Data Processing Addendum

Roles

You are the controller. We are the processor. Our providers, listed on the subprocessors page, are sub-processors.

You confirm that you have a lawful basis to collect the comments you bring into Replim, that you have complied with the terms of each platform you connect, and that you have given the notices the law requires to the people who wrote them.

What is processed

• Subject matter: providing the Replim comment inbox.
• Duration: for as long as your account is open, plus up to 30 days after closure.
• Categories of data subject: people who commented on your posts, and the members of your workspace.
• Categories of personal data: display name, handle, profile URL, comment text, and the timestamps attached to them.
• Special category data: none is requested. Comment text is free text written by strangers and may incidentally contain anything, which is a reason to keep retention short.

Our obligations

• We process personal data only on your documented instructions, which include your use of the product, unless the law requires otherwise.
• Everyone with access is bound by confidentiality.
• We keep appropriate technical and organisational measures, described in the security section of the Privacy Policy.
• We assist you, so far as is reasonable, with data subject requests, impact assessments and consultations with regulators.
• We notify you without undue delay after becoming aware of a personal data breach affecting your data.
• On termination we delete or return the data within 30 days, except where the law requires us to keep it.

Sub-processors

You give general authorisation for us to use the sub-processors listed on the subprocessors page. We will give notice before adding a new one, and you may object on reasonable data protection grounds; if we cannot resolve the objection you may terminate the affected part of the service and receive a pro-rata refund.

We remain liable for our sub-processors' performance of these obligations.

AI processing

Comment text is sent to our AI provider for classification and for drafting suggested replies. That provider acts as a sub-processor. This is the single most significant flow of your data to a third party in this product, which is why it is stated here rather than left implicit.

International transfers

Where personal data is transferred outside the UK or EEA, we rely on Standard Contractual Clauses or another approved safeguard in our agreement with the receiving provider.

Audit

We will make available the information reasonably necessary to demonstrate compliance with this addendum, and will contribute to audits, on reasonable notice, no more than once a year unless a regulator requires otherwise.

Contact

Questions about this document go to [email protected]. Anything about personal data goes to [email protected].