Data Processing Agreement

1. Parties and roles

The customer is the controller of personal data about its own contacts and customers and of other personal data it submits to Townproof. advixory s.r.o. is the processor that processes that personal data on the customer's documented instructions to provide Townproof. advixory is a separate controller for its own account administration, billing, security, product analytics, public reports and business prospecting, as described in the Privacy Policy; this DPA does not cover that processing. For payment, billing and tax data, our Merchant of Record (Polar) acts as an independent controller, and its own terms and privacy policy apply to that processing. Polar is therefore not a sub-processor under Section 8.

2. Subject-matter, nature, purpose and duration

The subject-matter is the processing needed to provide review-request workflows, contact import and intake, consent records, suppressions, tracked review links, outcome reports, optional AI reply drafts, customer-directed AI visibility checks, auditability and support. The nature and purpose of the processing is to store, organize, import, validate, transmit, generate, log, delete, export and secure personal data so that customers can send lawful review requests, honor opt-outs, answer reviews, measure results, keep audit trails and handle data-subject requests. Processing lasts for the term of the customer's use of Townproof and ends as set out in Section 12.

3. Types of personal data

• Contact email address, normalized email, first name and phone number.
• Review-request metadata, including the request, message, delivery, unsubscribe, suppression and interaction records.
• Compliance metadata, such as the consent-attestation actor, IP address, timestamps and audit events.
• Review text, ratings and any names or details it contains, and generated or edited reply drafts, where the customer uses AI reply drafts.
• Content of replies that recipients send to review-request emails, and tracked-link interaction records, including a daily-rotating visitor fingerprint.
• Business names, locations and people named in customer-directed AI visibility checks, where these identify a person (for example a sole trader).

4. Categories of data subjects

Data subjects are the customer's own contacts, customers or business recipients whose information the customer uploads or manages in Townproof; authors of reviews and staff named in review text the customer submits; people who open the customer's tracked review links; and individuals, such as sole traders, identifiable from business information in the customer's AI visibility checks.

5. Controller obligations and instructions

The customer determines the purposes and legal basis for processing, ensures contact data is accurate and lawfully collected, provides the privacy notices required by Articles 13–14 GDPR (including the source of the data), handles data-subject requests as controller, ensures a valid legal basis for each send (including any consent or soft opt-in required under §116 of Act No. 452/2021 Coll.), and instructs us only to process data in ways permitted by law and this DPA. The customer's use of Townproof, together with its in-product configuration, constitutes its documented instructions.

6. Processor obligations

We will: (a) process personal data only on the controller's documented instructions, including for transfers to a third country, unless required by Union or Member-State law, in which case we will inform the controller before processing unless that law prohibits it; (b) ensure that persons authorized to process the data are bound by confidentiality; (c) take all security measures required by Article 32 GDPR; (d) respect the conditions in Sections 7 and 8 for engaging sub-processors; (e) assist the controller, by appropriate technical and organizational measures, in responding to data-subject requests; (f) assist the controller in ensuring compliance with Articles 32–36 GDPR, including security, breach notification and data-protection impact assessments; (g) at the controller's choice, delete or return personal data after the end of the services and delete existing copies unless storage is required by law; and (h) make available all information necessary to demonstrate compliance and allow for and contribute to audits. We will immediately inform the controller if, in our opinion, an instruction infringes the GDPR or other data-protection law.

7. Security measures

Taking into account the state of the art and the risk, we implement appropriate technical and organizational measures, including: encryption of personal data in transit; access controls and least-privilege access; isolation of each customer's data (multi-tenant separation); pseudonymization and tombstoning of purged identifiers; audit logging; secure backups; and procedures to detect, assess and respond to personal data breaches.

8. Sub-processors

The controller gives general written authorization for us to engage the sub-processors listed below for the stated purposes, except entries marked as independent controllers (Polar), which are not sub-processors. We engage each sub-processor under its terms of service and data processing agreement, which impose data-protection obligations that are, in substance, the same as those in this DPA; the list below marks any sub-processor whose data processing agreement is not yet signed. As Article 28(4) GDPR requires, we remain liable to the controller for each sub-processor's performance of its data-protection obligations. We will give the controller at least 30 days' prior notice of any intended addition or replacement of a sub-processor by email to the account administrator (this page remains the canonical sub-processor list), during which the controller may object on reasonable data-protection grounds; if the parties cannot resolve the objection, the controller may terminate the affected part of the service.

