Data Processing Agreement

1. Parties and roles

This DPA supplements the Terms of Service between the professional customer, as controller, and Giuseppe Cerutti, trading as Repliku, VAT no. IT03365870835, as processor under Article 28 GDPR for personal data processed on behalf of the customer.

2. Subject matter, duration and purpose

Repliku processes data solely to connect authorised locations, import and manage reviews, generate and publish replies under customer instructions, produce reports and insights, provide support, and maintain service security and continuity. Processing continues for the period of service use and the technical time needed for return or deletion.

3. Data and data subjects

• Data subjects: review authors, customer contacts and staff, authorised users and people mentioned in submitted content.
• Data: public author identifiers, review text and ratings, replies, location data, provider metadata, support communications and technical data needed for the service.
• Special categories: these are not required. The customer must avoid submitting unnecessary sensitive data and inform Repliku where a specific activity requires it.

4. Customer instructions

Product settings, provider authorisations and documented customer requests constitute instructions. Repliku will inform the customer if it believes an instruction breaches applicable law, unless prohibited by law, and may suspend execution pending clarification.

5. Repliku obligations

• process data only on documented instructions and for agreed purposes;
• bind authorised personnel to confidentiality;
• apply technical and organisational measures appropriate to the risk;
• reasonably assist the customer with data-subject rights, impact assessments and authority requests;
• make information available to demonstrate compliance with this DPA.

6. Security measures

Measures include, as appropriate:

• access controls, role separation and authentication managed by Supabase;
• encryption in transit, server-side secret management and integration-token encryption;
• RLS and application controls to separate customer data;
• audit logs, rate limits, operational monitoring, tracked retries and recovery procedures;
• data minimisation for AI providers and controls on generated content.

7. Sub-processors

The customer authorises sub-processors required for the service, including Supabase, Vercel, Google, LLM providers configured through OpenRouter or direct integration, Resend and Stripe. Repliku imposes protection obligations consistent with this DPA and remains responsible for selecting and managing sub-processors to the extent required by law.

Material changes to the sub-processor chain will be communicated through the service or by email. The customer may raise a reasoned data-protection objection; the parties will seek a reasonable solution.

8. International transfers

Where processing involves transfers outside the European Economic Area, Repliku uses a valid GDPR transfer mechanism, including adequacy decisions, the Data Privacy Framework where applicable, or Standard Contractual Clauses with supplementary measures where needed.

9. Personal data breaches

Repliku will notify the customer without undue delay after confirming a breach involving data processed on the customer s behalf and will provide reasonably available information needed for obligations under Articles 33 and 34 GDPR.

10. Return and deletion

On termination and at the customer s request, Repliku will delete or return personal data processed on the customer s behalf, except for legal retention obligations and temporary technical copies subject to deletion cycles and restricted access.

11. Audits

Repliku provides reasonable documentation on security and processing. Additional audits must be agreed in advance, limited to once per year unless there is an incident or authority request, conducted without compromising the security or confidentiality of other customers, and paid for by the customer where they create exceptional costs.

12. Priority and contact

For data-protection matters, this DPA prevails over the Terms. Privacy contact: privacy@repliku.io.