Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Terms of Use between OnClick Solutions LLC, a California limited liability company, 1055 Regency Knoll Drive, San Jose, CA 95129, US (“Repuso”, “we”, “us”) and the customer using the Repuso service (“Customer”, “you”). It applies whenever Repuso processes Customer Personal Data on your behalf. You accept it by using the service; no signature is needed and it is not negotiated individually.

Last updated: 2026-11-03

1. Definitions

1. “Data Protection Laws” means all laws on the processing of personal data that apply to a party in connection with the service, including the EU General Data Protection Regulation 2016/679 (“GDPR”), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and US state privacy laws such as the California Consumer Privacy Act as amended (“CCPA”).
2. “Customer Personal Data” means personal data that Repuso processes on your behalf through the service, as described in Annex 1.
3. “Sub-processor” means a third party that Repuso engages to process Customer Personal Data.
4. “Security Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
5. “Controller”, “processor”, “data subject”, “personal data” and “processing” have the meaning given in the GDPR. Under the CCPA, you are the “business” and Repuso is your “service provider”.

2. Roles and instructions

1. You are the controller (or, where you act for your own clients, a processor) of Customer Personal Data. Repuso is your processor (or sub-processor).
2. Repuso processes Customer Personal Data only on your documented instructions. These Terms, this DPA, your settings in the service and your use of the API are your complete instructions. We will tell you if we believe an instruction infringes Data Protection Laws.
3. You are responsible for the lawfulness of the data you give us and of your instructions, including having a lawful basis and any consent needed to send review requests to your customers.

3. Repuso’s obligations

1. Confidentiality. Everyone at Repuso with access to Customer Personal Data is bound by confidentiality.
2. Security. We apply the technical and organisational measures in Annex 2 and may update them, as long as the overall level of protection is not reduced.
3. Data subject requests. If a data subject contacts us directly, we pass the request to you and do not answer it ourselves unless you ask us to. We help you answer requests through the service (you can view, edit and delete data in the dashboard and through the API) and, where that is not enough, on request to hello@repuso.com.
4. Assistance. Taking into account the nature of the processing, we give reasonable help with your data protection impact assessments and consultations with supervisory authorities.
5. No sale. We do not sell or share Customer Personal Data (as those terms are used in the CCPA), and we do not retain, use or disclose it for any purpose other than providing the service, or outside our direct business relationship with you, or combine it with other personal data except as the CCPA permits for service providers.

4. Sub-processors

1. You give general authorisation for Repuso to engage Sub-processors. The current list is in Annex 3.
2. We impose data protection terms on each Sub-processor that are no less protective than this DPA, and we remain responsible for their performance.
3. We announce a new Sub-processor by updating Annex 3 at least 30 days before it starts processing Customer Personal Data. You can subscribe to these updates by writing to hello@repuso.com. If you object on reasonable data protection grounds within those 30 days and we cannot resolve the objection, you may terminate the affected part of the service, and we refund any prepaid fees for the period after termination.

5. Security Incidents

1. We notify you without undue delay after becoming aware of a Security Incident affecting your Customer Personal Data.
2. The notice describes, as far as known, the nature of the incident, the data and data subjects concerned, the likely consequences, and the measures taken or proposed. We take reasonable steps to contain and remedy it.
3. Notifying you is not an admission of fault or liability.

6. International transfers

1. Customer Personal Data is hosted in the United States (Annex 3). Parts of our team access it from Israel, which the European Commission recognises as providing adequate protection.
2. For transfers of personal data from the European Economic Area to Repuso, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 apply and are incorporated by reference: Module 2 (controller to processor) where you are a controller, and Module 3 (processor to processor) where you are a processor. Clause 7 (docking clause) applies; in Clause 9, option 2 (general authorisation, with the notice period in section 4.3) applies; the option in Clause 11 does not apply; for Clauses 17 and 18, the law and courts of Ireland apply. Annexes 1 to 3 of this DPA complete the annexes of the Clauses.
3. For transfers from the United Kingdom, the International Data Transfer Addendum issued by the UK Information Commissioner (version B1.0) applies with the Clauses above. For transfers from Switzerland, the Clauses apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner as the competent authority.
4. Where a Sub-processor is certified under the EU-US Data Privacy Framework (or its UK and Swiss extensions), we may rely on that certification for onward transfers.

7. Deletion and return

1. You can export and delete Customer Personal Data in the service at any time.
2. Closing or cancelling your account does not delete its data, so you can return to it. To have your account and its Customer Personal Data deleted, write to hello@repuso.com from the account owner’s email; we delete it within 30 days of the request, unless the law requires us to keep it. Data in our backups is overwritten as the backups rotate, within 21 days.
3. Review-request recipient details (name, email address or phone number, message details) are anonymized 24 months after the request, and 30 days after the account or sub-account that sent it is deleted. Deleting a recipient in the dashboard anonymizes all of that recipient’s review requests at once.

8. Audits

1. On request, once a year, we answer a reasonable written security questionnaire and provide the information needed to show compliance with this DPA.
2. Where a supervisory authority requires it, or after a Security Incident affecting you, we allow an audit by you or an independent auditor bound by confidentiality, on 30 days’ notice, during business hours, at your cost, and in a way that does not expose other customers’ data.

9. General

1. Liability under this DPA is subject to the limitations in the Terms of Use, except where Data Protection Laws do not allow it.
2. If this DPA conflicts with the Terms of Use, this DPA prevails for the processing of Customer Personal Data. If it conflicts with the Standard Contractual Clauses, the Clauses prevail.
3. We may update this DPA to reflect changes in law or in the service. We do not reduce the protection it gives you without notice, and the current version is always on this page.

Annex 1: Details of processing

• Subject matter and duration: providing the Repuso service for as long as your account exists, until you ask us to delete it (section 7).
• Nature and purpose: collecting, storing and displaying reviews; sending review requests and reminders by email, SMS and WhatsApp; collecting feedback through forms; drafting replies and summaries with AI; checking how AI assistants describe your business (AI Visibility); reports and notifications.
• Data subjects: your customers and contacts you send review requests to; people who write reviews about you or submit your forms; your users of the service.
• Categories of data: names, email addresses, phone numbers and other fields you upload for review requests; review content, reviewer names and profile photos; form submissions; delivery and engagement data for review requests (sent, delivered, opened, clicked, unsubscribed); your users’ names and email addresses.
• Special categories: none intended. Do not upload special category data; reviews written by third parties may occasionally contain it.
• Frequency: continuous.

Annex 2: Technical and organisational measures

• Hosting: dedicated servers in a US data centre (Linode, Chicago) with encrypted disks.
• Network: the database is reachable only on a private network and behind a firewall; Cloudflare provides DNS and network protection for our domains.
• Encryption in transit: TLS for the website, dashboard, API and widgets.
• Access control: production access limited to a small number of authorised staff; per-user accounts with roles (admin, editor, user) and per-sub-account permissions in the service; API keys per account.
• Backups: automatic daily and weekly backups, kept for up to 21 days.
• Opt-outs: every review-request email carries a one-click unsubscribe (List-Unsubscribe); unsubscribes and spam complaints block further review requests from that sub-account, and are kept only as a one-way hash of the address.
• Monitoring: application error monitoring and logging.
• Payments: card data is handled by Stripe and never stored on our servers.
• Review requests: recipients can opt out, and opted-out recipients are not contacted again by the same business.
• Staff: confidentiality obligations; access removed when no longer needed.

Annex 3: Sub-processors

Review platforms you connect (such as Google or Facebook) are sources of data you choose, not Sub-processors.