• Postmark (AC PM, LLC) — Doručovanie e-mailov so žiadosťami o recenziu a transakčných e-mailov.
  Lokalita: Spojené štáty americké · Záruka pri prenose: Štandardné zmluvné doložky EÚ; EU–US Data Privacy Framework (rámec ochrany osobných údajov medzi EÚ a USA).
• Polar (Polar Software, Inc.) — samostatný prevádzkovateľ — Merchant of Record pre predplatné, platby, fakturáciu a dane. Polar je predávajúcim a vystupuje ako samostatný prevádzkovateľ vo vzťahu k platobným, fakturačným a daňovým údajom kupujúcich. Pozri zásady ochrany osobných údajov Polar na https://polar.sh/legal/privacy-policy.
  Lokalita: Spojené štáty americké · Záruka pri prenose: Štandardné zmluvné doložky EÚ.
• Neon (Neon, Inc.) — Spravovaný hosting PostgreSQL pre primárnu aplikačnú databázu.
  Lokalita: Európska únia (Frankfurt, Amazon Web Services); materská spoločnosť v USA · Záruka pri prenose: Dáta uložené v EÚ; EU–US Data Privacy Framework a štandardné zmluvné doložky pre prípadný prístup materskej spoločnosti.
• Sentry (Functional Software, Inc.) — Monitorovanie chýb a výkonu, nakonfigurované tak, aby odstraňovalo osobné údaje; prehrávanie relácií je v produkcii vypnuté.
  Lokalita: Európska únia (Frankfurt); materská spoločnosť v Spojených štátoch amerických · Záruka pri prenose: Údaje o udalostiach sú uložené v EÚ; EU–US Data Privacy Framework (rámec ochrany osobných údajov medzi EÚ a USA) a štandardné zmluvné doložky pre prípadný prístup materskej spoločnosti.
• PostHog (PostHog, Inc.) — Produktová analytika. Analytika v prehliadači a maskované, vzorkované prehrávanie relácií bežia iba potom, ako v lište cookies prijmete analytiku. Nezávisle od toho naše servery odosielajú udalosti služby (napríklad registráciu, kontroly AI a platby) spojené s identifikátorom účtu alebo organizácie, na základe našich oprávnených záujmov (Zásady ochrany osobných údajov, oddiel 4); súbory cookie nepotrebujú, ale ak ste prijali analytické súbory cookie, udalosti registrácie obsahujú aj v nich uložené analytické identifikátory prehliadača a kampaňové značky. Záväznou analytickou evidenciou zostáva vlastná databáza Townproof. Prevádzka z prehliadača sa k PostHog dostáva cez našu subdoménu t.townproof.com, ktorú PostHog smeruje cez svojho subspracovateľa Cloudflare.
  Lokalita: Európska únia (Frankfurt, Amazon Web Services); PostHog, Inc. je spoločnosť z USA a jej zamestnanci môžu k údajom pristupovať na diaľku; smerovanie Cloudflare môže využívať lokality mimo EÚ · Záruka pri prenose: Údaje o udalostiach uložené v EÚ. Vzdialený prístup zamestnancov PostHog, Inc. sa opiera o EU–US Data Privacy Framework (rámec ochrany osobných údajov medzi EÚ a USA), podľa ktorého je PostHog, Inc. podľa vlastného vyhlásenia certifikovaná. Zmluva o spracúvaní osobných údajov od PostHog zatiaľ nie je podpísaná. IP adresy klientov sa neukladajú.
