Data Processing Agreement

This DPA governs the processing of personal data by Reviewed on behalf of the Controller when the Controller uses Reviewed to manage customer communication and review follow-up messaging.

This Agreement applies to all personal data processed by Reviewed in connection with the Service.

4.1 Controller Responsibilities

• Determines the purposes and means of processing personal data
• Ensures lawful basis for processing under Applicable Data Protection Law
• Obtains valid consent from data subjects where required
• Provides privacy notices to data subjects
• Ensures accuracy and quality of personal data

4.2 Processor Responsibilities

• Processes personal data only on documented instructions from the Controller
• Implements appropriate technical and organisational security measures
• Ensures confidentiality of personnel processing personal data
• Assists the Controller in fulfilling data subject rights requests
• Notifies the Controller of any data breaches without undue delay

Reviewed processes personal data only as instructed by the Controller through the Controller’s use of the Service, configuration settings and templates, and direct instructions via support channels.

• Encryption of data in transit and at rest
• Access controls and authentication
• Regular security audits and vulnerability assessments
• Employee confidentiality agreements
• Incident response procedures
• Regular backups

Reviewed may engage sub-processors to assist in providing the Service. The Controller consents to the use of these sub-processors. Reviewed will notify the Controller of any changes.

Reviewed will assist the Controller in responding to data subject rights requests including:

In the event of a personal data breach, Reviewed will notify the Controller without undue delay and no later than 72 hours after becoming aware, providing:

• Nature of the breach
• Categories and approximate number of data subjects affected
• Likely consequences
• Measures taken or proposed to address the breach

Upon termination of the Service or upon request, Reviewed will delete or return all personal data to the Controller and delete existing copies, unless retention is required by law.

Reviewed will make available to the Controller information necessary to demonstrate compliance with this DPA and allow for audits upon reasonable notice.

Personal data is processed and stored in the UK and EEA. If data is transferred outside these regions, Reviewed will ensure appropriate safeguards are in place as required by Applicable Data Protection Law.

This DPA remains in effect for as long as Reviewed processes personal data on behalf of the Controller. Obligations survive termination where required by law.