Data Processing Addendum

1. Parties and scope

This Data Processing Addendum ("DPA") is between VELJASMELE LTD, trading as Replyze, company number 15570351, 128 City Road, London EC1V 2NX, United Kingdom ("Replyze", the processor), and the business that uses Replyze, directly or through Replyze for Shopify ("Customer", the controller). It forms part of the Terms of Service and applies whenever Replyze processes personal data on the Customer's behalf. It is designed to meet Article 28 of the UK GDPR and the EU GDPR.

2. Details of the processing

• Subject matter and purpose: providing the Replyze live chat, AI answers, inbox, notifications and, for Shopify stores, answers about orders and products.
• Duration: for as long as the Customer uses Replyze, then until deletion under section 8.
• Data subjects: visitors to the Customer's websites and stores, the Customer's shoppers and customers, and the Customer's team members.
• Personal data: chat messages and attachments; names and email addresses visitors give; IP address, approximate location, browser, device and pages viewed; for Shopify stores, an order's status, fulfilment, shipment tracking and items, the order email (compared, not stored) and the Shopify customer id of a signed-in shopper.
• Special categories: none are required. The Customer should not ask visitors to share them in the chat.

3. Replyze's obligations

• Process personal data only on the Customer's documented instructions, which are this DPA, the Terms and the Customer's settings in Replyze, unless the law requires otherwise (in which case Replyze will tell the Customer first, where allowed).
• Make sure everyone authorised to process the data is bound by confidentiality.
• Keep the security measures in Annex 1 in place.
• Not sell the data, use it for advertising, or use it to train AI models.
• Help the Customer answer data subjects' requests (access, correction, deletion, export, objection), mainly through the export and delete features of Replyze.
• Help the Customer with security, data protection impact assessments and consultations with authorities, as far as they concern Replyze.

4. Sub-processors

The Customer authorises the sub-processors in Annex 2. Replyze binds each of them to data protection terms no less protective than this DPA and stays responsible for them. Replyze will announce a new sub-processor on this page and by email at least 30 days before it starts processing Customer data. The Customer may object on reasonable data protection grounds; if the parties can't resolve the objection, the Customer may end the affected service and receive a pro-rata refund of prepaid fees.

5. International transfers

Where personal data is transferred outside the UK or the EEA, Replyze relies on an adequacy decision or on the Standard Contractual Clauses together with the UK International Data Transfer Addendum, and the sub-processor terms that include them.

6. Personal data breaches

Replyze will notify the Customer without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting the Customer's data. The notice will describe what happened, the data and people likely affected, the likely consequences and the measures taken or proposed, as far as this is known, with updates as more is learned.

7. Audits

Replyze will make available the information needed to show compliance with this DPA, including written answers to reasonable security questionnaires. Where that is not enough, the Customer may audit Replyze once a year, on 30 days' notice, during business hours, at its own cost and under confidentiality.

8. Deletion

The Customer can delete conversations and contacts at any time. Conversations and contacts are deleted automatically 24 months after their last activity. When the Customer's account ends, Replyze deletes the Customer's personal data within 30 days (for Shopify stores, 48 hours after the app is uninstalled), and it leaves the encrypted backups within a further 14 days, unless the law requires it to be kept. The Customer can export its data before then.

Annex 1: Security measures

• Encryption in transit: TLS on every connection between browsers, Cloudflare, Replyze servers and sub-processors.
• Encryption at rest: backups are encrypted, and Shopify access tokens and two-factor secrets are encrypted in the application. Servers are hosted in Hetzner's ISO 27001-certified data centres in Germany.
• Access control: production access is limited to authorised staff; each workspace's data is separated in the application; team members' access depends on their role in the workspace.
• Logging: opening or exporting a conversation or contact is recorded in the workspace's audit log; server logs are kept 14 days.
• Backups and recovery: daily encrypted database backups, kept 14 days.
• Data minimisation and retention: only the data needed for the chat is collected; visitor tracking needs the visitor's consent where the site requires it; retention as in section 8 and the Privacy Policy.
• Separation: development and tests do not use production data.
• Incident response: a written process to contain, assess, notify and learn from security incidents.

Annex 2: Sub-processors

Integrations the Customer connects (such as Slack, HubSpot or Facebook) are not Replyze's sub-processors: they receive data at the Customer's instruction, under the Customer's own agreement with them.

Contact

Questions about this DPA, or a signed copy: [email protected].