Data processing agreement

• GDPR means the EU General Data Protection Regulation.
• Personal data, processing, controller, processor, sub-processor, data subject and personal data breach have the meanings set out in the GDPR.
• Operator Data means personal data processed by Reesure on the Operator's behalf via the Platform.
• Sub-processor means any third party engaged by Reesure to process Operator Data.

Reesure processes Operator Data only on documented instructions from the Operator, as set out in this DPA, the Terms of Service and the Operator's configured use of the Platform.

If Reesure is required to process Operator Data for any other purpose under EU or Member State law, it will inform the Operator beforehand unless that law prohibits such notice.

Reesure ensures that personnel authorised to process Operator Data are bound by appropriate confidentiality obligations (contractual or statutory) and that access is limited to what is needed to perform the contract.

• AES-256 encryption at rest; TLS 1.2+ in transit
• Multi-factor authentication for administrative access
• Role-based access with least-privilege
• Daily encrypted backups with off-site replication
• Quarterly vulnerability scans and annual external penetration testing
• API rate-limiting and automated anomaly detection
• Logging and monitoring of administrative access

Measures may evolve over time; current measures are also summarised in §7 of the Privacy Policy.

• Reesure has a written contract with each sub-processor imposing data protection obligations no less protective than this DPA.
• Reesure will notify the Operator of any intended addition or replacement of a sub-processor at least 30 days in advance, by email or by updating Annex A.
• The Operator may object on reasonable grounds related to data protection during that period. If the parties cannot agree on a solution, the Operator's sole remedy is to terminate the Client Agreement as a whole, without penalty for the unused portion of pre-paid fees.
• Reesure remains responsible for the performance of its sub-processors.

Where technically feasible, Reesure will assist the Operator in responding to requests from data subjects to exercise their rights under Articles 12–22 of the GDPR.

Data subjects should contact the Operator (as controller) in the first instance. If a data subject contacts Reesure directly, Reesure will forward the request to the Operator and not respond on the Operator's behalf unless instructed to do so.

Reesure will notify the Operator of any personal data breach affecting Operator Data without undue delay after becoming aware, and where feasible within 48 hours. The notification will include the information set out in Article 33(3) of the GDPR to the extent known.

Reesure will assist the Operator in fulfilling its breach notification obligations to supervisory authorities and data subjects.

• the EU Standard Contractual Clauses (Commission Decision 2021/914) as supplemented by appropriate safeguards; or
• an adequacy decision under Article 45 of the GDPR.

Details of the transfer mechanism for each sub-processor are in Annex A.

Note: Stripe Payments Europe Ltd. is based in Dublin (EEA) and processes EU payments via its EEA entity. The only sub-processors that may process data outside the EEA today are SendGrid (transactional email relay) and HubSpot (CRM, internal use), both under EU SCCs.

• return Operator Data in a structured, machine-readable format (CSV/JSON); or
• delete Operator Data,

within a reasonable period, unless retention is required by EU or Member State law. If the Operator has not specified a preference within 30 days of termination, Reesure will delete Operator Data. Where retention is required (e.g. Dutch bookkeeping obligations of up to 7 years, or 10 years for immovable-property records), Reesure will continue to apply this DPA to the retained data.

• this DPA and any updates;
• summary reports of relevant certifications and audits (when available); and
• responses to reasonable written security questionnaires.

The Operator may, no more than once per year and on reasonable prior notice, request an on-site audit limited to data protection matters. Costs are borne by the Operator unless the audit reveals material non-compliance. Audits must be conducted in a manner that does not disrupt operations or compromise other Operators' data.

Each party's liability under this DPA is subject to the limitations set out in the Terms of Service and any Client Agreement.

This DPA is governed by Dutch law. Disputes are subject to the exclusive jurisdiction of the courts of Amsterdam, Netherlands.

In case of conflict on data protection matters, this DPA prevails over the Terms of Service and any other agreement, except an explicit, signed Client Agreement that expressly amends this DPA.

The current sub-processor list is published on this page. Updates are notified per §7.

See §6 above.