Data Processing Agreement

1. Parties and scope

This Data Processing Agreement ("DPA") is between the Customer and Respondo doo Beograd-Zvezdara, trading as Revnox, registration number 21537896, tax number (PIB) 111774560, based in Vitezova Karađorđeve Zvezde 50, 11050 Belgrade, Serbia ("Revnox"). It forms part of the Terms of Service and takes effect when the Customer accepts them. It applies whenever Revnox processes Customer Personal Data on the Customer's behalf.

For Customer Personal Data, the Customer is the controller and Revnox is the processor. Where the Customer is itself a processor for someone else, Revnox is its sub-processor, and the Customer is responsible for passing on what this DPA requires.

2. Definitions

• Data Protection Law: the GDPR (Regulation (EU) 2016/679), the laws that implement or supplement it, and any other data protection law that applies to the processing, including the Serbian Law on Personal Data Protection.
• Customer Personal Data: personal data in Customer Data, as defined in the Terms, that Revnox processes on the Customer's behalf.
• Sub-processor: another processor engaged by Revnox to process Customer Personal Data.
• Security Incident: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
• Standard Contractual Clauses: the clauses adopted by the European Commission in Implementing Decision (EU) 2021/914.
• Other terms, such as controller, processor, data subject and processing, have the meaning given in the GDPR.

3. Details of the processing

• Subject matter and duration: providing the Service under the Terms, for as long as the Customer has an account and until the data is deleted under section 12.
• Nature and purpose: collecting, enriching, storing, scoring, analysing and organising business information so the Customer can identify companies to sell to and the people to contact there; generating research and draft messages; and, when the Customer turns sending on, sending the Customer's messages from the Customer's own mailbox and processing the replies.
• Data subjects: people in business roles at companies the Customer researches or contacts; the Customer's Users; and anyone else whose data the Customer puts into the Service.
• Types of personal data: names, job titles, employers, work email addresses, business phone numbers, public professional profile addresses, work location at city and country level, public information about the person's employer, messages exchanged, opt-out records, and User account details.
• Special categories: none. The Terms forbid the Customer from putting them into the Service.

4. The Customer's instructions and responsibilities

Revnox processes Customer Personal Data only on the Customer's documented instructions. The Terms, this DPA and the Customer's own settings and use of the Service are those instructions. Further instructions must be in writing and consistent with the Terms. Revnox will tell the Customer if, in its opinion, an instruction infringes Data Protection Law, and may then decline to carry it out.

The Customer is responsible for:

• having a lawful basis for the processing and for any messages it sends;
• giving data subjects the information that Articles 13 and 14 of the GDPR require, including where their data came from;
• honouring objections and opt-outs, and not re-introducing data subjects who have objected;
• the accuracy and lawfulness of the Customer Personal Data it brings into the Service.

5. Revnox's obligations

• Process Customer Personal Data only as instructed, unless the law requires otherwise, in which case it will tell the Customer first where the law allows.
• Ensure that everyone authorised to process Customer Personal Data is bound by confidentiality.
• Keep the security measures in section 6 in place.
• Help the Customer, as far as reasonably possible, with data subject requests, security of processing, breach notifications, data protection impact assessments and consultations with authorities, taking into account the nature of the processing and the information available to it.
• Make available the information needed to show compliance with Article 28 of the GDPR, as described in section 11.
• Not sell Customer Personal Data, not combine it with other customers' data, and not use it to train artificial intelligence models.

6. Security measures

Revnox maintains technical and organisational measures appropriate to the risk, which currently include:

• Hosting of Customer Data in the European Union (Germany), with daily backups.
• Encryption of all traffic between users and the Service in transit.
• Encryption at rest of stored secrets, including mailbox credentials, mailbox authorisation tokens and integration keys, with a key held outside the database.
• Passwords stored only as salted one-way hashes, and API keys stored only in hashed form and shown once.
• Separation of every Workspace's data, enforced on every query and covered by automated tests that check one Workspace cannot read another's.
• Sign-in protection: email verification, manual approval of new accounts, limits on repeated failed sign-ins, and session cookies that page scripts cannot read and that expire after 24 hours.
• Role-based access inside each Workspace, and access to the operator's administration tools limited to named administrators and recorded in an audit log.
• Sending controls: sending is off in a new Workspace until the Customer turns it on, messages can be held for approval, the suppression list is checked before every send and a send is refused if the check cannot run, and an emergency stop halts all sending at once.

