GDPR & CCPA compliant template ยท Last updated: September 2026
Legal Notice: This DPA template is provided for enterprise clients who require a signed data processing agreement. Have your legal counsel review and customize it before signing. Replace all bracketed placeholders with actual values.
This Data Processing Agreement ("DPA") governs the processing of personal data by Pera Reply, Inc. ("Processor") on behalf of [Client Name] ("Controller") in connection with the Pera Reply subscription services. This DPA supplements the Terms of Service and any Master Services Agreement between the Parties. Terms are defined per GDPR (EU 2016/679) and CCPA (California Consumer Privacy Act).
Processor shall process personal data only on documented instructions from Controller, including with regard to transfers of personal data to a third country. The processing includes: collecting customer reviews from public sources, generating AI-drafted responses, storing review data and brand voice configurations, and sending notifications. The duration of processing is the term of the Controller's subscription, plus 90 days for data retention before deletion.
Processor maintains appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including: (a) encryption of data in transit (TLS 1.2+) and at rest (AES-256); (b) access controls with role-based permissions and audit logging; (c) regular security assessments and vulnerability scanning; (d) staff training on data protection; (e) incident response procedures; (f) backup and disaster recovery with daily backups and 99.9% uptime target; (g) network security with firewalls and intrusion detection.
Processor may engage sub-processors to process personal data. Current sub-processors include: cloud infrastructure providers (for hosting), AI model providers (for response generation), and email delivery services (for notifications). Processor maintains a list of sub-processors and notifies Controller of any additions, giving Controller the right to object. Processor remains liable for sub-processor performance and ensures sub-processors are bound by data protection obligations at least as protective as this DPA.
Processor shall assist Controller in responding to data subject requests (access, rectification, erasure, restriction, portability, objection) by: (a) providing tools for data export and deletion within the platform; (b) notifying Controller of any data subject request received directly, without responding unless authorized; (c) taking reasonable steps to assist with data subject requests within 30 days. Controller is responsible for verifying data subject identity and responding to requests.
In the event of a personal data breach, Processor shall: (a) notify Controller without undue delay, and in any case within 72 hours of becoming aware of the breach; (b) provide a description of the breach, the likely consequences, and the measures taken or proposed; (c) take reasonable steps to mitigate the breach and prevent recurrence; (d) maintain documentation of all breaches. Controller is responsible for notifying the supervisory authority and data subjects as required by law.
Upon termination of services, Processor shall, at Controller's choice, return or delete all personal data, and delete existing copies, within 90 days of termination. Processor shall provide written confirmation of deletion upon request. Data retained for legal compliance or backup recovery purposes shall be held securely and deleted once the legal basis expires.
Controller may audit Processor's compliance with this DPA once per calendar year, upon 30 days' written notice. Audits shall be conducted during business hours, with minimal disruption to Processor's operations. In lieu of an on-site audit, Processor may provide independent third-party audit reports (e.g., SOC 2 Type II) upon request.
If personal data is transferred outside the EU/EEA or UK, Processor shall ensure such transfers are made pursuant to appropriate safeguards, including Standard Contractual Clauses (SCCs) as approved by the European Commission, or other valid transfer mechanisms. Processor shall notify Controller if a transfer mechanism is invalidated and provide alternative safeguards.
Each Party's liability under this DPA shall be subject to the limitations of liability in the Terms of Service or Master Services Agreement. Processor shall indemnify Controller for claims arising from Processor's breach of its data protection obligations under this DPA, to the extent permitted by the underlying agreement.
This DPA is effective as of the start date of the Controller's subscription and continues for the duration of the subscription. Obligations regarding data return/deletion, breach notification, and confidentiality survive termination.
This DPA is governed by the laws of the State of Ohio for U.S. clients, and by the laws of Ireland for EU/EEA clients, without regard to conflict of law principles.
Pera Reply, Inc. (Processor)
[Client Name] (Controller)
We use cookies to enhance your experience, analyze site traffic, and serve relevant content. By clicking 'Accept', you consent to our use of cookies. Learn more