• Google (Google Ireland Limited) — Vyhľadávania cez Google Maps a Places pre údaje firemného profilu, informácie o konkurentoch a audite; Gemini API (platená úroveň) na kontroly viditeľnosti v AI, ktoré dostáva názvy firiem, lokality a vyhľadávacie otázky, nie údaje kontaktov. Na platenej úrovni Google nepoužíva dopyty ani odpovede na zlepšovanie svojich produktov.
  Lokalita: Európska zmluvná entita (Google Cloud EMEA Limited pre Gemini API); spracúvanie môže prebiehať celosvetovo · Záruka pri prenose: EU–US Data Privacy Framework (rámec ochrany osobných údajov medzi EÚ a USA); štandardné zmluvné doložky EÚ.
• Cloudflare (Cloudflare, Inc.) — Autoritatívny DNS pre domény Townproof a objektové úložisko R2 pre vytvorené reporty viditeľnosti v AI (mazanie po 365 dňoch).
  Lokalita: Spoločnosť z USA; globálna sieť. Bucket R2 je nastavený tak, aby uprednostňoval východnú Európu, čo Cloudflare plní podľa možností, bez záruky ukladania alebo spracúvania iba v EÚ · Záruka pri prenose: EU–US Data Privacy Framework (rámec ochrany osobných údajov medzi EÚ a USA); štandardné zmluvné doložky EÚ.
• OpenRouter (OpenRouter, Inc.) a vybraní poskytovatelia hostovaných modelov — Voliteľné smerovanie požiadaviek na AI návrhy odpovedí cez OpenRouter k vybraným poskytovateľom hostovaných modelov, keď je funkcia AI zapnutá. OpenRouter a vybraný poskytovateľ inferencie dostanú iba text recenzie a kontext promptu potrebný na vytvorenie návrhu; produkčné smerovanie je obmedzené na schválených poskytovateľov a nastavené tak, aby odmietalo zber údajov poskytovateľom alebo vyžadovalo nulovú retenciu údajov, ak je podporovaná.
  Lokalita: Spojené štáty americké (OpenRouter; inferencia teraz obmedzená na DeepInfra, Inc. a Fireworks AI, Inc., obe v USA) · Záruka pri prenose: Zmluva o spracúvaní údajov OpenRouter a štandardné zmluvné doložky EÚ; zber údajov poskytovateľmi je v smerovaní zakázaný. Túto položku aktualizujeme skôr, ako začneme smerovať k iným poskytovateľom.
• Railway (Railway Corporation) — Hosting API a procesov na pozadí (odosielanie žiadostí o recenzie, načítavanie recenzií, kontroly viditeľnosti v AI). Spracúva v pamäti údaje o účtoch, kontaktoch a správach; databáza zostáva u Neon v EÚ.
  Lokalita: Spojené štáty americké (Virgínia) · Záruka pri prenose: Obchodné podmienky Railway. Zmluva o spracúvaní osobných údajov od Railway, ktorá obsahuje štandardné zmluvné doložky EÚ, zatiaľ nie je podpísaná. Naša databáza zostáva v EÚ.
• Vercel (Vercel, Inc.) — Hosting webu a webovej aplikácie a doručovanie obsahu.
  Lokalita: Serverové funkcie v Európskej únii (Frankfurt); globálna okrajová sieť na doručovanie obsahu; spoločnosť z USA · Záruka pri prenose: Štandardné zmluvné doložky EÚ; EU–US Data Privacy Framework (rámec ochrany osobných údajov medzi EÚ a USA).