Revnox may update these measures, provided the overall level of protection does not decrease. The Security page describes them in more detail.

7. Sub-processors

The Customer gives Revnox general authorisation to engage Sub-processors. They currently fall into these categories: hosting and infrastructure in the European Union (Germany); AI model providers; business contact data providers; email verification; email delivery for messages the Service itself sends; and news and public data search services.

The current list of Sub-processors, with what each one processes and where, is available to the Customer on request at nikola@revnox.io. Revnox will notify the Customer at least 30 days before adding or replacing a Sub-processor, by email to the account owner. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may terminate the affected part of the Service, and will not be charged for the remainder of any period it has paid for.

Revnox imposes on each Sub-processor, by written contract, data protection obligations that are no less protective than this DPA, and remains responsible to the Customer for each Sub-processor's performance of them.

8. International transfers

Customer Data is hosted in the European Union (Germany). Some Sub-processors process Customer Personal Data outside the European Economic Area, and Revnox is operated from Serbia.

Revnox transfers Customer Personal Data out of the European Economic Area only to a country covered by an adequacy decision, or under the Standard Contractual Clauses or another safeguard recognised by Chapter V of the GDPR. Where the Customer's transfer to Revnox needs such a safeguard, the parties agree that the Standard Contractual Clauses (module two, controller to processor, or module three, processor to processor) are incorporated into this DPA, completed with the details in section 3 and the measures in section 6, and governed by the law of the EU member state in which the Customer is established, or Ireland if it is established in none. If they conflict with this DPA, the Standard Contractual Clauses prevail.

9. Data subject requests

If Revnox receives a request from a data subject about Customer Personal Data, it will pass it to the Customer without undue delay and will not answer it itself, except to confirm receipt and to say who the Customer is.

One instruction is given here in advance, because an objection to direct marketing must always be honoured: the Customer instructs Revnox to add to the Customer's suppression list the email address of any data subject who opts out or objects to being contacted, whether through the unsubscribe link in a message, by replying to one, or by writing to Revnox directly.

10. Security incidents

Revnox will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a Security Incident affecting the Customer's Personal Data. The notice will describe, as far as then known, what happened, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Information not yet available will follow as soon as it is.

Revnox will take reasonable steps to contain the incident and limit its effects, and will cooperate with the Customer's own notifications. Notifying the Customer is not an acknowledgement of fault.

11. Information and audits

Revnox will answer the Customer's reasonable written questions about its processing and security, including security questionnaires. If those answers are not enough to show compliance with this DPA, or an authority requires it, the Customer may audit Revnox's compliance once a year on 30 days' written notice, during business hours, at its own cost, through an auditor bound by confidentiality, and in a way that does not expose other customers' data.

12. Return and deletion

When the Customer's account ends, the Customer may ask for an export of Customer Personal Data within 30 days. After that, Revnox deletes Customer Personal Data within 30 days, and it is removed from backups as they expire, within 30 days after deletion, unless the law requires Revnox to keep it. On request, Revnox will confirm the deletion in writing.

13. Liability, precedence and term

Liability

Each party's liability under this DPA is subject to the limits in the Terms, except where Data Protection Law or the Standard Contractual Clauses do not allow it.

Precedence

On personal data, this DPA prevails over the Terms, and the Standard Contractual Clauses, where they apply, prevail over both.

Term

This DPA lasts as long as Revnox processes Customer Personal Data. The Privacy Policy describes the same processing from the point of view of the people whose data it is.