⚖️ LEGAL REVIEW REQUIRED. This is a template DPA. Counsel must (a) confirm the operating entity and registered address, (b) review SCC module choice and UK IDTA, (c) confirm Annex II TOMs match the live whitepaper, and (d) review the audit-rights clause against insurance and operational constraints.

Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service (the "Agreement") between {{LEGAL_ENTITY}} ("Processor", "we") and the customer that has accepted the Agreement ("Controller", "you"). Where the Agreement is silent, this DPA governs in respect of personal data.

This DPA reflects the parties' agreement on the processing of personal data under the UK GDPR, the EU GDPR (Regulation (EU) 2016/679) and, where applicable, the Swiss FADP. The 2021 EU Standard Contractual Clauses (Commission Decision (EU) 2021/914), Module 2 (controller-to-processor), and the UK International Data Transfer Addendum (UK IDTA) are incorporated by reference and apply to onward transfers from the UK/EEA.

1. Definitions

Capitalised terms not defined here have the meanings in the GDPR. "Personal Data" means personal data processed by us on your behalf in connection with the Service. "Sub-processor" means any third party engaged by us to process Personal Data.

2. Subject matter and details of processing

3. Roles

Controller is the controller of the Personal Data. We are the processor. To the extent Controller's processing instructions to us require us to act as an independent controller, that processing is governed by the Privacy Policy, not this DPA.

4. Controller obligations

Controller will:

• Have all lawful bases necessary for the Personal Data it submits.
• Provide all notices and obtain all consents required from data subjects.
• Issue all processing instructions through use of the Service and its documented configuration options; out-of-band instructions must be in writing.

5. Processor obligations (Article 28(3))

We will:

1. Process Personal Data only on Controller's documented instructions (the Agreement, this DPA, and Service configuration), including in respect of international transfers, unless required by law to which we are subject — in which case we will inform Controller of that requirement before processing, unless prohibited by law on important grounds of public interest.
2. Ensure that persons authorised to process Personal Data are under appropriate confidentiality obligations.
3. Implement the technical and organisational measures set out in Annex II ("TOMs"), which are reviewed and updated as our security programme matures.
4. Engage Sub-processors only in accordance with §6.
5. Assist Controller, taking into account the nature of processing, in fulfilling its obligations to respond to data-subject requests (see §7).
6. Assist Controller in ensuring compliance with Articles 32–36 of the GDPR (security, breach notification, DPIA, prior consultation) taking into account the information available to us.
7. At Controller's choice, delete or return Personal Data at the end of the Service, subject to limited residual retention required by law (see §10).
8. Make available all information necessary to demonstrate compliance with Article 28 and allow for and contribute to audits, in line with §8.

6. Sub-processors

Controller authorises us to engage the Sub-processors listed in our public list at Sub-processors. We will:

• Maintain that list current.
• Give Controller at least {{SUB_PROCESSOR_NOTICE_DAYS}} days' notice of any new or replacement Sub-processor.
• Allow Controller to object on reasonable, documented data-protection grounds. If we cannot accommodate the objection, Controller may terminate the affected Services with a pro-rata refund for prepaid unused fees.
• Impose on each Sub-processor data-protection obligations no less protective than this DPA. We remain liable for our Sub-processors' acts and omissions in respect of the Personal Data.

7. Data subject requests

If we receive a request from a data subject directed at Controller's data, we will, without undue delay:

• Inform Controller of the request (and not respond directly unless authorised).
• Assist Controller in responding, including by providing reasonable technical means (export, deletion, correction). Our procedures are in the DSR Runbook.

8. Audits

We will make available to Controller:

• This DPA, the public Security Whitepaper, sub-processor list, and (when produced) external audit reports such as SOC 2 Type II or ISO 27001.
• On reasonable written notice no more than once per twelve months (unless required by a regulator or following a confirmed personal-data breach), a written response to a reasonable security questionnaire.

Where Controller's regulator requires an on-site audit, the parties will agree in good faith on scope, scheduling (at least 30 days' notice), confidentiality, and reimbursement of reasonable costs.

9. Personal data breaches

We will notify Controller without undue delay, and in any case within 72 hours, after becoming aware of a personal-data breach affecting Personal Data. The notification will include, to the extent then known, the information required by GDPR Article 33(3). We will cooperate with Controller and provide reasonable assistance with Controller's regulator and data-subject notifications.

