779985 - [Join Mozilla] Vendor Review - PDQ

Status: VERIFIED FIXED

(Privacy Graveyard :: Product Review, task, P2)

Description

[Ben Simon]

We're planning to work with a new merch/fulfillment vendor for some
stickers we're going to offer as an incentive to take a webmaker quiz. Since they'll be handling fulfillment, this means we'll be sending them names & mailing addresses of users.

The vendor is PDQ (http://pdqvegas.com/).

The reason why we want to use them instead of Staples, the main MoCo
merch supplier, is that PDQ is many times cheaper than Staples for
what we're trying to to (unit cost of ~$1 instead of ~$5).

I've sent the review questionnaire to PDQ and will add any response I receive to this bug.

Comment 1

[Ben Simon]

Attachment: PDQ's vendor questionnaire

Comment 2

[Ben Simon]

Hey Stacy -- need anything else from me before moving fwd with this?

Comment 3

[Stacy Martin [:stacy]]

Hi Ben - I've read their privacy policy and responses to the vendor privacy questionnaire.  Although their policy is very short, based on their responses to our questions, I don't see any concerns.  Because they will be handling names and mailing addresses of our users, the next step is to incorporate the Data Addendum in the agreement.  I will add Liz to the bug so she can attach the latest version.

Comment 4

[Liz Compton [:liz]]

Ben - Will you be opening a legal bug to put in place an agreement with PDQ? They may not be accustomed to having an agreement, they may just include some terms & conditions on their invoices, and for low dollar stuff like this Legal wouldn't ordinarily need to review, but since we'll be sending them our users' personal information, we'll have to put something simple in place that includes the data addendum or something similar. Will anyone around the world be eligible to take the quiz?

Comment 5

[Ben Simon]

Thanks, Stacy.

Hey Liz,

I hadn't been planning to file a legal bug around the stickers/shipping but can if you'd like me too -- i think incorporating a data addendum into whatever agreement we have with them will be fine from my perspective, and I don't think PDQ would have a problem with it.

And we had been planning to ship globally, yes.

Comment 6

[Liz Compton [:liz]]

Thanks Ben. Please do open a legal bug and if they have any standard terms, please attach those. We most likely won't need the full data addendum for this, just a few key provisions.

Comment 7

[Liz Compton [:liz]]

Hi Ben. Stacy and I were talking about the fact that Engagement is also conducting a sticker give away and they are having people send us a self addressed envelope in order to receive the stickers. In that way, no one receives or stores addresses. Would that work for the Foundation too or do you need the vendor to handle fulfillment?

Comment 8

[Ben Simon]

Hey Liz,

I'd really much rather not ask people to do this -- it significantly raises the bar for them, and makes it decidedly not "free" (and we also don't have the capacity to handle the fulfillment on our end).

Comment 9

[Liz Compton [:liz]]

OK, just a thought.

Comment 10

[Ben Simon]

No worries at all! Sorry if that seemed a little terse, just doing a couple too many things at once. 

I agree it would be great to combine/mirror if it made sense on our end, just don't think it quite matches up with our goals/capacity this time.

Comment 11

[Ben Simon]

Closing this out -- I'll add the signed legal agreement in the other bug once I have it.

Thanks all!