Data Processing Addendum (DPA) — DRAFT (requires attorney review before publishing)
Between: Steele Standards d/b/a Revundo (formerly Verifund) ("Processor") and the merchant ("Controller") Effective: on signature · Contact: hello@revundo.com
1. Scope
This DPA applies whenever Revundo processes shopper or order personal data on the merchant's behalf, including Trust Network participation. It supplements the merchant service agreement.
2. Instructions
The Processor processes personal data only on the Controller's documented instructions and only as needed to provide the returns-management service.
3. De-identification for cross-merchant signals
Trust Network signals shared across merchants are derived from de-identified data only. Raw shopper identities are never shared between merchants. The Trust Network is not enabled for a merchant until this DPA is signed.
4. Sub-processors
Current sub-processors: Vercel (hosting), Supabase (database), Stripe (billing). The Processor will give 14 days' email notice before adding a sub-processor; the Controller may object on reasonable grounds.
5. Security
TLS in transit, encryption at rest via hosting providers, hashed shopper identifiers, least-privilege access, and prompt patching. See the Security page.
6. Breach notification
The Processor will notify the Controller without undue delay (and within 72 hours of awareness) of a personal-data breach, with the nature, categories, approximate subjects affected, and mitigation steps.
7. Assistance and audit
The Processor will assist the Controller with data-subject requests and, on reasonable written request no more than annually, provide a written summary of its security practices or permit a mutually agreed audit at the Controller's expense.
8. Return and deletion
Within 90 days of termination, the Processor deletes or returns all personal data, unless law requires retention.
9. Liability
Confidentiality and data-security liability is subject to the $25,000 super-cap in the merchant service agreement.
DRAFT — prepared for internal review. Not legal advice. Must be reviewed by a licensed attorney before publishing.