Our internal procedure is governed by the Incident Response Policy.

10. Deletion and return

On termination of the Service, Controller may, within {{NOTICE_PERIOD_DAYS}} days, export Personal Data via the Service's existing export features. After that period we will delete Personal Data from production systems within 30 days. Residual copies in backups are retained per platform backup retention and overwritten in the ordinary course; while retained they remain protected by this DPA.

11. International transfers

Where Personal Data is transferred from the UK/EEA to a country without an adequacy decision:

• The EU SCCs, Module 2 (controller-to-processor), are incorporated by reference. Annexes I.A, I.B, I.C, II, and III to the SCCs are completed by reference to Annex I and Annex II of this DPA and to the live Sub-processors list.
• For UK transfers, the UK IDTA is incorporated and completed by reference to the same Annexes.
• For Switzerland, the SCCs apply as if "GDPR" included the Swiss FADP and the supervisory authority included the FDPIC.

12. Liability

The liability provisions of the Agreement apply to this DPA. Nothing in the Agreement or this DPA excludes either party's liability where exclusion is prohibited by data-protection law.

13. Order of precedence

If there is a conflict, the order is: (1) SCCs/UK IDTA; (2) this DPA; (3) the Agreement.

14. Term

This DPA is effective from the {{EFFECTIVE_DATE}} or, if later, from the date Controller accepts the Agreement, and continues for the term of the Agreement plus any retention period.

Annex I — Description of processing

(See §2 above.)

Competent supervisory authority (SCCs Annex I.C): {{SUPERVISORY_AUTHORITY}}.

Annex II — Technical and organisational measures

These TOMs supplement and are summarised in the Security Whitepaper, which is the authoritative description and is reviewed on at least a quarterly cadence.

Annex III — Sub-processors

The current list, including the entity name, processing activities, and processing locations, is published at Sub-processors and forms part of this DPA. We will keep it current and notify Controller per §6.

⚖️ LEGAL REVIEW REQUIRED.

Acceptable Use Policy

This Acceptable Use Policy ("AUP") governs all use of the Revsnap service. It is incorporated into the Terms of Service. Capitalised terms have the meanings given there.

1. You must not

• Use the Service to violate any applicable law or third-party right.
• Submit data you do not have a lawful basis to process, including special-category personal data unless explicitly agreed in writing.
• Attempt to access another customer's data, accounts, or systems.
• Probe, scan, or test the vulnerability of the Service except via the coordinated disclosure process.
• Bypass or interfere with security or access controls, rate limits, audit logs, or anti-abuse mechanisms.
• Use the Service to send unsolicited or unlawful communications, malware, or harmful content.
• Use the Service to facilitate denial-of-service attacks or to launch attacks against any party, including against your own Salesforce orgs at a volume their service tier does not allow.
• Reverse engineer, decompile, or attempt to derive the source code of the Service, except where permitted by law.
• Resell, sublicense, or provide the Service to third parties except as expressly permitted.
• Submit content that is unlawful, defamatory, obscene, infringing, or harmful.

2. Rate limits and fair use

The Service enforces rate limits to protect itself and other customers. You will not work around them. If your legitimate use exceeds defaults, contact {{SUPPORT_EMAIL}}.

3. Salesforce credentials

You will:

• Only connect Salesforce orgs you are authorised to connect.
• Only authorise the scopes you actually need.
• Revoke the connection promptly when no longer needed.

4. Security and reporting

• Treat your account credentials and API keys as sensitive.
• Rotate API keys on suspected compromise.
• Report security issues to {{SECURITY_EMAIL}} per the coordinated disclosure policy.

5. Beta and preview features

Beta features may be unstable, change without notice, or be withdrawn. Do not use them for production data without an understanding of these limitations.

6. Enforcement

We may investigate suspected violations. We may suspend or terminate access in accordance with §11 of the Terms. For material or repeated violations we may terminate immediately.

If suspension is in your interest (e.g., apparent account takeover), we will act with reasonable speed and restore once the cause is resolved.

7. Cooperation with law enforcement

We respond to validly issued legal process. Where lawfully permitted, we notify the customer of any compelled disclosure of their data so they may seek a protective order.