Data Processing Addendum (DPA)

Version 1.0 · Draft basis for engagement, subject to legal review and signature by the parties.

This is a courtesy translation. The binding version of this document is the Hebrew version; if the two diverge, the Hebrew version prevails.

1. Parties and definitions

This agreement is made between RevYou (the "Provider") and the business engaging with it under a service agreement (the "Customer"), and forms part of the service agreement between them.

In this agreement:

• "Personal information" - information as defined in the Israeli Protection of Privacy Law, 5741-1981;
• "The information" - personal information the Provider processes for the Customer within the service;
• "Processing" - any operation on the information, including receipt, storage, display and deletion;
• "Subprocessor" - a third party the Provider engages to process the information.

With respect to the information covered by this agreement, the Customer is the data controller and the Provider holds and processes it on the Customer's behalf, as also set out in the Privacy Policy.

2. Purpose of processing and Customer instructions

The Provider will process the information solely for operating the service for the Customer: receiving private feedback from the Customer's customers, displaying it to the Customer in the management interface, producing reports and usage data, and operating and securing the system.

Where the feature is enabled for the Customer, processing also includes analysing the content of feedback, classifying it and producing insights and suggested actions by automated systems, including artificial intelligence systems, and transcribing recordings that the Customer's customers chose to make. The outputs of that analysis are shown to the Customer as suggestions only.

The Provider will follow reasonable, documented instructions of the Customer regarding the information, unless such an instruction conflicts with the law or requires a material change to the service.

The Provider will not use the information for its own purposes beyond what is required to operate the service.

3. Data types and categories of data subjects

The information processed within the service may include:

• the content of private feedback sent to the business;
• contact details provided voluntarily with the feedback, such as name, phone number and email address;
• usage data of the business pages and the management interface;
• audio and transcripts of reviews the Customer's customers chose to record (the audio is not kept by the Provider after transcription);
• outputs of the automated analysis of feedback, such as summaries, classification and suggested replies.

The data subjects are mainly:

• customers of the business who use the business's page or send feedback;
• team members of the Customer who use the management interface.

4. Confidentiality

The Provider will keep the information confidential and will limit access to it to those who need it to operate the service, after they have undertaken an appropriate duty of confidentiality.

5. Data security

The Provider will take reasonable security measures appropriate to the nature of the information and the service, including traffic encryption, access controls and separation between different customers' data. The measures are detailed on the Security page.

6. Subprocessors

The Customer grants the Provider general authorization to engage subprocessors for operating the service. The current list of subprocessors is set out on the Subprocessors page.

The Provider will update the list when a subprocessor is added or replaced, and will bind every subprocessor to data protection obligations no less protective in substance than those in this agreement.

A subprocessor may be an artificial intelligence provider used for transcription and for processing and analysing text. Such a provider receives only the information needed to run the relevant feature, and its processing is subject to the data processing agreement that applies to it.

7. Security incidents

If the Provider becomes aware of a security incident that affected the information, or of a substantial concern that it did, it will notify the Customer without unreasonable delay and will provide the Customer with reasonable information needed to handle the incident and comply with the Customer's obligations under law.

8. Data subject requests

A data subject may submit a request through the Your Data Request page. If the Provider receives a request concerning information the Customer is responsible for, it will forward the request to the Customer or handle it together with the Customer, and will reasonably assist the Customer in responding to access, correction and deletion requests.

9. Deletion or return at the end of the engagement

At the end of the engagement, and at the Customer's choice, the Provider will delete the information or return a reasonable copy of it to the Customer, within a reasonable period and as detailed in the Privacy Policy.

The Provider may retain information it is required to retain by law, for security purposes, or within backups deleted in the ordinary backup cycles.

10. Data transfers

The main processing of the information takes place in a database in the Frankfurt region in the European Union (EU), as detailed in the Privacy Policy. Subprocessors may process technical information in other countries as well, subject to applicable law.

11. Replacement of the Provider as the processing party

If the service agreement is transferred to another entity in a way that has that entity replace the Provider as the party processing information for the Customer, the transfer will be made only after that entity has assumed in writing all of the obligations applicable to the Provider under this agreement and under law.

The transfer will not change the purposes of processing, the types of information or the Customer's rights without the Customer's separate consent, to the extent such consent is required by law.

The Provider will notify the Customer of a replacement of the processing party in accordance with the timeframes set out in the service agreement.

If the Customer terminates the engagement following the transfer, the Provider and the continuing entity will act to return, delete or continue storing the information in accordance with this agreement and with the law.

12. Term and termination

This agreement applies for as long as the Provider processes information for the Customer, and its provisions concerning confidentiality, deletion and liability will survive its termination to the extent relevant.

13. Liability

Each party is responsible for fulfilling its obligations under this agreement and under law. The limitations of liability set out in the service agreement between the parties apply to this agreement as well, to the extent permitted by law.

14. Governing law and jurisdiction

This agreement is governed exclusively by Israeli law, and exclusive jurisdiction is vested in the competent courts in Israel.

15. Contact

For questions regarding this agreement: info@revyou.site