The full DPA is available on request from legal@reppx.ai. This page is a summary of key clauses.
Roles
The customer is the Data Controller. reppX is the Data Processor.
Subject-matter and duration
Processing is limited to what's needed to deliver the Service, for the duration of the customer's subscription plus 30 days for deletion.
Sub-processors
Current sub-processors are listed on our Privacy Policy. We provide 30 days' advance notice of new sub-processors and allow the customer to object.
Security measures
Detailed on our Security page.
Data subject rights
reppX will assist the customer in responding to data subject requests within 10 business days.
Breach notification
reppX will notify the customer within 72 hours of becoming aware of any personal data breach.
Return / deletion
On termination, reppX will delete or return all customer data within 30 days, subject to legal retention requirements.