Data Processing Agreement

1. Parties, scope and precedence

This DPA is between the business that has accepted the Terms of Service or signed an Order Form (the Customer, the controller) and RATECARDS L.L.C-FZ, Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates (RATECARDS, the processor). It is incorporated into the Agreement by reference and takes effect on the date the Customer first uses the Service. Either party may request a countersigned copy at support@ratecards.co.

This DPA applies to Customer Personal Data: personal data contained in Customer Data that RATECARDS processes on the Customer's behalf in providing the Service — in particular reviewer identifiers, display names, review text and replies mirrored from the platforms the Customer connects, and the personal data of the Customer's own staff that the Customer enters into its workspace. It does not apply to Users' sign-in and session data (credentials, sessions, verification tokens, invitations), which RATECARDS processes as a controller under the Privacy Policy. A User's name, email address, role and location scope are held in both capacities: as account data under the Privacy Policy, and as Customer Personal Data under this DPA where they appear in the Customer's workspace.

If this DPA conflicts with the Terms or an Order Form, this DPA prevails for the processing of personal data. If the Standard Contractual Clauses referred to in the International transfers section conflict with this DPA, the Clauses prevail.

2. Definitions

• Data Protection Law — every law that applies to the processing of Customer Personal Data under this DPA, including the EU General Data Protection Regulation 2016/679 (GDPR), the UK GDPR and Data Protection Act 2018, and UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, together with any executive regulations issued under it (PDPL).
• Personal data, controller, processor, data subject, processing and personal data breach have the meanings given in Data Protection Law.
• Sub-processor — a third party engaged by RATECARDS to process Customer Personal Data.
• Agreement, Service, Order Form, Customer Data, User, Workspace, Location and Touchpoint have the meanings given in the Terms of Service.
• Platform — a third-party review platform the Customer connects to the Service (an independent controller, not a sub-processor).
• Standard Contractual Clauses — the clauses adopted by the European Commission in Decision (EU) 2021/914 for the transfer of personal data to third countries, Module Two (controller to processor), and, where UK law applies, the UK International Data Transfer Addendum.

3. Roles of the parties

The Customer is the controller of Customer Personal Data and determines the purposes and means of its processing. RATECARDS is the Customer's processor. Each party will comply with the obligations Data Protection Law places on it in that role. The Customer confirms that it has a lawful basis for the processing it instructs, including for mirroring reviews from each Platform it connects, and that its instructions comply with the Platform's terms.

4. Processing on documented instructions

• RATECARDS will process Customer Personal Data only on the Customer's documented instructions, including for transfers to a third country, unless required to do so by Union or Member State law to which RATECARDS is subject; in that case RATECARDS will inform the Customer of the legal requirement before processing, unless the law prohibits this. Where a law of the United Arab Emirates or another third country requires processing contrary to the Customer's instructions, RATECARDS will inform the Customer before complying, unless that law prohibits this, and will comply only to the extent legally required.
• The Customer's instructions are: the Agreement, this DPA (including Annex 1), the configuration the Customer's Users apply in the Service (which Platforms are connected, which features are enabled, which replies are published), and any further written instructions the Customer gives.
• RATECARDS will inform the Customer immediately if, in its opinion, an instruction infringes Data Protection Law. RATECARDS may then suspend the instruction until the Customer confirms or changes it.

5. Confidentiality of personnel

RATECARDS ensures that every person it authorises to process Customer Personal Data is bound by a duty of confidentiality (by contract or statute) and processes the data only on instructions. Access is granted on a need-to-know basis; changes to critical records are captured in the audit log described in Annex 2.

6. Security of processing

RATECARDS implements and maintains the technical and organisational measures described in Annex 2, and will not reduce the overall level of protection they provide during the term. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, these measures are designed to ensure a level of security appropriate to the risk.

7. Sub-processors

• The Customer gives RATECARDS general written authorisation to engage the sub-processors listed in Annex 3, and any replacement or additional sub-processor engaged under this section.
• RATECARDS will give the Customer's workspace owners at least 30 days' notice by email before a new sub-processor starts processing Customer Personal Data. The Customer may object in writing on reasonable, documented data-protection grounds within that period. If the parties cannot resolve the objection in good faith, the Customer may terminate the affected part of the Service, or the Agreement, without penalty and with a pro-rata refund of prepaid fees.
• RATECARDS engages each sub-processor under written data-processing terms — the vendor's data-processing addendum named in Annex 3 — that impose data-protection obligations providing at least the same level of protection as this DPA, and remains fully liable to the Customer for the sub-processor's performance.
• A sub-processor that Annex 3 marks as planned is disclosed in advance, not yet processing; RATECARDS will still give the Customer's workspace owners the notice above before it starts processing Customer Personal Data, and the objection right runs from that notice.
• The Platforms the Customer connects are not sub-processors: they are independent controllers with which the Customer has its own relationship, and review data flows between the Customer's Platform account and its workspace under the Platform's terms.

8. Assistance with data-subject requests

Taking into account the nature of the processing, RATECARDS will assist the Customer, by appropriate technical and organisational measures and insofar as this is possible, in fulfilling the Customer's obligation to respond to requests from data subjects exercising their rights (access, rectification, erasure, restriction, portability, objection). If a data subject contacts RATECARDS directly about Customer Personal Data, RATECARDS will not respond on the merits but will forward the request to the Customer without undue delay and tell the data subject it has done so. Erasure is carried out by overwriting the subject's personal fields in place and recording the subject on a platform-wide erasure list that every backup restore is checked against, so erased data cannot be resurrected (today by an operator following a written procedure; an automated flow is planned).

