Parties and roles
The final addendum must identify the customer/controller and the feedrevive processor legal entity. feedrevive’s own account, billing and security processing requires a separate role assessment. This draft is not an executed data processing agreement.
Processing schedule
Planned subject matter: product feed analysis, recommendations, controlled publishing, monitoring and reporting. Duration: the active service term plus agreed deletion and justified retention periods. Data may include authorized user identities, work contact details, catalog content and incidentally included personal data. Data subjects may include customer staff and client contacts.
Customers should avoid supplying shopper records, payment-card data or sensitive personal data not required for product feed work. Final data categories and prohibited data must be agreed.
Instructions and confidentiality
Processing should follow documented customer instructions, authorized product actions and agreed legal requirements. Personnel access and confidentiality obligations, access reviews, authentication controls and auditability must be defined and evidenced in the final agreement.
Security and incidents
The final technical and organizational measures schedule must describe verified access controls, encryption, tenant isolation, change approval, recovery, incident handling and testing. Incident notification timing, content and assistance responsibilities remain to be finalized; no unsupported deadline is promised here.
Suppliers and transfers
Attach a verified subprocessor register covering legal names, services, data categories and processing locations. Define authorization, notice and objection processes. USA application storage is planned at launch; applicable transfer safeguards and supplier processing locations must be confirmed separately.
Assistance, audits and deletion
Define assistance for rights requests, assessments, regulator enquiries and incident response. Agree reasonable audit evidence and review procedures. At termination, document return/export and deletion, required retained records and backup expiry, with safeguards against restoring deleted data.
Open schedules and execution
Complete the processing details, security measures, supplier list, transfer instruments, assistance costs, audit process, contact details and signatures before use. Contact privacy@feedrevive.com.
Proposed processing instructions
For the executed agreement, processing must be limited to documented lawful instructions, including approved transfers, unless binding law requires otherwise. In that case, notify the customer before processing unless the law prohibits notice. Inform the customer if an instruction appears unlawful and pause the affected operation while it is resolved. Do not independently repurpose customer personal data for advertising, sale or unrelated training.
Authorized personnel must be bound by confidentiality and receive access only as necessary for their duties. A customer acting as a processor must have its controller’s authority to engage feedrevive and pass through the controller’s lawful instructions. The agreement must cover both role configurations rather than assume every customer is a controller.
Required security schedule
The proposed schedule must record implemented measures and evidence for: access approval and removal; least privilege and administrative MFA; tenant separation; encryption and key management; vulnerability and patch handling; secure development and change review; logging and monitoring; secure backups and tested recovery; personnel training; and physical/provider security. Testing frequency, responsible parties and material changes need documentation. No certification or particular control is warranted by listing it here.
Measures must address confidentiality, integrity, availability and resilience in proportion to processing risks. Supplier claims are not a substitute for verifying feedrevive’s own configuration. The customer must also secure its users, connected accounts and lawful source collection.
Personal-data breach procedure
Where GDPR applies, a processor must notify the controller of a personal-data breach without undue delay after becoming aware of it. The controller’s potentially applicable 72-hour authority-notification period is not a waiting period available to the processor. The final operational schedule must specify monitored contacts, escalation ownership and practical early-notification targets.
The proposed notice should include known facts, affected data and people, likely consequences, containment and remediation, and a contact for follow-up. Information may be supplied in stages as the investigation develops. Preserve appropriate evidence, cooperate with the customer and avoid delaying initial notice until every fact is known. The controller retains its own regulator and individual-notification duties unless a lawful delegated arrangement applies.
Subprocessor authorization
The final DPA must record specific authorization or a defined general written authorization. Under general authorization, provide advance notice of intended additions or replacements and a meaningful opportunity to object on data-protection grounds before the new processing. Agree the notice period, objection channel and a resolution such as an alternative supplier, avoiding affected processing or terminating the affected service.
Impose equivalent relevant data-protection duties on subprocessors by written contract and remain responsible to the customer for their performance as required by applicable law. Publish verified supplier information in the register. A candidate supplier is not automatically authorized.
Assistance, evidence and end of processing
The proposed agreement requires appropriate assistance with individual rights, security, breach response, impact assessments and prior regulatory consultation, taking account of the processing and information available. Route customer-data requests to the customer promptly; do not disclose its data to an unverified requester.
Make available information needed to demonstrate compliance and allow legally required audits and inspections by the customer or its authorized auditor. Reasonable confidentiality, scheduling and protection of other customers’ data must not eliminate the audit right. Any exceptional assistance fees must be agreed and must not obstruct statutory obligations.
At the customer’s choice, return or delete personal data after the service ends, including copies unless binding law requires retention. Agree export format, deletion timetable, backup expiry and evidence of completion. Isolate legally retained records, limit further use and prevent deleted data returning to active use after a backup restore.
Transfers and execution checklist
An Article 28 processing agreement is not itself an international-transfer mechanism. Complete the appropriate transfer instrument, parties, modules and annexes, destination assessment and any additional safeguards before a restricted transfer. Mandatory transfer clauses prevail over conflicting commercial wording. UK or other jurisdiction-specific requirements must be assessed where applicable.
Before execution, fill in both legal parties and contacts; processing purpose, operations, frequency and duration; data subjects and data types; approved locations and suppliers; verified security measures; assistance procedures; return/deletion terms; applicable transfer instruments; and acceptance/signatures. Until these are complete, this page is a review draft and must not be relied on as an executed DPA.