Data Protection & GDPR

REVIENT DATA PROTECTION & GDPR

Including the Revient Data Processing Addendum

Version: 1.0
Effective date: (EFFECTIVE DATE)
Last updated: (LAST UPDATED DATE)

This Data Protection & GDPR document explains Revient's data-protection framework and contains the contractual Revient Data Processing Addendum (DPA). Where the DPA applies, it forms part of the agreement between the Merchant and (COMPANY LEGAL NAME) LIMITED, trading as Revient.

Company number: (COMPANY REGISTRATION NUMBER)
Registered in: (JURISDICTION OF INCORPORATION)
Registered office: (REGISTERED OFFICE ADDRESS)
ICO registration number: (ICO REGISTRATION NUMBER, IF APPLICABLE)
Privacy email: (PRIVACY EMAIL)
Website: (WEBSITE URL)

1. Purpose and scope

This document covers Revient's approach to:

• Controller and Processor roles;
• privacy by design and data minimisation;
• Merchant and Partner data-protection responsibilities;
• security and confidentiality;
• Data Subject rights and complaints;
• personal-data breaches;
• international data transfers;
• retention, return and deletion;
• AI-assisted processing and automated decisions;
• service providers and Subprocessors; and
• the contractual terms that apply where Revient processes personal information as Processor for a Merchant.

It should be read with the Revient Terms of Service, Privacy Notice and Cookie Policy.

2. Applicable data-protection laws

Revient complies with data-protection and privacy laws that apply to Revient's particular processing activities. Depending on the circumstances, this may include the UK GDPR, Data Protection Act 2018, Privacy and Electronic Communications Regulations, the EU GDPR, and applicable national, state or regional privacy laws.

The fact that Revient is accessible over the internet does not mean that every privacy law applies to every processing activity. Where mandatory applicable law imposes requirements that cannot be varied by contract, those requirements apply.

3. Data-protection principles

Revient seeks to process personal information in accordance with the principles of lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability.

Revient applies privacy considerations when designing, changing and operating the Services and seeks to limit personal information to what is reasonably necessary for the relevant purpose.

4. Controller and Processor roles

Revient's legal role depends on the particular processing activity and is determined by what Revient and the Merchant actually do.

Revient as Processor

Revient may act as Processor where it processes Merchant-controlled personal information solely on the Merchant's behalf and under the Merchant's documented instructions to provide configured Services.

Examples can include hosting Case Data, importing authorised commerce records, storing Evidence, normalising records, performing Merchant-requested evidence processing, conducting case-targeted mailbox evidence searches and transmitting a Case according to a Merchant instruction.

Revient as Controller

Revient acts as Controller where it determines its own purposes and essential means, including for Account administration, billing administration, security, fraud prevention, Terms enforcement, Partner due diligence, compliance, privacy-request handling, complaints, corporate records and legal claims.

Revient may also act as Controller for limited Case-related processing where Revient independently determines that processing is necessary for security, fraud prevention, platform integrity, compliance or protection of legal rights.

Independent Partners

A Collection Agency or institutional Buyer may act as an independent Controller when it independently determines whether and how to accept a Case, conduct collection activity, perform acquisition due diligence, purchase a receivable or manage a receivable after purchase.

Revient does not label an independent organisation as a Processor merely to change its legal responsibilities.

5. Merchant responsibilities as Controller

Where the Merchant is Controller, the Merchant is responsible for:

• ensuring that its processing has an appropriate lawful basis or other legal authority;
• providing privacy information required of the Merchant;
• ensuring that personal information made available to Revient has been collected and disclosed lawfully;
• keeping Case information reasonably accurate and current;
• limiting instructions to lawful processing;
• handling Data Subject requests for Merchant-controlled information, with Revient's assistance where required;
• conducting any DPIA or other Controller assessment required for the Merchant's use of the Services; and
• complying with applicable retention, recordkeeping and regulatory obligations.

6. Revient responsibilities as Controller

Where Revient acts as Controller, Revient is responsible for its own lawful basis, transparency, security, rights handling, retention, data-protection records, complaint handling and other Controller obligations applicable to that processing.

Revient's Controller processing is described in the Privacy Notice.

7. Data minimisation

Revient seeks to limit collection and disclosure to information reasonably necessary for the relevant purpose.

For example, Revient's intended mailbox evidence workflow uses targeted Case identifiers to locate potentially relevant correspondence rather than intentionally copying an entire Merchant mailbox. Commerce connections are intended to retrieve relevant order, dispute, fulfilment, refund and Case information rather than unrelated customer records where broader access is not required.

The current selected-message retention path stores a minimized text-only projection of message identifiers, date, parties, subject and plain text. Original provider JSON/MIME, arbitrary headers, HTML data URLs and unselected inline attachment bytes are excluded. Only selected attachment metadata is retained with the message, while selected files use separate private storage and scanning. This current processing boundary is not a claim that earlier retained versions have been automatically purged.

8. Accuracy and Case updates

Revient may rely on data obtained from the Merchant, connected systems and Partners. The Merchant must promptly update information where a payment, refund, return, settlement, direct payment, identity correction or other material event affects an active Case.