9. Assistance with security, breach notification and impact assessments

• RATECARDS will notify the Customer's workspace owners of a personal data breach affecting Customer Personal Data immediately upon becoming aware of it — and in every case without undue delay and no later than 72 hours after becoming aware, so that a Customer subject to the UAE PDPL can make its own immediate notification and a Customer subject to the GDPR can meet its 72-hour deadline. The notice will describe, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point; information may be provided in phases as it becomes available.
• RATECARDS will assist the Customer in meeting its own obligations regarding security of processing, breach notification to authorities and data subjects, data-protection impact assessments and prior consultation, taking into account the nature of the processing and the information available to RATECARDS.
• RATECARDS may charge reasonable costs for assistance that goes beyond what the Service and this DPA already provide, and will tell the Customer before incurring them.

10. Deletion and return at the end of the Service

At the Customer's choice, RATECARDS will return (as an export in a common machine-readable format) and/or delete all Customer Personal Data after the end of the provision of the Service. RATECARDS will delete the Customer's workspace data 30 days after termination — or earlier if the Customer asks in writing after receiving its export — and destroy the key material that protected the workspace's Platform credentials; every Platform authorisation is revoked within seven business days of termination so the Customer can disassociate its Platform accounts. Copies held in backups are overwritten in the ordinary backup cycle described in Annex 2 and are protected until then by the same measures. RATECARDS may retain data where, and for as long as, Union or Member State law — or, for a Customer subject to the PDPL, UAE law — requires it, and will continue to protect it under this DPA.

11. Information and audit

RATECARDS will make available to the Customer all information necessary to demonstrate compliance with this DPA, and will allow for and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer. Audits are limited to once in any 12-month period unless required by a supervisory authority or following a personal data breach, are conducted on at least 30 days' written notice during business hours, must not unreasonably disrupt the Service or expose other customers' data, and are at the Customer's cost. RATECARDS will first answer written questions and provide its security documentation and test evidence; an on-site inspection is reserved for cases those answers cannot resolve.

12. International transfers

The Service is hosted in Frankfurt, Germany (European Union). RATECARDS is established in the United Arab Emirates and administers the Service from there, and the sub-processors in Annex 3 process Customer Personal Data in the locations stated there, some of which are outside the EU/EEA, the UK and the UAE.

• Customers subject to the GDPR or UK GDPR. The Customer's engagement of RATECARDS is a transfer to a third country. The parties agree the Standard Contractual Clauses (Module Two), which are incorporated into this DPA by reference with the following selections: Clause 7 (docking) included; Clause 9 option 2 (general authorisation, 30 days' notice as in this DPA); Clause 11 optional language not included; Clause 13 and Annex I.C: the supervisory authority of the EU member state in which the Customer is established; Clause 17 option 1: the law of Ireland; Clause 18: the courts of Ireland. Annex I.A of the Clauses is completed as follows: data exporter — the Customer, at the name, address and contact details in its Order Form or workspace account, role controller; data importer — RATECARDS L.L.C-FZ, Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates, support@ratecards.co, role processor; each party's acceptance of this DPA stands as its signature and date. Annex I.B is completed by Annex 1 of this DPA, Annex II by Annex 2, and Annex III by Annex 3. For Customers subject to the UK GDPR the UK International Data Transfer Addendum (ICO, version B1.0) is incorporated: Table 1 — the parties as identified in this DPA; Table 2 — the Clauses with the selections above; Table 3 — Annexes 1, 2 and 3 of this DPA; Table 4 — either party may end the Addendum as set out in its section 19. RATECARDS makes an onward transfer of Customer Personal Data to a sub-processor outside the EU/EEA only where Clause 8.8 of the Clauses is met — Module Three Clauses concluded with that sub-processor (the data-processing terms in Annex 3 incorporate them where they say so) or another transfer tool under Chapter V of the GDPR.
• Customers subject to the UAE PDPL. Customer Personal Data leaves the UAE for the EU hosting location and for the sub-processors in Annex 3. Until the UAE Data Office approves the destination countries or agreements under Article 22 of the PDPL, these transfers are made under Article 23: RATECARDS binds each recipient by contract to protection equivalent to the PDPL's provisions, measures, controls and requirements (this DPA and the sub-processor terms in Annex 3), and the Customer, by accepting this DPA, instructs and authorises the transfers for the performance of the Agreement.
• Where a supervisory authority or a change in Data Protection Law requires a different or additional transfer mechanism, the parties will cooperate in good faith to put it in place promptly.

13. Liability, term and general

• Each party's liability under this DPA is subject to the limitations and exclusions in the Terms, except that nothing limits liability to data subjects under the Standard Contractual Clauses or under Data Protection Law where it cannot be limited.
• This DPA lasts as long as RATECARDS processes Customer Personal Data on the Customer's behalf, including the deletion period above, and is governed by the law and courts stated in the Terms, except where the Standard Contractual Clauses require otherwise.
• RATECARDS may update Annex 3 under the sub-processor section, and Annex 2 to strengthen (never weaken) the measures. Other changes to this DPA follow the change procedure in the Terms.

14. Annex 1 — Details of the processing

15. Annex 2 — Technical and organisational measures

The measures below are those in force on the date of this version, stated as built. Where a measure depends on a sub-processor that Annex 3 marks as planned, or on a step that is still carried out manually, the row says so.

16. Annex 3 — Sub-processors

The sub-processors engaged, or planned and disclosed in advance, on the date of this version. RATECARDS keeps this list current under the sub-processor section above; the version and date at the top of this page change when it does.

Not sub-processors. Google Business Profile and Trustpilot are Platforms the Customer connects and are independent controllers; Tripadvisor is linked to and not mirrored; Google Sign-In is an identity provider a User may choose. Their processing is governed by their own terms with the Customer or the User.