Privacy Policy
Data Subject Rights & Personal Data Handling
Effective Date: September, 2026
1. Scope and Roles
OrderMesh, Inc. (“OrderMesh,” “we,” “our”)operates the OrderMesh Platform, used by account holders (“Customer,” asdefined in our Terms of Service) to route and fulfill orders to their own endconsumers (each, an “End Consumer”) across a network of independent FulfillmentPartners. This policy explains how OrderMesh handles personal data in thatcontext, and the rights available to individuals. Capitalized terms not definedhere have the meanings given in our Terms of Service.
● Processor role: For End Consumer personal data (name, delivery/billing address, phone,email, and order details) processed to fulfill a Customer's orders, OrderMeshacts as a processor on behalf of the Customer, who is the data controller.Requests concerning End Consumer data are generally directed to, and honored onthe instruction of, the relevant Customer, consistent with our Data ProcessingAgreement.
● Controller role: For Customer account and billing contact data (e.g., a User's first andlast name, username, and email address, as defined in our Terms of Service),OrderMesh acts as the data controller.
2. What Personal Data We Process
As documented in OrderMesh's Record ofProcessing Activities (ROPA), the personal data categories processed throughthe Platform include: End Consumer name; delivery and billing address; phonenumber; email address; and order and shipment records, together with Customeraccount and billing contact information.
Consistent with our Terms of Service,Customer Data submitted to the Platform must not include: government-issuedidentification numbers (including Social Security numbers); personal financialaccount information; special categories of personal data under GDPR Article 9;personal data relating to criminal convictions or offenses under GDPR Article10; protected health information under HIPAA; or other information subject toheightened requirements under applicable law. OrderMesh does not intentionallyprocess any such data.
3. Your Rights
Subject to applicable law and, whereOrderMesh acts as a processor, subject to the instructions of the relevantCustomer, individuals have the following rights with respect to their personaldata:
● Right to Access: request confirmation of whether we process your personal data, and acopy of that data.
● Right to Rectification: request correction of inaccurate or incompletepersonal data.
● Right to Erasure: request deletion of your personal data, subject to any legal orcontractual obligation to retain it.
● Right to Restrict / Stop Processing: request that we stop or limit a specific processingactivity involving your personal data.Where OrderMesh acts as a processor for aCustomer's End Consumer data, we route these requests to the applicableCustomer and act on their instructions, consistent with our Data ProcessingAgreement. Where OrderMesh acts as controller, we respond directly.
4. How to Exercise Your Rights
Requests may be submitted toprivacy@ordermesh.com. We aim to acknowledge requests promptly and to respondwithin the timeframe required by applicable law. We may need to verify youridentity, or the identity of the requesting party, before acting on a request.
5. Technical Processes SupportingThese Rights
● Access / export: personal data associated with an order can be retrieved and exported byCustomer/account identifier
.● Erasure: deletion is carried out under OrderMesh's documented deletion procedure,completed and certified within 30 days of a validated request
.● Rectification: open order records can be corrected on the instruction of the applicableCustomer.
● Standard retention: End Consumer PII is redacted no later than 30 days after orderfulfillment in the ordinary course; related documents follow a 365-daylifecycle, and logs are PII-scrubbed with a 30-day retention.
6. Purpose Limitation
Consistent with Section 8(d) of our Terms ofService, personal data submitted to the Platform is used by OrderMesh solely toprovide and support the Services, manage the Customer's Account, calculatefees, and fulfill OrderMesh's contractual obligations. OrderMesh will not usesuch data for any purpose beyond the foregoing, and does not sell personaldata.
7. Who We Share Data With
Personal data necessary to complete an orderis shared with the independent Fulfillment Partner (and, where applicable,shipping carrier) assigned to that order, and with OrderMesh's hosting andinfrastructure sub-processors, solely as necessary to provide the Platform.Fulfillment Partners are independent contractors and are not OrderMeshemployees or agents. A current list of sub-processors is maintained atOrderMesh's trust center.
8. Data Security
Consistent with Section 6(b) of our Terms ofService, OrderMesh implements and maintains reasonable, industry-standardtechnical and organizational measures designed to protect the security,confidentiality, and integrity of personal data against unauthorized access,use, alteration, or disclosure, including encryption in transit and at rest,role-based access controls, and incident response procedures, as furtherdescribed in our Data Processing Agreement.
9. Security Breach Notification
Consistent with Section 6(e) of our Terms ofService, OrderMesh will notify the affected Customer of any confirmed securitybreach affecting Customer Data in accordance with applicable law.
10. Changes to This Policy
We may update this policy from time to time.Material changes will be reflected by an updated effective date above and,where required, notified consistent with Section (f) of our Terms of Service.
11. Contact
Questions about this policy or your personaldata may be directed to privacy@ordermesh.com.