Revient may preserve an audit history showing that information changed rather than silently rewriting historic records where an audit trail is reasonably required.

9. Security framework

Revient maintains technical and organisational measures designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

The production security measures applicable to Processor data are described in Schedule B - Technical and Organisational Measures below.

Security controls are reviewed and may be updated as the platform, risks and technology evolve, provided that Revient does not materially reduce the overall level of protection for Merchant Personal Data without appropriate justification.

10. Confidentiality and least privilege

Access to personal information is limited to authorised persons and systems that require access for an authorised purpose.

Revient personnel and contractors with access to confidential or personal information are subject to appropriate confidentiality obligations.

Privileged access should be limited, controlled and reviewed in accordance with Revient's security programme.

11. Privacy rights

Where Revient is Controller, Revient provides rights required by applicable law, which may include rights of access, correction, deletion, restriction, objection, portability, withdrawal of consent and safeguards relating to qualifying automated decisions.

Requests may be sent to (PRIVACY EMAIL) or submitted through (PRIVACY RIGHTS PORTAL URL, IF USED).

Where Revient acts as Processor, Revient assists the Merchant with Data Subject requests as described in the DPA.

12. Privacy complaints

Data-protection complaints may be submitted to (PRIVACY EMAIL) or (PRIVACY COMPLAINT FORM URL, IF USED).

For qualifying complaints subject to UK data-protection complaint requirements, Revient will acknowledge the complaint within 30 days, take appropriate steps to investigate and respond without undue delay, keep the complainant appropriately informed where required, and communicate the outcome.

Individuals remain entitled to complain to a competent supervisory authority where applicable.

13. AI-assisted processing

Revient may use deterministic checks and AI-assisted processing to assess Evidence, identify contradictions, identify missing information and provide recovery indicators or route recommendations.

Revient seeks to distinguish source facts from machine-generated assessments and to retain provenance for material Evidence.

The Evidence Engine is intended as decision support. A Merchant remains responsible for its Case information and an independent Collection Agency or Buyer makes its own acceptance decision.

Revient does not treat an Evidence Engine output as proof that an individual committed fraud or another criminal offence.

The implemented evidence workflow queues deterministic recovery checks only for confirmed lost disputes following collection/import and relevant evidence changes. Open, won, unknown and unsupported dispute outcomes do not enter recovery scoring. Optional AI also requires a confirmed lost dispute, an approved evaluated configuration and the applicable access permissions. Each provider attempt rechecks selected-message consent. AI support is limited to the authorised Case summary and versioned help, with no external-action tools.

Source refresh can reread connected store facts, parcel history and already-selected mailbox evidence for the authorised Case. It does not select new messages or expand staff or AI consent. Rechecking stored evidence reruns the assessment without asserting that a provider was read. Separate parcels and source timestamps remain distinct; available carrier proof files use private storage, scanning and Case-authorised access. Merchant-imported destination references are not independent carrier verification.

New normalized revisions and assessment inputs preserve source references, evidence selections and omissions, hashes, consent references and the engine configuration. New AI traces and correction payloads are encrypted within Revient and scoped to the Workspace. Corrections supersede current facts without rewriting historical assessments. Real review material remains Workspace-scoped; shared improvements use reviewed synthetic examples, excluding Gmail-derived material, and require approval before release.

14. Significant automated decisions

Revient does not intend the Evidence Engine alone to make a final decision that automatically causes collection communications to be sent to an individual without an independent Partner acceptance step.

Where Revient introduces a solely automated decision that produces legal or similarly significant effects and applicable law requires safeguards, Revient will provide the applicable safeguards, which may include information about the decision, the opportunity to make representations, human intervention and a way to challenge the decision.

15. Personal-data breaches

Revient maintains an incident-response process for suspected or confirmed security incidents affecting personal information.

Where Revient acts as Controller, Revient will assess regulator and individual notification obligations and make legally required notifications.

Where Revient acts as Processor, Revient will notify the relevant Merchant in accordance with the DPA below.

16. International data transfers

Revient may use providers or Partners in more than one country.

Where a transfer is restricted under UK data-protection law, Revient will use an available lawful transfer mechanism where required, such as an adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to EU Standard Contractual Clauses, or another approved safeguard or transfer mechanism.

Where EU GDPR applies, Revient will use an applicable EU transfer mechanism where required, including adequacy or applicable Standard Contractual Clauses.

The actual provider locations and transfer mechanisms are listed in the provider and Subprocessor schedules when known.

17. Retention and deletion

Revient retains personal information only for as long as reasonably necessary for the relevant purpose, subject to legal, accounting, security, dispute, Partner, platform and litigation requirements.

The Privacy Notice describes the principal retention categories. Processor data is returned or deleted at the end of the relevant Services as described in the DPA, subject to legally permitted retention and backup lifecycle controls.

18. Service Provider and Subprocessor Register

Revient maintains a register of providers that process personal information in connection with the Services.

A provider's legal role depends on the activity. Some providers act as Processors/Subprocessors; some act as independent Controllers for parts of their services; and connected platforms may be data sources used at the Merchant's direction rather than Revient Subprocessors.

