Data Protection · Processing Agreement (DPA)

1. Purpose, contractual binding and identity

This DPA governs the processing of personal data carried out on behalf of the client (controller) to provide the service: import and management of reviews, assisted generation of responses, pattern analysis, preparation of recommendations and reports, and delivery through the configured channels.

Contractual binding

When RepuOrbit processes personal data on behalf of the client, this DPA (version 1.0), based on Article 28 of the GDPR, forms an integral part of the contractual conditions applicable to the service and of the Terms and Conditions, and binds the parties from acceptance of those conditions.

Identity of the processor

RepuOrbit is a product by IATASKIA S.L., tax ID (NIF) B05703038 (Spain), which acts as data processor when it processes personal data on behalf of the client.

Nature

Operations of collection, storage, consultation, analysis, AI-assisted generation, communication to the configured channels and deletion, by automated means.

2. Duration

The processing is maintained while the service relationship is in force. Upon its termination, the provisions of the return or deletion clause will apply.

3. Categories of data subjects and types of data

Categories of data subjects

• End customers and review authors of the business.
• Staff and authorised users of the client business.

Types of data

• Identifying and contact data contained in reviews and responses.
• Content of the opinions and of the associated communications.
• Configuration data and technical metadata necessary for the service.

Special categories of data

RepuOrbit does not request special categories of personal data for the ordinary provision of the service. However, the content of the reviews or communications processed may incidentally include information of this nature entered by their own authors. The client, in its capacity as data controller, must ensure the existence of an appropriate legal basis where applicable and configure and use the service in accordance with data protection regulations.

4. Documented instructions and confidentiality

RepuOrbit will process the data only following the client’s documented instructions, including those of this DPA and those arising from the use of the platform, except where legally required. If an instruction infringes the regulations, RepuOrbit will inform the client.

The persons authorised to process the data undertake to respect confidentiality or are subject to a duty of confidentiality of an equivalent nature.

5. Technical and organisational measures

RepuOrbit applies technical and organisational measures appropriate to the risk. The measures actually implemented are described in Annex I of this DPA.

6. Assistance to the controller and exercise of rights

RepuOrbit will reasonably assist the client to: address requests to exercise data subjects’ rights; comply with security obligations, breach notification and, where appropriate, impact assessments and prior consultations.

7. Incidents and security breaches

RepuOrbit will notify the client without undue delay when it becomes aware of a security breach affecting data processed on behalf of the client.

To the extent available, it will provide:

• the nature of the incident;
• the categories of data and of data subjects affected;
• the likely consequences;
• the measures adopted or proposed;
• the information necessary for the controller to comply with its notification obligations.

8. Sub-processors

• The client grants a general authorisation for the use of sub-processors in the provision of the service.
• RepuOrbit will inform of the additions or replacements of sub-processors that affect the processing of data.
• The client may raise justified objections in accordance with this DPA.
• Sub-processors will be subject to data protection obligations equivalent to those applicable to RepuOrbit.

9. Sub-processors and processing providers

Depending on the features used, the service may rely on the following types of providers. The list is prepared to be updated with the actual providers; no provider that is not yet contracted is presented as such:

• Google Business Profile / Google — reviews and publishing.
• Meta / WhatsApp Business Platform and Telegram — delivery and approval of responses.
• AI providers configured by the client — OpenAI, Anthropic, Google Gemini.
• Payment provider — when the charging system is implemented.
• Hosting / database provider — service infrastructure.
• Email provider — service communications.
• Technical services necessary to operate the platform.

AI providers and credentials (API Key)

• The client can configure its own AI provider and use its own credentials/API Key.
• This does not mean that the data never passes through RepuOrbit’s infrastructure.
• RepuOrbit may need to receive, process and transmit certain data to execute the requested feature.
• The necessary data may be sent to the AI provider selected or configured by the client.
• Credentials are handled securely in accordance with the measures actually implemented (see Annex I): they are stored encrypted and redacted in logs.

10. International transfers

Where a provider or sub-processor involves an international transfer of data, the appropriate legal mechanism under Chapter V of the GDPR will be used, for example: an adequacy decision, standard contractual clauses or other legally valid safeguards.

It is not claimed that all data always remains in Spain or in the EEA.

Once confirmed, the information will be detailed by actual provider, with the following structure:

• provider;
• country or region of processing;
• service provided;
• applicable transfer mechanism.

11. Audit and compliance information

Without prejudice to the client’s right to audit in accordance with Art. 28 GDPR, that right will be exercised on reasonable terms:

• RepuOrbit will make available to the client the information reasonably necessary to demonstrate compliance with its obligations.
• Audits will be carried out with reasonable prior notice.
• The confidentiality and security of its own information and that of third parties will be respected.
• Disproportionate interference with the continuity of the service will be avoided.
• The right may be satisfied by means of documentation, evidence or third-party audits where these are sufficient.

12. Return or deletion of data

Once the provision has ended, and at the controller’s choice, RepuOrbit will return or delete the personal data processed on behalf of the client. For these purposes, a distinction is made:

• Active data: returned or deleted after the end of the service, according to the controller’s choice.
• Data kept by legal obligation: kept blocked for the legally required periods and deleted upon their expiry.
• Backups: the data contained in backups is deleted in accordance with the technically established retention cycle and remains blocked and not accessible for ordinary exploitation during that period, where applicable.
• End of service: once the previous steps are completed, the information is deleted except for that which must be legally kept.

Annex I — Technical and organisational measures

Measures actually implemented in the service as of the date of this version of the DPA:

• Encryption of secrets at rest: sensitive credentials and integrations (AI provider API Keys and Google, WhatsApp and Telegram access tokens) are stored encrypted using AES-256-GCM.
• Password protection: user passwords are stored hashed using bcrypt; never in plain text.
• Authentication: access via signed tokens (JWT) verified on each request.
• Role-based access control: permissions by role within each organisation and separation of the platform administration role.
• Logical multi-tenant isolation: data is segmented by organisation and business; access is resolved according to the user’s membership.
• Input validation and sanitisation: requests are validated against strict schemas before being processed.
• Audit logs: relevant events (for example, authentication and credential changes) are recorded for traceability.
• HTTP security headers and restricted CORS: security headers and a controlled CORS policy are applied.
• Rate limiting: the frequency of requests is limited, with stricter limits on authentication, to mitigate abuse and brute-force attacks.
• Secure secrets management: sensitive configuration is validated and loaded from the environment (not embedded in the code) and sensitive data is redacted in logs.
• Encrypted communications: communications with external services are carried out over HTTPS/TLS; the application is prepared to operate behind a proxy that manages TLS termination.
• Constant-time verification: the checking of certain sensitive tokens uses constant-time comparisons.
• Deletion mechanisms: it is possible to revoke and delete stored credentials and integrations, as well as delete businesses and their associated data. Data minimisation: the data necessary to provide the requested feature is processed.