Data Processing Agreement

1. Parties

This DPA is incorporated into and forms part of the WiserReview Terms & Conditions. By using WiserReview services, you agree to this DPA. Enterprise customers may request a countersigned copy by emailing [email protected].

2. Definitions

3. Details of Processing

4. Obligations of the Processor (WiserReview)

WiserReview, as Data Processor, shall:

• 1Process Personal Data only on documented instructions from the Controller (i.e., to deliver the WiserReview service as described in the Terms & Conditions).
• 2Ensure that persons authorised to process Personal Data are bound by confidentiality obligations.
• 3Implement appropriate technical and organisational security measures as described in Section 7 of this DPA.
• 4Assist the Controller in responding to Data Subject rights requests (access, rectification, deletion, portability, objection, restriction) within applicable timeframes.
• 5Notify the Controller without undue delay, and in any event within 72 hours, upon becoming aware of a Personal Data breach affecting the Controller's data.
• 6Provide the Controller with all information necessary to demonstrate compliance with GDPR Article 28, and cooperate with audits or inspections conducted by the Controller or a mandated auditor (see Section 9).
• 7Engage Sub-Processors only as listed in Section 6, and impose equivalent data protection obligations on them.
• 8Delete or return all Personal Data to the Controller upon termination, as per Section 10.
• 9Not process Personal Data for any purpose other than delivery of the services.
• 10Notify the Controller if it believes any instruction infringes applicable data protection law.

Our full breach notification and incident response procedure is documented at /security/incident-response.

5. Obligations of the Controller (Merchant)

You, as Data Controller, shall:

• 1Ensure you have a lawful basis (e.g., legitimate interest, consent, contractual necessity) to share your customers' personal data with WiserReview.
• 2Inform your end customers about the use of WiserReview for review management in your privacy policy and any required consent flows.
• 3Give documented and lawful instructions to WiserReview regarding the processing of Personal Data.
• 4Ensure that the personal data you share with WiserReview is accurate and relevant.
• 5Promptly inform WiserReview of any Data Subject rights requests that affect data held by WiserReview.
• 6Accept the use of Sub-Processors listed in Section 6 and any updates notified by WiserReview.

6. Sub-Processors

WiserReview currently uses the following Sub-Processors. By accepting this DPA, you provide general authorisation to engage these Sub-Processors. WiserReview will notify you of any intended changes to Sub-Processors and provide an opportunity to object within 14 days.

7. Technical & Organisational Security Measures

WiserReview implements the following technical and organisational measures in accordance with GDPR Article 32:

Full technical security documentation is available at wiserreview.com/security.

8. Data Subject Rights

WiserReview will assist the Controller in fulfilling Data Subject rights requests:

• • Access & Portability: Review data can be exported from the dashboard in CSV format.
• • Rectification: Merchants can edit review content via the dashboard.
• • Deletion (Erasure): Merchants can delete individual reviews or their entire account via the dashboard. Automated data deletion is supported through integration events from connected platforms.
• • Objection: Consumers can unsubscribe from review request emails at any time via unsubscribe links.

For Data Subject requests that require WiserReview action, contact [email protected]. We will respond within the required timeframe (no later than 30 days). For a full overview of data subject rights and how we support them, see Data Privacy & Protection §4.2.

9. Audit Rights

WiserReview shall provide the Controller with all information reasonably necessary to demonstrate compliance with this DPA, including access to this publicly available security documentation. The Controller may, upon 30 days' written notice, request an audit of WiserReview's data processing activities. Audits shall be conducted during business hours, at the Controller's expense, and in a manner that does not disrupt WiserReview's operations. WiserReview may satisfy audit obligations by providing relevant third-party audit reports or certifications where available.

10. Return & Deletion of Data

Upon termination of the WiserReview subscription, or upon written request from the Controller, WiserReview shall:

• • Delete all Personal Data from primary databases within a reasonable timeframe (typically within 60 days of account closure).
• • Provide the Controller with the option to export all review data in CSV format prior to deletion.
• • Backup data may be retained for up to the MongoDB Atlas point-in-time recovery window before being fully purged.
• • CDN caches will be purged following account closure.

11. Cross-Border Data Transfers

Personal Data is processed primarily in the United States via Microsoft Azure infrastructure. For transfers of Personal Data from the EEA or UK to the United States, WiserReview and its Sub-Processors rely on Standard Contractual Clauses (SCCs) as approved by the European Commission, or other appropriate transfer mechanisms under GDPR Chapter V. All major Sub-Processors (Azure, AWS, MongoDB Atlas, Cloudflare) maintain GDPR-compliant data transfer frameworks.

12. Governing Law

This DPA is governed by the laws of the State of Delaware, United States, except where superseded by applicable data protection law (including GDPR where applicable). Where GDPR applies, the relevant EU data protection regulations take precedence over this governing law clause.

13. Order of Precedence

In the event of any conflict between this DPA and the Terms & Conditions, this DPA shall prevail with respect to data processing matters. In the event of any conflict between this DPA and applicable data protection law, applicable law shall prevail.