The DPA Subprocessor Register is contained in Schedule C.

19. Data Protection Officer and representatives

If Revient is required to appoint a Data Protection Officer, the DPO contact will be:

(DPO CONTACT DETAILS, IF REQUIRED)

If an EU or other regional representative is legally required, the representative details will be:

EU Representative: (EU REPRESENTATIVE DETAILS, IF REQUIRED)
Other representative: (OTHER REGIONAL REPRESENTATIVE DETAILS, IF REQUIRED)

If no DPO or representative is required, privacy enquiries should be directed to (PRIVACY EMAIL).

REVIENT DATA PROCESSING ADDENDUM

20. Application of the DPA

20.1 Sections 20 to 55 and Schedules A to E form the Revient Data Processing Addendum.

20.2 The DPA applies to the extent that the Merchant acts as Controller and Revient acts as Processor in processing Merchant Personal Data to provide the Services.

20.3 The DPA is incorporated into the Revient Terms of Service and becomes binding when the Merchant accepts the Terms or otherwise enters an Agreement that incorporates this DPA.

20.4 If Revient acts as Controller for a separate processing activity, this DPA does not artificially convert that Controller processing into Processor processing.

21. DPA definitions

For the DPA:

Applicable Data Protection Law means privacy and data-protection law that applies to the relevant Processing, including the UK GDPR, Data Protection Act 2018 and EU GDPR where applicable, together with applicable US state privacy laws or other laws imposing equivalent Controller/Processor obligations.

Controller, Processor, Data Subject, Personal Data, Personal Data Breach, Process and Processing have the meanings given under Applicable Data Protection Law.

Merchant Personal Data means Personal Data processed by Revient as Processor on behalf of the Merchant under the Agreement.

Subprocessor means a Processor engaged by Revient to process Merchant Personal Data on Revient's behalf.

22. Processing details

The subject matter, duration, nature, purpose, types of Personal Data and categories of Data Subjects are set out in Schedule A - Processing Details.

23. Documented instructions

23.1 Revient will process Merchant Personal Data only on documented instructions from the Merchant, including with regard to transfers of Merchant Personal Data, unless applicable law requires Revient to process the information otherwise.

23.2 Documented instructions include the Agreement, this DPA, the Merchant's use and configuration of the Services, valid API calls, authorised integrations, Case-release actions, standing automation instructions configured by authorised Merchant users, and written instructions accepted by Revient.

23.3 If Revient reasonably believes a Merchant instruction violates Applicable Data Protection Law, Revient may inform the Merchant, request clarification, suspend the affected processing or decline the instruction to the extent necessary to avoid unlawful processing.

24. Processing required by law

Where applicable law requires Revient to process Merchant Personal Data other than on the Merchant's documented instructions, Revient may do so and will inform the Merchant before the processing unless the law prohibits Revient from giving that information.

25. Merchant Controller warranties

25.1 The Merchant represents that its instructions to Revient are lawful and that it has all rights, permissions, notices and lawful bases required to make Merchant Personal Data available for the instructed processing.

25.2 The Merchant is responsible for the accuracy and legality of Merchant Personal Data it controls and for determining whether its use of the Services is appropriate for its legal obligations.

25.3 The Merchant must not instruct Revient to process Personal Data for an unlawful purpose or provide data that the Services expressly prohibit.

26. Confidentiality

26.1 Revient will ensure that persons authorised to process Merchant Personal Data are subject to confidentiality obligations and receive access only where reasonably required for their duties.

26.2 Revient will maintain appropriate internal controls designed to prevent unauthorised disclosure or use of Merchant Personal Data.

27. Security of processing

27.1 Revient will implement and maintain appropriate technical and organisational measures designed to protect Merchant Personal Data, taking into account the state of the art, costs of implementation, the nature, scope, context and purposes of Processing, and the risk to Data Subjects.

27.2 The current measures are described in Schedule B.

27.3 Revient may update security measures as technology and risks evolve, provided the overall protection of Merchant Personal Data is not materially diminished without appropriate reason.

28. Subprocessor authorisation

28.1 The Merchant grants Revient general written authorisation to engage Subprocessors necessary to provide the Services, subject to this DPA.

28.2 Revient will enter into a written agreement with each Subprocessor that processes Merchant Personal Data requiring data-protection obligations appropriate to the processing and no less protective in substance than the relevant Processor obligations required by Applicable Data Protection Law.

28.3 Revient remains responsible to the Merchant for the performance of its Subprocessor obligations to the extent required by Applicable Data Protection Law and the Agreement.

29. Subprocessor Register

The current categories and identified Subprocessors are set out in Schedule C.

Revient will not knowingly describe an independent Controller as a Subprocessor merely to avoid the responsibilities associated with that Controller relationship.

30. New and replacement Subprocessors

30.1 Where Applicable Data Protection Law requires notice under a general authorisation model, Revient will give the Merchant reasonable advance notice of a material new or replacement Subprocessor that will process Merchant Personal Data.

30.2 The standard notice period will be (SUBPROCESSOR CHANGE NOTICE PERIOD) unless urgent security, legal or operational circumstances reasonably require a shorter period.

