Data Processing Agreement

Last updated: 24-DEC-2025

This Data Processing Agreement ("DPA") forms part of the agreement between Recometry ("Processor") and the customer ("Controller") governing the use of the services provided through recometry.com (the "Service").

This DPA is entered into pursuant to Article 28 of Regulation (EU) 2016/679 (the "GDPR") and applies where Processor processes Personal Data on behalf of Controller.

1. Definitions

Terms such as "Personal Data", "Processing", "Controller", and "Processor" shall have the meanings given to them in the GDPR.

2. Subject Matter and Duration

This DPA applies for the duration of Processor's processing of Personal Data under the agreement for the provision of the Service.

3. Nature and Purpose of Processing

Processor provides a software platform for recommendation, personalization, and analytics. Processing is limited to what is necessary to provide and maintain the Service.

4. Categories of Data and Data Subjects

Category	Description
Data Subjects	End users of Controller's applications or services
Personal Data	Pseudonymous identifiers, behavioral and interaction data, content or item identifiers, timestamps, and contextual metadata
Sensitive Data	Processing of special categories of personal data is not intended and must not be provided without Processor's prior written consent

5. Obligations of the Controller

Controller represents and warrants that:

It has a valid legal basis to process Personal Data
It has provided all required notices to data subjects
Personal Data is collected and processed in compliance with applicable law

6. Obligations of the Processor

Processor shall:

Process Personal Data only on documented instructions from Controller
Ensure personnel are bound by confidentiality obligations
Implement appropriate technical and organizational security measures
Not engage another processor without authorization
Assist Controller with data subject requests where applicable

7. Security Measures

Processor implements appropriate measures including, but not limited to:

Access controls and authentication
Encryption in transit and at rest where appropriate
Monitoring and logging
Regular security assessments

8. Subprocessors

Controller grants Processor general authorization to engage subprocessors for the provision of the Service.

Processor shall ensure subprocessors are subject to data protection obligations no less protective than those set out in this DPA.

A current list of subprocessors may be provided upon request.

9. International Data Transfers

Where Personal Data is transferred outside the EEA, Processor shall ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission.

10. Data Subject Rights

Processor shall, to the extent legally permitted, assist Controller in fulfilling its obligations to respond to requests from data subjects exercising their rights under the GDPR.

11. Personal Data Breach

Processor shall notify Controller without undue delay after becoming aware of a Personal Data Breach and provide information reasonably required to comply with applicable law.

12. Deletion or Return of Data

Upon termination of the Service, Processor shall, at Controller's choice, delete or return all Personal Data unless retention is required by law.

13. Audits

Processor shall make available information reasonably necessary to demonstrate compliance with this DPA and allow for audits conducted by Controller, subject to reasonable notice and confidentiality obligations.

14. Liability

Liability arising from this DPA shall be subject to the limitations set forth in the main agreement between the parties.

15. Governing Law

This DPA shall be governed by the laws of [Jurisdiction].

16. Contact

For data protection matters, contact:

Email: [email protected]
Company: Recometry