OPAL SaaS Data Processing Agreement (DPA)
This Data Processing Agreement (“DPA”) forms part of and supplements the applicable SaaS Agreement, Order Form, or Statement of Work (collectively, the “Agreement”) between Order Processing and Logistics LLC (OPAL LLC) (“OPAL”, “Company”, “we”, “us”) and the customer identified in the Agreement (“Customer”).
This DPA governs the processing of Personal Data by OPAL in connection with the OPAL SaaS platform and related services (“Services”).
In the event of any conflict between this DPA and the Agreement with respect to data protection, this DPA shall prevail.
- Definitions
For purposes of this DPA:
- “Personal Data” means information that identifies, relates to, describes, or is reasonably capable of being associated with an individual or household.
- “Data Protection Laws” means all applicable U.S. data protection and privacy laws, including the California Consumer Privacy Act (CCPA), as amended by the CPRA, and any implementing regulations.
- “Business” / “Controller” means the entity that determines the purposes and means of processing Personal Data.
- “Service Provider” / “Processor” means OPAL, processing Personal Data on behalf of Customer.
- “Subprocessor” means any third party engaged by OPAL to process Personal Data.
- “Processing” means any operation performed on Personal Data (collection, use, storage, disclosure, deletion).
- “Sell”, “Share”, “Commercial Purpose” shall have the meanings set forth in the CCPA.
- “Sensitive Personal Information” has the meaning defined under applicable Data Protection Laws.
- Roles and Scope
- Customer acts as the Business / Controller
- OPAL acts as the Service Provider / Processor
OPAL shall process Personal Data solely on behalf of Customer and in accordance with documented Customer instructions and this DPA.
- Purpose of Processing
OPAL processes Personal Data strictly to provide the Services, including:
- Order lifecycle management (intake, validation, routing, fulfillment)
- Warehouse and inventory operations
- Shipping, labeling, documentation, and tracking
- Integration with ERP systems, retailers, and logistics providers
- Reporting, analytics, and operational visibility
OPAL shall not process Personal Data for any purpose outside the scope of this Section unless required by law.
- CCPA / CPRA Service Provider Commitments
To comply with applicable privacy laws, including CCPA/CPRA, OPAL:
- Does not sell Personal Data
- Does not share Personal Data for cross-context behavioral advertising
- Does not retain, use, or disclose Personal Data for any purpose other than:
- Performing Services specified in the Agreement
- Internal business purposes permitted under CCPA
- Does not combine Personal Data received from Customer with Personal Data obtained from other sources, except as permitted by law
- Will provide the same level of privacy protection as required by CCPA
OPAL certifies that it understands and will comply with its obligations as a Service Provider under CCPA/CPRA.
- Customer Obligations
Customer represents and warrants that:
- It has lawful rights to collect and share Personal Data with OPAL
- It provides all required notices to individuals
- It complies with applicable Data Protection Laws
Customer is responsible for:
- Data accuracy and lawfulness
- Data minimization
- Industry-specific compliance (e.g., healthcare, financial data)
- OPAL Processing Commitments
OPAL shall:
- Process Personal Data only on Customer instructions
- Limit access to authorized personnel only
- Ensure Personal Data is used exclusively for Service delivery
- Support legitimate internal uses such as:
- Service improvement
- Security monitoring
- Fraud prevention
- Legal compliance
- Data Security
OPAL implements reasonable and appropriate administrative, technical, and organizational safeguards, including:
- Secure cloud infrastructure
- Access controls and role-based permissions
- Encryption in transit and at rest (where applicable)
- Monitoring, logging, and incident detection controls
Security measures are proportionate to:
- Sensitivity of data
- Volume of processing
- Industry standards
- Personnel and Confidentiality
OPAL ensures that all personnel:
- Are bound by confidentiality obligations
- Receive data protection training
- Access Personal Data strictly on a need-to-know basis
- Subprocessors
OPAL may engage Subprocessors and shall:
- Maintain a list of Subprocessors upon request
- Impose contractual obligations equivalent to this DPA
- Remain fully liable for Subprocessor performance
- Security Incidents
In the event of a Security Incident, OPAL will:
- Notify Customer without undue delay
- Provide relevant details reasonably available
- Take commercially reasonable steps to mitigate impact
OPAL is not responsible for incidents caused by Customer systems or misuse.
- Data Subject Requests
If OPAL receives a request from an individual:
- OPAL will notify Customer promptly
- OPAL will not respond directly unless legally required
OPAL will reasonably assist Customer in handling:
- Access requests
- Deletion requests
- Correction requests
- Opt-out requests under CCPA (where applicable)
- Data Retention and Deletion
- Personal Data is retained only for the duration of the Agreement unless required by law
- Upon termination, OPAL will:
- Delete or return Personal Data upon Customer request
- Retain limited data only for legal compliance
- Audits and Compliance
Upon reasonable request (typically annually), OPAL may provide:
- Security documentation summaries
- Third-party audit reports (if available)
Any audit access is subject to confidentiality and reasonable limitations.
- International Data Transfers
If Personal Data is transferred outside the United States:
- OPAL will implement appropriate safeguards consistent with applicable law
- Limitation of Liability
Liability under this DPA is governed by and subject to the limitations stated in the Agreement.
- Term and Survival
This DPA remains in effect for the duration of the Agreement and survives termination to the extent required by law.