30.3 A Merchant may object during the notice period on reasonable grounds relating to data protection.

30.4 The parties will work in good faith to address a reasonable objection. If no commercially and technically reasonable alternative is available and the Subprocessor is necessary for the affected Service, either party may terminate the affected Service in accordance with the Agreement without requiring Revient to provide a materially different service architecture.

31. Data Subject requests

31.1 Taking into account the nature of Processing, Revient will provide reasonable technical and organisational assistance to the Merchant to respond to Data Subject requests relating to Merchant Personal Data where required by Applicable Data Protection Law.

31.2 If Revient receives a request that primarily concerns Merchant Personal Data processed solely as Processor, Revient may acknowledge the requester, verify enough information to avoid unauthorised disclosure, and refer or forward the request to the Merchant unless prohibited by law.

31.3 Revient will not independently make substantive Controller decisions on the Merchant's behalf unless the Merchant instructs Revient to do so and the instruction is lawful.

32. Assistance with security and breach obligations

Taking into account the nature of Processing and information available to Revient, Revient will provide reasonable assistance required for the Merchant's compliance with applicable Controller obligations concerning security and Personal Data Breaches.

33. Processor breach notification

33.1 Revient will notify the Merchant without undue delay after becoming aware of a Personal Data Breach affecting Merchant Personal Data processed by Revient as Processor.

33.2 To the extent information is known and reasonably available, the notification may include:

• the nature of the incident;
• categories of affected information and Data Subjects;
• approximate numbers where known;
• likely consequences;
• containment and remediation measures taken or proposed; and
• a contact point for further information.

33.3 Revient may provide information in phases as the investigation develops.

33.4 Notification under this clause is not an admission of fault or liability.

33.5 The Merchant remains responsible for determining whether it must notify a regulator, Data Subject or other person as Controller, except where Revient has an independent notification duty for its own Controller processing.

34. Data Protection Impact Assessments

34.1 Taking into account the nature of Processing and information available to Revient, Revient will provide reasonable information required to assist the Merchant with a Data Protection Impact Assessment relating to the Processor Services where the Merchant is legally required to conduct one.

34.2 Revient may provide standard security, architecture, processing or compliance materials rather than completing a Merchant-specific DPIA on the Merchant's behalf.

35. Prior consultation and regulator assistance

Where Applicable Data Protection Law requires the Merchant to consult a supervisory authority about Processing involving Revient as Processor, Revient will provide reasonable assistance and information within Revient's control, subject to appropriate confidentiality and security restrictions.

36. Records of Processing

Revient will maintain records of Processor activities to the extent required by Applicable Data Protection Law, including relevant categories of Processing, Controllers, international transfers and general security measures.

37. Compliance information

Revient will make available information reasonably necessary to demonstrate compliance with its Processor obligations. Depending on availability and sensitivity, this may include security summaries, architecture descriptions, Subprocessor information, policy extracts, audit reports, independent certifications actually held, questionnaire responses or other appropriate evidence.

Revient may redact information where disclosure would create an unreasonable security risk, violate another customer's confidentiality or disclose privileged information, provided that Revient supplies a reasonable alternative where required to demonstrate compliance.

38. Audits and inspections

38.1 The Merchant may audit Revient's compliance with the Processor obligations where required by Applicable Data Protection Law.

38.2 Unless a regulator, Personal Data Breach, material security event or reasonable evidence of material non-compliance justifies more frequent review, Merchant-initiated audits will normally be limited to once in any twelve-month period.

38.3 The Merchant must provide reasonable advance written notice and conduct an audit during normal business hours in a manner that does not unreasonably disrupt Revient or compromise other customers' information or system security.

38.4 Revient may satisfy an audit request in the first instance by providing current independent audit reports, certifications, security documentation or questionnaire responses where those materials reasonably address the requested subject.

38.5 The Merchant bears its own audit costs and Revient's reasonable costs of a bespoke audit unless the audit identifies a material breach by Revient, in which case allocation of reasonable audit costs will be determined in accordance with the Agreement and applicable law.

38.6 Nothing in this clause restricts a competent regulator's lawful audit or investigative powers.

39. International transfers by Revient as Processor

39.1 Revient will not make a restricted transfer of Merchant Personal Data except on the Merchant's documented instructions, through the operation of the Services authorised by the Merchant, or as required by law, and only where a lawful transfer mechanism applies.

39.2 Applicable transfer mechanisms are identified in Schedule D.

39.3 Where required, Revient will conduct or support an appropriate transfer-risk assessment or equivalent review for a transfer mechanism used by Revient.

40. UK restricted transfers

Where a transfer of Merchant Personal Data subject to UK transfer restrictions is made to a recipient in a country without an applicable adequacy arrangement, Revient will use an appropriate safeguard where required, which may include the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses or another approved mechanism.

41. EEA restricted transfers

Where a transfer of Merchant Personal Data subject to EU GDPR transfer restrictions is made to a country without an applicable adequacy decision, Revient will use an appropriate Article 46 safeguard where required, which may include the applicable modules of the European Commission Standard Contractual Clauses or another lawful mechanism.

