reasonably possible, for the fulfilment of the User’s obligations to respond to requests for exercising Data Subject rights under Applicable Data Protection Regulations.
Taking into account the nature of the Processing and the information available to Cargo, Cargo shall provide reasonable assistance to the User with its obligations relating to security of Processing, Personal Data Breach notifications, data protection impact assessments and prior consultation with supervisory authorities, to the extent required by Applicable Data Protection Regulations.
This DPA shall be in effect in relation to each User, for as long as such User, uses any of the Cargo Service; provided, however, that in the event Cargo is obligated, according to the terms of this DPA or any Cargo Policies, to keep Personal Data of a User Customer following the termination of the Services, this DPA shall continue to be in effect for as long as Cargo holds such Personal Data.
Upon termination of the use by the User of the Services, and unless Cargo is required to retain such User Customer Data under Cargo Policies, any other agreement or Applicable Data Protection Regulations, Cargo shall, including upon written request by the User, delete the User’s Personal Data as soon as reasonably practicable and according to Cargo Policies and applicable laws.
Cargo shall have the right to amend and/or adjust any of the terms of this DPA as may be required from time-to-time, in order to comply with any applicable laws or regulations.
Any questions regarding this DPA or requests from Users to exercise Data Subject Rights as described herein, in the GDPR, or other applicable regulation, should be sent to support@cargo.site. Cargo will attempt to resolve any complaints regarding the use of your User Customer Data in accordance with this DPA and Cargo Policies.
Annex 1 — Standard Contractual Clauses
The standard contractual clauses set out in the Annex to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (the “EU SCCs”), as published in the Official Journal of the European Union, are incorporated into this DPA by reference and apply to any transfer of User Customer Data from the European Economic Area to Cargo. The EU SCCs are completed as follows:
Modules. Module Two (transfer controller to processor) applies where the User is a Controller of the User Customer Data. Module Three (transfer processor to processor) applies where the User is itself a Processor acting on behalf of another Controller.
Clause 7 (docking clause) and the optional language in Clause 11(a) do not apply.
Clause 9(a) (use of sub-processors): Option 2 applies, with a notice period of 30 days, as described under Sub-processors in this DPA.
Clause 13(a) (supervision): whichever of its three options matches the User’s situation applies.
Clause 17 (governing law): Option 1 applies; the Clauses are governed by the law of Ireland.
Clause 18 (choice of forum and jurisdiction): the courts of Ireland.
Annex I.A — List of parties
Data exporter: the entity identified as the “User” in this DPA, at the address and contact details held in its Cargo account. Role: Controller (Module Two) or Processor (Module Three).
Data importer: Cargo, 3006 N Coolidge Ave., Los Angeles, CA 90039, United States, support@cargo.site. Activities relevant to the transfer: hosting and operating the User’s website and the Services described in the Cargo Policies. Role: Processor.
Annex I.B — Description of the transfer
Categories of data subjects: visitors to the User’s website, customers of the User (including purchasers where the User uses Cargo Commerce) and any other person whose Personal Data the User publishes on, or collects through, their website.
Categories of personal data: content published by the User on their website; names, email addresses and message content submitted through contact forms; order, shipping and contact details where the User uses Cargo Commerce; IP addresses and technical data contained in server logs.
Sensitive data: the Services are not designed specifically for the Processing of special categories of Personal Data. Users may nevertheless submit or collect such data through the Services. Where special categories of Personal Data are Processed, the User is responsible for ensuring that such Processing is lawful under Applicable Data Protection Regulations and for identifying any additional safeguards required by applicable law.
Frequency of the transfer: continuous, for as long as the User uses the Services.
Nature and purpose of the Processing: hosting, storage, transmission and display of the User’s website and its data in order to provide the Services.
Retention: for the duration of the User’s use of the Services and thereafter as described in this DPA and the Cargo Policies.
Transfers to Sub-processors: as described in Annex 3, for the purposes stated there and for the same duration.
Annex I.C — Competent supervisory authority
The supervisory authority identified by the option of Clause 13(a) that applies to the User.
Annex II — Technical and organisational measures
Access control. Access to production systems and Personal Data is restricted to authorised Cargo personnel based on their responsibilities.
Encryption. Data transmitted between Users and the Services is encrypted in transit using TLS. Personal Data stored by Cargo is protected using encryption at rest where supported and appropriate.
Logging. Cargo maintains audit logging of its production infrastructure.
Backups. Cargo’s databases are backed up automatically.
For transfers of User Customer Data subject to the UK GDPR, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner (version B1.0, in force 21 March 2022) (the “UK Addendum”) is incorporated by reference and applies in addition to the EU SCCs. Tables 1 to 3 of the UK Addendum are completed with the information in this Annex 1, and for Table 4 either party may end the UK Addendum as set out in its section 19.
Annex 2 — Applicable Regulations
California:
The definition of “Applicable Data Protection Regulations” includes the California Consumer Privacy Act (“CCPA”).
The definition of (i) “Personal Data” includes “Personal Information”, (ii) “Data Subject” includes “Consumer”, (iii) “Controller” includes “Business”, (iv) “Processor” includes “Service Provider”, as defined under CCPA.
Cargo will process, retain, use, and disclose personal data only as necessary to provide its Services, which constitutes a business purpose.
Cargo agrees not to: (i) sell or share (as defined by the CCPA) User Customer Data; (ii) retain, use, or disclose User Customer Data for any commercial purpose (as defined by the CCPA) other than providing the Services; (iii) retain, use, or disclose User Customer Data outside of the scope of the Cargo Policies; or (iv) combine User Customer Data with personal information that Cargo receives from or on behalf of another person, or collects from its own interaction with the consumer, except as permitted by the CCPA.
Cargo will comply with its applicable obligations under the CCPA and provide the same level of privacy protection as is required by the CCPA. The User may take reasonable and appropriate steps to help ensure that Cargo uses User Customer Data in a manner consistent with the User’s obligations under the CCPA.
Cargo will notify the User if it determines that it can no longer meet its obligations under the CCPA. Upon notice, the User may take reasonable and appropriate steps to stop and remediate unauthorised use of User Customer Data by Cargo.
Cargo has entered into a written contract as required by the CCPA with each Sub-processor that Processes User Customer Data.
United Kingdom:
The definition of “Applicable Data Protection Regulations” includes the GDPR as it forms part of the law of the United Kingdom (the “UK GDPR”) and the Data Protection Act 2018, and references to the GDPR include the UK GDPR.