Data Processing Agreement

This DPA applies where Revora processes personal data on behalf of the Merchant in connection with the Service.

For Merchant account information, billing of the Revora plan, and related administrative data, Revora acts as an independent Controller. That processing is governed by our Privacy Policy and is outside the scope of this DPA.

Subject matter: Provision of the Revora cancellation and retention Service.

Duration: For the term of the Merchant’s use of the Service and any period required for deletion or return of data.

Nature and purpose: Processing of cancellation session data to deliver the widget, generate analytics available to the Merchant, and (where enabled) provide optional Intelligence insights.

Types of personal data: Session identifiers, selected cancellation reasons, limited free-text feedback, subscription-related identifiers provided by the Merchant, and technical metadata necessary to operate the Service.

Categories of data subjects: End-users of the Merchant’s subscription services who interact with the Revora widget.

Revora shall process personal data only on the Merchant’s documented instructions, unless required to do otherwise by applicable law. In that case, Revora will inform the Merchant of the legal requirement before processing, unless the law prohibits such notice.

The Merchant’s instructions are set out in this DPA, the Terms of Service, the Privacy Policy, the configuration of the Service, and any additional written instructions agreed by the parties.

Revora shall:

• Process personal data only in accordance with documented instructions
• Ensure that persons authorised to process the data are bound by confidentiality
• Implement appropriate technical and organisational measures
• Assist the Merchant, where reasonably possible, with data subject rights requests
• Assist the Merchant with security, breach, and impact assessment obligations, taking into account the nature of processing
• Delete or return personal data at the end of the Service, subject to legal retention requirements
• Make available information reasonably necessary to demonstrate compliance with this DPA

The Merchant authorises Revora to engage subprocessors to process personal data in connection with the Service. A current list of subprocessors is available on our Subprocessors page.

Revora will impose data protection obligations on subprocessors that are substantially similar to those in this DPA. Revora remains responsible for the performance of its subprocessors.

We may update the list of subprocessors from time to time. We will update the Subprocessors page to reflect material changes and provide any notices required under applicable agreements or law. Where required by applicable law, Merchants may raise reasonable objections on data-protection grounds.

Revora implements commercially reasonable technical and organisational measures designed to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction, or damage. Further details are available on our Security page.

Taking into account the nature of the processing, Revora will assist the Merchant, by appropriate technical and organisational measures where possible, in responding to requests from data subjects to exercise their rights under applicable data protection law.

End-users should generally direct requests concerning their cancellation-session data to the Merchant. Revora will support the Merchant with such requests where required.

Revora will notify the Merchant without undue delay after becoming aware of a personal data breach affecting personal data processed under this DPA. The notification will include information reasonably available to Revora to assist the Merchant in meeting its own notification obligations.

Upon termination of the Service, Revora will delete or return personal data processed under this DPA, at the Merchant’s choice, unless applicable law requires retention. Deletion will be carried out according to our applicable procedures. Data held in backups may persist for a limited period until those backups are rotated or expired in the ordinary course.

Further details on retention are set out in our Privacy Policy.

Revora will make available to the Merchant information reasonably necessary to demonstrate compliance with this DPA. Any audit will be limited to what is reasonably required, conducted with reasonable prior notice, subject to confidentiality obligations, and carried out in a manner that minimises disruption to Revora’s operations. The parties may agree additional practical arrangements for any audit.

Personal data may be processed in countries outside the Merchant’s jurisdiction, including the United States. Where required by applicable law, we rely on appropriate transfer mechanisms made available by our providers (which may include Standard Contractual Clauses or equivalent safeguards).

This DPA takes effect when the Merchant starts using the Service and continues for as long as Revora processes personal data on the Merchant’s behalf. Provisions that by their nature should survive will survive termination.

This DPA is governed by the same law and dispute-resolution provisions as the Terms of Service.