42. Government and law-enforcement requests

42.1 Where Revient receives a legally binding governmental or law-enforcement request for Merchant Personal Data, Revient will assess the request and disclose only information Revient reasonably determines it is legally required or permitted to disclose.

42.2 Where legally permitted, Revient will notify the Merchant before disclosure if the request concerns Merchant Personal Data processed solely on the Merchant's behalf.

42.3 Revient may challenge an unlawful or manifestly excessive request where reasonably appropriate and legally available.

43. Return and deletion at the end of Services

43.1 At the end of the relevant Processor Services, Revient will, at the Merchant's choice where Applicable Data Protection Law requires it, return or delete Merchant Personal Data and delete existing copies, unless applicable law requires or permits continued retention.

43.2 The Merchant's choice may be exercised through available export/deletion functionality or a written request submitted before the applicable deletion deadline.

43.3 Revient may retain information that is no longer Processed solely as Merchant Processor where Revient has an independent lawful obligation or Controller purpose to retain it, provided that Revient clearly separates that legal role and complies with the applicable Controller obligations.

43.4 Access restriction does not itself establish completed physical deletion. If cleanup of an unsuccessful evidence acquisition encounters a storage failure, unattached content remains quarantined and inaccessible pending cleanup retry. Completion must be recorded separately; this mechanism is not a universal automated end-of-service purge. Backup handling and legal retention exceptions remain subject to sections 44 and 45.

44. Backups

44.1 Merchant Personal Data may remain in encrypted or access-restricted backups after deletion from active production systems until the relevant backup expires or is overwritten under Revient's backup lifecycle.

44.2 Backup data retained solely for disaster recovery will not be restored into active use except where needed for recovery, testing of recovery controls or legal requirements. If restored, applicable deletion instructions will be re-applied where technically appropriate.

44.3 Backup retention is: (BACKUP RETENTION PERIOD).

45. Legal holds and mandatory retention

Revient may retain Merchant Personal Data beyond an ordinary deletion date where necessary to comply with law, a binding legal process, a regulatory requirement, a litigation hold, or the establishment, exercise or defence of legal claims. Access to information retained solely for such a purpose will be restricted appropriately.

46. Sensitive and prohibited information

46.1 The Merchant must not use Revient to process special-category, criminal-offence, children's or other highly sensitive information unless the Processing is genuinely necessary, lawful and permitted by the Services.

46.2 The Merchant must not submit CVV/CVC values, authentication secrets or unnecessary complete payment-card credentials.

46.3 Revient may remove, quarantine or restrict prohibited or unnecessary information.

47. US state privacy Processor / Service Provider commitments

To the extent that an applicable US state privacy law treats Revient as a Processor, Service Provider or Contractor in relation to Merchant Personal Data, Revient will, to the extent required by that law:

• process the information only for the business purposes and Services specified in the Agreement or otherwise permitted by law;
• not sell or share Merchant Personal Data as those terms are defined by the applicable law merely by virtue of acting as the Merchant's Processor;
• not retain, use or disclose Merchant Personal Data outside the direct business relationship with the Merchant except as permitted by the Agreement or law;
• not combine Merchant Personal Data with personal information received from another person or collected from Revient's own interaction with an individual except where permitted by applicable law and consistent with the Services;
• provide the level of protection required by applicable law;
• assist with applicable consumer requests as required;
• notify the Merchant if Revient determines it can no longer meet an applicable contractual privacy obligation; and
• permit the Merchant to take reasonable and appropriate steps to stop and remediate unauthorised processing where required by applicable law.

Nothing in this section prevents Revient from processing information in its independent Controller capacity for purposes permitted by applicable law and disclosed in the Privacy Notice.

48. CCPA-specific contractual restrictions

Where Revient processes Merchant Personal Data as a Service Provider or Contractor under the California Consumer Privacy Act and implementing regulations, the parties agree that the Merchant discloses the information to Revient for the specific business purposes described in the Agreement and Schedule A.

Revient will not use that information outside those purposes except as permitted by California law and will not sell or share it for cross-context behavioural advertising while acting in that Service Provider or Contractor capacity.

The Merchant may monitor Revient's compliance through the audit and compliance-information mechanisms in this DPA.

49. AI/model providers as Subprocessors

If Revient sends Merchant Personal Data to an external AI/model provider while acting as Processor, that provider will be treated as a Subprocessor where applicable and listed in Schedule C.

Third-party providers are not authorised to train their own models on Merchant Personal Data. Under the Terms of Service clause 57.2, the Merchant instructs Revient to use de-identified Case data (customer names, email addresses, postal addresses, phone numbers, order numbers and identifiers removed) to train and improve Revient AI, including models Revient trains and hosts itself; data shared across Merchants is used only in a form from which no Merchant, customer or Case can be identified. Selected mailbox information is never used for training. (DPIA FOR REVIENT AI TRAINING — TO BE COMPLETED) The implemented OpenAI Responses requests use store: false; this does not establish zero retention or the account's contractual controls. Provider retention, processing locations, applicable transfer arrangements and executed agreements remain (AI PROVIDER ACCOUNT TERMS AND DATA CONTROLS — UNRESOLVED). API calls do not automatically retrain the model. See OpenAI data controls.

