DATA PROCESSING AGREEMENT (“DPA”)
This DPA is entered into on [Insert Date]
BETWEEN:
- FullHelp Ltd (SARL), operating under the trade name GetReviews Agency, having its registered office at 20 Geo Milev St, 1st floor, Sofia 1111, Bulgaria, registered in the Commercial Register (EIK) under number 203001586, holding license No. 86 / 26.08.2014, represented by its Manager, Mr. Krasimir IVANOV (hereinafter referred to as “GetReviews Agency“);
AND:
- [Insert Full Name of Client / Company], having its registered office at [Insert Client Address] (hereinafter referred to as the “Customer“).
The above entities are collectively referred to as the “Parties.”
1. SUBJECT MATTER AND SCOPE
This DPA is annexed to the Terms of Service (the “Agreement“) between the Parties. It defines the rules for the protection, confidentiality, and security of Personal Data processed by GetReviews Agency on behalf of the Customer in the context of using the reputation management software.
2. DEFINITIONS
- “Customer Data”: Any personal data (names, emails, reviews, IP addresses) processed via the GetReviews Agency platform.
- “Applicable Laws”: Refers to the GDPR (EU 2016/679) as well as Bulgarian and European laws relating to data protection.
- “Processor”: GetReviews Agency acts as a processor on behalf of the Customer, who remains the Data Controller.
3. INSTRUCTIONS AND LIMITATIONS
GetReviews Agency undertakes to:
- Process data only based on written instructions from the Customer and for the purposes set forth in the Agreement.
- Not sell, rent, or share Customer data for third-party advertising purposes.
- Guarantee the confidentiality of persons authorized to process the data (employees and agents).
4. SUB-PROCESSING
The Customer authorizes GetReviews Agency to engage sub-processors to ensure the technical functioning of the service. The current list includes:
- Hetzner Online GmbH (Hosting – Germany)
- SendGrid / Twilio (Email/SMS delivery – USA)
- Stripe (Payment management – EU/UK)
- Microsoft Clarity / Umami (Technical analytics)
GetReviews Agency will inform the Customer of any change in sub-processors via email with 10 days’ prior notice.
5. SECURITY AND BREACH NOTIFICATION
GetReviews Agency implements rigorous technical measures to protect data against unauthorized access. In the event of a confirmed data breach, GetReviews Agency will notify the Customer within a maximum of 72 hours after becoming aware of it.
6. INTERNATIONAL TRANSFERS
For any data transfer outside the European Economic Area (EEA), the Parties undertake to comply with the European Commission’s Standard Contractual Clauses (SCCs) to ensure an equivalent level of protection.
7. DATA SUBJECT RIGHTS
GetReviews Agency will assist the Customer, as far as possible, in responding to requests to exercise rights (access, rectification, erasure) submitted by end users.
8. DATA RETENTION AND DISPOSAL
Upon termination of the Agreement, GetReviews Agency will delete or anonymize Customer Data, unless prohibited by Applicable Law (notably for tax or security reasons).
SCHEDULE 1: DETAILS OF PROCESSING
- Nature of Processing: Collection, storage, and analysis of customer reviews for online reputation management.
- Categories of Data Subjects: Customer’s clients, platform users, business managers.
- Types of Data: First name, last name, email address, phone number (for SMS solicitation), review text, star rating, IP address, browser metadata.
- Duration: Duration of the subscription to GetReviews Agency services.
SIGNATURES
For GetReviews Agency:
Name: Mr. Krasimir IVANOV
Title: Manager
Date: ____________________
For the Customer:
Name: ____________________
Title: ____________________
Date: ____________________