9. International transfers

This DPA applies to processing by advixory in Slovakia irrespective of where the controller is located. Where advixory transfers personal data outside the European Economic Area to a sub-processor, it relies, in order of preference, on: (a) a European Commission adequacy decision for the recipient country, including the EU–US Data Privacy Framework where the specific recipient entity is certified under it; or (b) the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914), in the module that fits the transfer (Module Three for processor-to-sub-processor transfers), as included in the relevant sub-processor's data processing terms. The controller authorizes advixory to enter into and manage those clauses with sub-processors on the controller's behalf.

Before relying on the Standard Contractual Clauses, advixory carries out a transfer impact assessment consistent with EDPB Recommendations 01/2020, taking into account the nature of the personal data (mainly business and customer contact details and review-related content, which must not include special categories of data), the safeguards in the recipient country's law (including, for the United States, the necessary-and-proportionate limits and independent redress mechanism introduced by Executive Order 14086), and the supplementary technical and organizational measures advixory applies, including encryption of personal data in transit and at rest, access controls, data minimization and pseudonymization. advixory keeps this assessment under review and will suspend the transfer and notify the controller if it can no longer ensure an adequate level of protection.

In case of conflict between the Standard Contractual Clauses and this DPA or the Terms, the Standard Contractual Clauses prevail. The location and transfer safeguard for each sub-processor are shown in the list above, and the controller may request a copy of the relevant clauses at [email protected].

10. Personal data breach

We will notify the controller without undue delay after becoming aware of a personal data breach affecting the controller's personal data, and will provide the information the controller reasonably needs to meet its own obligations under Articles 33 and 34 GDPR. The 72-hour notification deadline under Article 33 applies to the controller, not to us as processor; our duty is to inform the controller without undue delay so that the controller can meet that deadline.

11. Assistance with data-subject rights

We will assist the controller with access, rectification, erasure, restriction, portability and objection requests where the request relates to personal data processed in Townproof. Contact exports are produced as a JSON and CSV bundle for the relevant contact, scoped to the customer's organization.

12. Deletion and return of data on termination

After the services end, we will, at the controller's choice, return (as a JSON and CSV export) or delete its personal data and delete existing copies, unless Union or Member-State law requires storage. If law requires us to keep some personal data, we will tell the controller which categories and why, use them only for that purpose and delete them when the obligation ends. Separately, during the service: contact identifiers are purged by default 365 days after the contact's last interaction, or after creation if there was none, unless a send is in progress; AI reply drafts are deleted after 90 days; and tracked-link interaction records after 13 months. Suppression records needed to honor an opt-out are kept, reduced to what is needed for that purpose.

13. Audit rights

We will make available the information necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, by the controller or an auditor it mandates. Audits must be limited to what is necessary, avoid disrupting the service, protect other customers' data, and respect our confidentiality and security controls; we may satisfy audit requests through documentation, summaries or equivalent evidence where appropriate.

14. Liability

As between the parties, the limitation of liability in the Terms of Service applies to this DPA. Nothing in this DPA limits any liability that cannot be limited under mandatory law, including a processor's liability toward data subjects under Article 82 GDPR.

15. Successors and assignment

This DPA binds and benefits each party and its respective successors and permitted assigns. We may assign or novate this DPA, together with the underlying Terms, to a successor or affiliated entity in connection with a merger, reorganization, sale of the business or its assets, or other corporate transaction. On written notice to the controller identifying the successor and the effective date, the successor assumes our rights and obligations, the controller's instructions and authorizations continue in favor of the successor, and this DPA continues without re-execution. Where applicable law requires the successor to be separately bound, the successor will execute a deed of adherence to this DPA, and the controller agrees in advance to such adherence. If the controller objects on reasonable data-protection grounds to the identity of the successor within 30 days of our notice, and we cannot resolve the objection, the controller may terminate the affected part of the service. Any onward transfer of personal data under this Section will comply with Articles 28 and 44–49 and the transparency requirements of Articles 13–14 GDPR.

16. Governing law and order of precedence

This DPA is governed by the laws of the Slovak Republic and any mandatory data-protection law that applies; the Standard Contractual Clauses keep their own governing law for transfers they cover. The courts competent for the seat of advixory s.r.o. in Košice have jurisdiction unless mandatory law requires a different forum. In case of conflict regarding the processing of personal data, this DPA prevails over the Terms of Service. This DPA is concluded in electronic form; acceptance is logged when a customer creates or accesses an organization, again for each new version of this DPA, and may be confirmed again in-product before review-request sending is enabled. Acceptance logs include the DPA version and related legal-document versions.

17. California (CCPA) terms

This Section applies where the customer is a business and the personal data is personal information under the California Consumer Privacy Act (CCPA). With respect to that data, advixory acts as a service provider and processes it only on the customer's behalf for the limited and specified business purpose of providing Townproof. advixory will not: (a) sell or share the personal information; (b) retain, use or disclose it for any purpose other than the business purposes specified in this DPA, for any commercial purpose other than providing the service, or outside the direct business relationship with the customer; or (c) combine it with personal information from another source, except as the CCPA permits. advixory certifies that it understands and will comply with these restrictions, will provide the same level of privacy protection as the CCPA requires, will notify the customer if it can no longer meet its obligations, will allow the customer to take reasonable steps to ensure its data is used appropriately, and will impose these same terms on any sub-processor.