Selected Google Workspace information remains subject to the applicable use and transfer restrictions and verification requirements. It is excluded from shared learning; selected-message consent is an additional Revient control, not a substitute for provider-policy compliance. See Google Workspace user data policy.

50. Connected platforms are not automatically Subprocessors

A third-party commerce or email platform that the Merchant independently uses and instructs Revient to connect to is not necessarily a Revient Subprocessor merely because data flows through an integration.

The legal role of Shopify, Google, Microsoft, WooCommerce hosting providers, BigCommerce, Squarespace, Adobe or another connected platform depends on the actual relationship and processing activity.

Revient will describe such connected services accurately rather than classifying every integration as a Subprocessor.

51. Processor liability and statutory responsibility

Each party remains responsible for the legal obligations that applicable data-protection law imposes directly on it.

Nothing in this DPA relieves either party of statutory responsibility that cannot lawfully be transferred or excluded by contract.

Contractual liability between Revient and the Merchant remains subject to the liability provisions of the Agreement except to the extent Applicable Data Protection Law requires otherwise.

52. Conflict with the Terms

If this DPA conflicts with another part of the Agreement on the Processing of Merchant Personal Data in Revient's Processor capacity, this DPA prevails for that Processing unless a specifically negotiated data-protection agreement signed by Revient expressly supersedes it.

53. Changes to the DPA

Revient may update this DPA to reflect changes in the Services, Subprocessors or Applicable Data Protection Law.

Where an update materially reduces contractual data-protection protections applicable to Merchant Personal Data, Revient will provide reasonable notice and will not apply the reduction retrospectively to completed processing where prohibited by law.

Changes required to comply with mandatory law may take effect when reasonably necessary.

54. Duration of DPA obligations

The DPA applies for as long as Revient processes Merchant Personal Data as Processor and continues for any period during which Processor obligations remain applicable to retained Merchant Personal Data.

SCHEDULE A - PROCESSING DETAILS

A1. Subject matter

Provision of Revient's B2B post-chargeback Case-management, evidence-intelligence, workflow, integration, import, email-evidence and authorised routing functionality as configured and used by the Merchant.

A2. Duration

For the duration of the applicable Services and any lawful post-termination retention period described in the Agreement, Privacy Notice or Merchant instruction.

A3. Nature of Processing

Collection or receipt, recording, organisation, structuring, storage, retrieval, consultation, normalisation, comparison, analysis, matching, display, transmission on Merchant instruction, restriction, return, deletion and other operations reasonably required to provide the Services.

A4. Purposes

• host and manage Merchant Cases;
• import or receive authorised commerce records;
• organise and normalise Case Data;
• store and associate Evidence;
• perform deterministic evidence checks;
• perform Merchant-requested AI-assisted evidence assessment;
• conduct targeted Merchant-authorised mailbox evidence searches;
• support Merchant review and workflow;
• route Case Data where the Merchant has issued a valid release or standing instruction;
• provide reporting, status and audit functionality; and
• secure, support and maintain the Processor Services.

A5. Categories of Data Subjects

• Merchant customers and purchasers;
• delivery recipients;
• account holders associated with Merchant transactions;
• people who communicate with the Merchant about an order or dispute;
• Merchant employees or contractors where their information appears in Case records; and
• other individuals lawfully associated with a Merchant Case.

A6. Types of Personal Data

• names and Merchant customer identifiers;
• email addresses and telephone numbers;
• billing and shipping addresses;
• order IDs, numbers, dates, statuses and values;
• transaction references, payment authorisation results the source platform returns, and limited payment-method category, not the card number;
• Chargeback and dispute information;
• refund and return information;
• fulfilment, delivery and tracking information;
• Merchant/customer correspondence;
• Merchant notes;
• invoices, screenshots, PDFs and other Evidence;
• deterministic rule outputs and Evidence Engine assessments linked to the Case; and
• technical identifiers necessary to provide the Processor Services.

A7. Sensitive data

The Services are not intended to routinely process special-category or criminal-offence information. Such information may appear incidentally in correspondence or documents. The Merchant must minimise such information and ensure appropriate legal conditions where processing is necessary.

A8. Frequency

Continuous or recurring for active Services, connections and Cases, and event-driven when the Merchant imports data, triggers an assessment, authorises an integration, configures an automation or releases a Case.

A9. Merchant rights and obligations

The Merchant retains the Controller rights and obligations described in the Agreement, including the right to issue lawful instructions, receive compliance information, object to Subprocessors on reasonable data-protection grounds where applicable, request return/deletion and conduct audits subject to the DPA.

SCHEDULE B - TECHNICAL AND ORGANISATIONAL MEASURES

The following schedule must reflect Revient's production security implementation.

