Data Processing Agreement

This Data Processing Agreement ("DPA") is between Uprate Technologies Private Limited ("RateUp") and the customer that has agreed to the RateUp Terms of Service ("Customer"). It applies automatically, without a signature, whenever RateUp processes personal data in Customer Data on Customer's behalf. Terms not defined here have the meaning given in the Terms.

If you need a countersigned copy for your records, email [email protected].

For personal data in Customer Data, Customer is the controller and RateUp is the processor. For account, billing and website data about Customer and its Users, RateUp is an independent controller under its Privacy Policy.

• Subject matter and purpose: providing the Service: messaging, inbox, automations, campaigns, surveys, loyalty, shop, pipelines and related features.
• Duration: the term of the Terms, plus the deletion period in section 9.
• Data subjects: Customer's End Customers, leads, loyalty members, survey respondents and buyers, and Customer's Users.
• Personal data: names, phone numbers, email addresses, Instagram and Facebook IDs, message content and media, survey answers, loyalty and referral activity, orders and delivery addresses, and other data Customer chooses to add.
• Special categories: none are required. Customer must not send them unless the law allows it.

• Process personal data only on Customer's documented instructions. The Terms, Customer's settings and its use of the Service count as those instructions. RateUp will tell Customer if it believes an instruction breaks the law.
• Make sure everyone authorised to process the data is bound by confidentiality.
• Apply the security measures in section 10.
• Help Customer, taking into account the nature of the processing, to respond to data subject requests, carry out data protection impact assessments and consult regulators.
• Not sell Customer Data, or use it for RateUp's own marketing or to train models offered to other customers.

Customer authorises RateUp to use the subprocessors listed on our Subprocessors page. RateUp binds each one to data protection terms at least as protective as this DPA and remains responsible for them. RateUp will update that page at least 30 days before adding a subprocessor. If Customer objects on reasonable data protection grounds within that time and we cannot resolve the objection, Customer may terminate the affected Service and receive a pro-rated refund of prepaid fees for it.

Meta (for WhatsApp, Instagram and Messenger), and any other Third-Party Platform Customer connects, process data under Customer's own agreement with them. They are not RateUp's subprocessors. RateUp exchanges data with them on Customer's instruction.

RateUp's main databases are in the European Union, and file storage and email delivery are in India. Where personal data is transferred out of the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, the parties agree to the European Commission's Standard Contractual Clauses (Module 2 or Module 3, as applicable) and the UK Addendum. These are incorporated by reference, with the governing law and courts named in the Terms where the Clauses allow it.

RateUp will notify Customer without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer Data. The notice will include what RateUp knows of the breach, the likely impact and the steps taken. RateUp will add more information as it becomes available.

Customer can export Customer Data during the term and for 30 days after it ends. RateUp then deletes Customer Data within 90 days, except where the law requires it to be kept. Backups are overwritten on their normal cycle and are protected until then.

Technical

• TLS encryption for data in transit.
• Encryption at rest for file storage, and where our hosting provider offers it for databases.
• Separation of each customer's data by organisation in the application.
• Regular backups, error monitoring and logging.

Organisational

• Role-based permissions in the product, so Customer controls what each User can see and do.
• Staff access to production data limited to those who need it to run and support the Service.
• Confidentiality obligations for all staff and contractors.

On request, RateUp will provide information reasonably needed to show compliance with this DPA. If that is not enough, Customer may audit RateUp once a year on 30 days' notice, during business hours and at its own cost, subject to confidentiality.

Each party's liability under this DPA is subject to the limits in the Terms. If this DPA conflicts with the Terms on data protection, this DPA wins. If it conflicts with the Standard Contractual Clauses, the Clauses win.