Legal & compliance documents

The Legal tab gives you two ready-made compliance documents, pre-filled with your store and merchant details: a Data Processing Addendum (DPA) and a privacy policy. They’re the kind of paperwork EU regulators and larger B2B prospects ask for. Find the tab under Settings → Brand → Legal, or go to /app/<storeId>/settings/legal. The page header reads Legal documentswith the kicker “Compliance.”

Data Processing Addendum

A GDPR and UK GDPR–compliant DPA describing how Zubby processes shopper data on your behalf as your data processor. It’s the contract you give a customer (or that a B2B buyer’s legal team requests) to document the data-processing relationship.

Click Download DPA to fetch it. The intended workflow is simple: download, sign, and counter-sign with your customer.

Privacy policy

A plain-text privacy policy describing how Zubby handles shopper data on your behalf. It’s written to drop into your store footer alongside your own policies. Click Download privacy policy to get it.

How downloads work

Each button links to a dedicated export endpoint that generates the document for your store on the fly — the DPA and privacy policy are served from /api/v1/exports/legal/<storeId>/dpa and /api/v1/exports/legal/<storeId>/privacyrespectively. Because they’re generated from live data, re-downloading after you update store details gives you a refreshed copy.

When you’ll need these

• Closing B2B deals— enterprise buyers routinely require a signed DPA before they’ll let a vendor process data.
• Selling into the EU/UK— GDPR expects a clear processor agreement and a published privacy policy.
• Responding to a data-protection questionnaire— having a pre-filled DPA on hand shortens vendor review cycles.

Related

For the account-protection controls that sit alongside compliance, see Security. Data-subject requests and shopper privacy controls connect to the broader privacy tooling — review your Settings overview for where those live, and the pricing page for plan availability.