B1. Access control

• Role-based access control: separate merchant, partner and staff sign-in realms; merchant roles Owner, Admin, Finance and Member, partner member roles, and staff roles, all checked on the server for every page and action
• Workspace / tenant isolation: every record is scoped to its workspace or partner organisation and every query filters by that scope on the server; partners see only cases offered or assigned to them; cross-workspace access is covered by automated tests
• Privileged-access restrictions: staff access is by invitation only; high-risk staff actions (approvals, credentials, money) require a fresh authenticator code; every staff action is recorded in the audit log as a staff action
• Privileged-access review frequency: (PRIVILEGED ACCESS REVIEW FREQUENCY)
• Multi-factor authentication: authenticator (TOTP) two-step sign-in is enforced for all staff; optional for merchant and partner users
• Joiner/mover/leaver process: (ACCESS LIFECYCLE PROCESS)

B2. Authentication and credential security

• Password hashing or identity-provider implementation: passwords hashed with scrypt and a per-user salt; no third-party identity provider
• OAuth state / PKCE or equivalent controls where applicable: state parameter and PKCE (S256) on every mailbox connection; read-only scopes only; broader scopes returned by a provider are refused
• API credential storage: provider credentials and OAuth tokens are encrypted with AES-256-GCM under a versioned application master key before storage; secret values are never shown back in the admin console
• Credential rotation and revocation: (CREDENTIAL ROTATION PROCESS)
• Session controls: HttpOnly, Secure, SameSite=Lax session cookies; idle timeout of 1 hour for staff and 12 hours for merchants and partners; maximum session length of 1 day (staff), 14 days (partners) and 30 days (merchants)

B3. Encryption

• Data in transit: HTTPS only via the hosting provider's TLS termination (TLS 1.2 or higher), with HTTP Strict Transport Security (two years, including subdomains)
• Data at rest: (ENCRYPTION AT REST IMPLEMENTATION)
• Backup encryption: (BACKUP ENCRYPTION IMPLEMENTATION)
• Secret/key-management service: (KEY MANAGEMENT IMPLEMENTATION)

B4. Logging and monitoring

• Security/audit logging: append-only audit log in the application database recording actor, portal, action and time for case, money, approval, credential and role changes
• Monitoring provider/tools: hosting provider logs and metrics, application health checks and background-job diagnostics
• Alerting and incident escalation: (ALERTING PROCESS)
• Log access restrictions: (LOG ACCESS CONTROLS)
• Log retention: (SECURITY LOG RETENTION PERIOD)

Revient will not intentionally log access tokens, passwords, full email bodies or unnecessary customer personal information in ordinary application logs.

B5. Application and infrastructure security

• Secure development/code review: all changes are made through pull requests to a single main branch with automated checks; deployments never change the database schema, and schema changes are applied separately after review
• Dependency and vulnerability scanning: (DEPENDENCY / VULNERABILITY SCANNING)
• Patch management: (PATCHING PROCESS)
• Environment separation: (DEVELOPMENT / STAGING / PRODUCTION SEPARATION)
• Change/deployment controls: deployments are built from the reviewed main branch only; the start script refuses to run migrations or seeds; production switches for routing, sales, settlements and billing are separate configuration flags
• Network/security configuration: database, malware scanner and worker communicate over the hosting provider's private network; only the web application is exposed publicly; security headers (Content-Security-Policy, X-Frame-Options DENY, Referrer-Policy, Permissions-Policy) on every page
• Rate limiting/abuse prevention: (RATE LIMITING AND ABUSE CONTROLS)

B6. File and import security

• File type and size validation: allow-listed file types whose extension, declared type and file signature must agree; 10 MB default size limit; files stored privately and served only through short-lived, access-checked links
• Malware scanning: every upload is scanned by a self-hosted ClamAV service before it can be opened; files stay quarantined if the scanner is unavailable or the scan does not complete
• CSV formula-injection controls: cells beginning with =, +, -, @, tab or carriage return are neutralised on export so spreadsheet software does not run them as formulas
• Content sanitisation: all user and provider text is escaped when rendered in pages and emails

B7. Integration security

• OAuth credentials stored encrypted: OAuth tokens are encrypted with AES-256-GCM in the managed secret store and are cleared on disconnect
• Webhook signature validation: every inbound webhook (Stripe, Airwallex, Shopify, Ship24, AfterShip) is signature- or secret-verified before anything is stored
• Webhook idempotency/replay controls: each provider event id is stored once; repeated deliveries are recognised as duplicates; failed events are retried without being applied twice
• Least-privilege scopes: each integration requests read-only scopes; the Shopify scope list and the reason for each scope are documented in the integration registry
• Disconnect/revocation handling: disconnecting stops new reads immediately, cancels queued jobs, deletes stored tokens and asks the provider to revoke the grant

B8. Backups, availability and recovery

• Backup provider/location: (BACKUP PROVIDER / LOCATION)
• Backup frequency: (BACKUP FREQUENCY)
• Backup retention: (BACKUP RETENTION PERIOD)
• Restore test frequency: (RESTORE TEST FREQUENCY)
• Business continuity: (BUSINESS CONTINUITY ARRANGEMENTS)
• Disaster recovery: (DISASTER RECOVERY ARRANGEMENTS)

B9. Incident response

• Incident-response plan: (INCIDENT RESPONSE PROCESS)
• Personal-data breach escalation: (PRIVACY INCIDENT ESCALATION PROCESS)
• Contact responsible for privacy incidents: (INCIDENT / PRIVACY CONTACT)
• Post-incident review: (POST INCIDENT REVIEW PROCESS)

B10. Organisational controls

• Confidentiality obligations: (PERSONNEL CONFIDENTIALITY CONTROL)
• Security/privacy training: (TRAINING PROGRAMME)
• Supplier due diligence: (SUPPLIER SECURITY REVIEW PROCESS)
• Policy review frequency: (SECURITY / PRIVACY POLICY REVIEW FREQUENCY)

SCHEDULE C - SERVICE PROVIDERS AND SUBPROCESSORS

C1. DPA Subprocessor Register

Only providers that process Merchant Personal Data on Revient's behalf as Subprocessors should be listed in this table.

