Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Revivanda Terms of Service between you ("Customer", the controller) and JCerme Software Solutions ("Revivanda", the processor). It applies where Revivanda processes personal data on the Customer's behalf and is designed to support obligations under laws such as the GDPR, the UK GDPR and the CCPA and CPRA.

Roles and scope

The Customer is the controller of the personal data it collects through Revivanda, including the contact details and feedback of its own customers. Revivanda acts as a processor and processes that data only to provide the service and on the Customer's documented instructions, which include these terms and the settings the Customer chooses.

Nature of the processing

Revivanda processes personal data to host branded feedback pages, capture ratings and responses, operate the feedback inbox, deliver notifications and integrations, and provide support. The categories of data subjects are the Customer's own customers and staff. The categories of data are contact identifiers, feedback content, ratings and related metadata.

Confidentiality and security

Revivanda keeps personal data confidential and requires personnel with access to be bound by confidentiality obligations. Revivanda maintains technical and organizational measures appropriate to the risk, including encryption in transit, access controls, tenant isolation and least-privilege administration.

Subprocessors

The Customer authorizes Revivanda to use subprocessors to provide the service, including cloud hosting, database, payment and messaging providers. Revivanda imposes data protection terms on each subprocessor that are no less protective than this DPA and remains responsible for their performance. A current list is available on request.

International transfers

Where personal data is transferred out of the EEA, the UK or Switzerland, the transfer is made under an approved mechanism such as the Standard Contractual Clauses, together with any additional safeguards required.

Data subject requests and assistance

Revivanda will, taking into account the nature of the processing, assist the Customer with responding to data subject requests and with the Customer's obligations around security, breach notification and data protection assessments. If Revivanda receives a request directly from a data subject, it will refer that person to the Customer.

Breach notification

Revivanda will notify the Customer without undue delay after becoming aware of a personal data breach affecting the Customer's data, and will provide the information the Customer reasonably needs to meet its own notification obligations.

Return and deletion

On termination the Customer can export its data for 30 days, after which Revivanda deletes or returns the personal data, except where retention is required by law. Deletion can be requested sooner from within the dashboard or by contacting us.

Audits

Revivanda will make available the information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, conducted by the Customer or an auditor it mandates, subject to reasonable notice and confidentiality.

How to accept this DPA

This DPA is incorporated into the Terms of Service and applies automatically where Revivanda processes personal data on your behalf. If your organization needs a countersigned copy, email the contact address below and we will arrange one.