Data Processing Agreement (DPA)

• Purposes: retrieving, storing and displaying the reviews of the connected profiles (widgets, API, structured data), generating and publishing replies to reviews, alerts and reports; anonymising the profiles’ data to produce the aggregated statistics provided for in Article 20 of the Terms (the customer gives this instruction by accepting the Terms and may withdraw it at any time).
• Data subjects: authors of the reviews published on the customer’s profiles; where applicable, persons mentioned in the reviews or replies.
• Data: the author’s public name and profile photo as provided by the platform, the text, rating and date of the review, the customer’s reply, and technical identifiers of the review. The service is not intended to process sensitive data; any such data an author chooses to publish in a review is processed like the rest of the text.
• Operations: collection through the third-party platforms’ interfaces, recording, display, transmission to the artificial intelligence provider to generate replies, publication of replies, deletion.
• Duration: the term of the contract, then the return period provided for in Article 9.

OZAPP processes the data only on the customer’s documented instructions: the Terms, this agreement and the settings the customer makes in Revys constitute its instructions. OZAPP informs the customer if, in its opinion, an instruction infringes the GDPR, and does not process the data for any purpose other than providing the service. OZAPP does not use customer data to train artificial intelligence models.

Persons authorised to process the data are bound by a confidentiality obligation.

OZAPP implements appropriate technical and organisational measures (Article 32 GDPR), including:

• hosting of the application and database in the European Union (Germany);
• encryption of communications (HTTPS/TLS) and hashing of passwords;
• segregation of data by customer workspace and role-based access control;
• administrator access restricted to authorised OZAPP personnel;
• daily database backups, kept for seven (7) days;
• regular security updates of software components.

The customer authorises OZAPP to engage the following sub-processors:

• netcup GmbH (Karlsruhe, Germany): hosting of the application and database (EU);
• Requesty and the artificial intelligence model providers to which it gives access: generation of AI replies (text and rating of the review, author’s public name and the customer’s instructions);
• sendy.cloud and o2switch (Clermont-Ferrand, France): sending of alert and report emails that may contain the text of reviews (EU).

OZAPP imposes on each of them data protection obligations equivalent to those of this agreement and remains liable for their compliance. It informs the customer by email at least fifteen (15) days before adding or replacing a sub-processor. The customer may object on reasonable grounds relating to data protection; if no solution is found, the customer may terminate at no cost and obtain a refund of the paid and unused portion of the period.

Where a sub-processor processes data outside the European Economic Area, the transfer is governed by an adequacy decision of the European Commission (in particular the EU–US Data Privacy Framework for certified companies) or by the standard contractual clauses adopted by the Commission, supplemented where necessary by additional measures.

Taking into account the nature of the processing, OZAPP assists the customer in responding to requests to exercise data subjects’ rights (in particular, the customer can hide a review in Revys, and the author can delete it on the original platform, which removes it from Revys at the next synchronisation), as well as with its obligations regarding security, data protection impact assessments and prior consultation of the supervisory authority. OZAPP forwards to the customer without delay any request from a data subject that it receives directly.

OZAPP notifies the customer of any personal data breach affecting it as soon as possible and no later than forty-eight (48) hours after becoming aware of it, with the information available (nature, categories and approximate number of data subjects and records concerned, likely consequences, measures taken or proposed), supplemented as further information becomes available.

At the end of the contract, the customer may obtain, for thirty (30) days and on request to privacy@revys.io, an export of its reviews and replies in a structured format. OZAPP then deletes the data processed on the customer’s behalf, including copies, no later than the end of the backup cycle, unless retention is required by law.

OZAPP makes available to the customer the information necessary to demonstrate compliance with this agreement. The customer may, no more than once a year and with thirty (30) days’ notice, have an audit carried out at its own expense by an independent auditor bound by confidentiality, under arrangements agreed so as not to disrupt the service or compromise the security of other customers.

The parties’ liability under this agreement is governed by Article 18 of the Terms, without prejudice to the rights data subjects derive from Article 82 of the GDPR. This agreement is governed by Belgian law and subject to the courts designated in the Terms. In the event of a conflict between the Terms and this agreement on data protection, this agreement prevails.