C2. Other material providers with independent or mixed roles

These organisations are not necessarily DPA Subprocessors for Merchant Case Data and are listed for transparency where relevant.

SCHEDULE D - INTERNATIONAL TRANSFER FRAMEWORK

D1. Revient establishment

Revient legal entity location: (REVIENT ESTABLISHMENT / COUNTRY)

Primary production hosting location(s): European Union (Railway region europe-west4, Netherlands)

Primary database location(s): European Union (Railway region europe-west4, Netherlands)

Primary Evidence/file storage location(s): (STORAGE LOCATIONS)

D2. UK transfers

For restricted transfers subject to UK data-protection law, the applicable mechanism will be identified per provider and may include:

• UK adequacy regulations;
• the UK International Data Transfer Agreement;
• the UK Addendum to EU Standard Contractual Clauses;
• an approved certification/code or other lawful safeguard; or
• another lawful transfer mechanism available under UK law.

Applicable UK transfer mechanism(s): (UK TRANSFER MECHANISMS BY PROVIDER)

D3. EEA transfers

For transfers subject to EU GDPR, the applicable mechanism may include:

• an EU adequacy decision;
• the applicable modules of the European Commission Standard Contractual Clauses;
• Binding Corporate Rules or another Article 46 mechanism; or
• another lawful transfer mechanism.

Applicable EEA transfer mechanism(s): (EU TRANSFER MECHANISMS BY PROVIDER)

D4. Supplementary measures / transfer review

Where a transfer mechanism requires additional assessment or safeguards, Revient will apply measures appropriate to the relevant provider and risk.

Transfer assessment owner: (TRANSFER COMPLIANCE OWNER)

Transfer review frequency: (TRANSFER REVIEW FREQUENCY)

SCHEDULE E - DATA PROTECTION CONTACTS

Revient privacy contact: (PRIVACY EMAIL)
Data Protection Officer: (DPO CONTACT DETAILS, IF REQUIRED)
Security incident contact: (INCIDENT / SECURITY CONTACT)
Merchant privacy requests: (PRIVACY EMAIL) / (PRIVACY RIGHTS PORTAL URL, IF USED)
Privacy complaints: (PRIVACY EMAIL) / (PRIVACY COMPLAINT FORM URL, IF USED)
EU representative: (EU REPRESENTATIVE DETAILS, IF REQUIRED)
Other regional representative: (OTHER REGIONAL REPRESENTATIVE DETAILS, IF REQUIRED)

55. Contact

Questions concerning this Data Protection & GDPR document or DPA may be sent to:

Revient / (COMPANY LEGAL NAME) LIMITED
Company number: (COMPANY REGISTRATION NUMBER)
Registered office: (REGISTERED OFFICE ADDRESS)
Privacy email: (PRIVACY EMAIL)
Legal email: (LEGAL EMAIL)
Website: (WEBSITE URL)

Draft implementation note — visual evidence processing

For authorized case-evidence instructions, selected CCTV clips may be stored privately and scanned; a description, selected interval and optional recording time accompany them. Where an evaluated visual runtime is approved and the merchant separately authorizes the selected processing, bounded sampled images are sent for draft observations. Complete video motion and audio are not analysed. No facial identification or automatic legal determination is authorized. Merchant-reviewed summaries are versioned. Original footage remains private unless the merchant explicitly shares the entire uploaded clip with a partner already authorized for that case. Future access can be revoked; downloaded copies cannot be technically recalled. Evidence-testing restrictions remain effective.

The merchant remains responsible for its instructions, lawful collection/sharing, minimization and appropriate notices. Production retention, approved subprocessors, international-transfer measures and contractual allocations remain subject to the unresolved draft schedules and review before launch. These implementation facts do not resolve those contractual choices or activate production readiness.

Draft implementation clarification — authorized automatic mailbox evidence

A separately recorded Workspace instruction may enable automatic discovery, retention and AI assessment of strong case-specific message matches. The current rule requires an exact case/order reference and matching customer participation without conflicting order references. Ambiguous matches require review. The instruction records the authorizing identity, mailbox, disclosure version and revocation. It does not authorize automatic attachments, staff raw-email access, customer contact or general model training. Authorization and access are checked again before retention and each AI attempt. Revocation stops future processing under that instruction without erasing previously retained evidence or undoing completed processing. These draft operational details do not resolve the outstanding contractual, retention or international-transfer placeholders elsewhere in this document.