Data Processing Addendum
Last updated · Edition 3
Last updated: 2026-10-21
This Addendum forms part of the Terms of Service between the merchant (“Controller”) and Referalli (“Processor”) and applies where Referalli processes personal data on the Controller’s behalf — principally end-user attribution and conversion data.
1. Roles and scope
The Controller determines the purposes and means of processing end-user data; Referalli processes it only on documented instructions, which include the Terms and use of the Service. For account data of the Controller’s own users, Referalli acts as an independent controller under its Privacy Policy.
2. Processor obligations
Process only on the Controller’s instructions and as required by law.
Ensure personnel are bound by confidentiality.
Implement appropriate technical and organizational security measures.
Assist the Controller with data-subject requests and breach notification.
Delete or return personal data at the end of the engagement, subject to legal retention.
3. Sub-processors
The Controller authorizes Referalli to engage the following sub-processors, under written terms no less protective than this Addendum:
Sub-processor | Purpose |
|---|---|
Atlas | Authentication of the Controller’s users and partners |
Forumulate | Hosting of documentation, community, and status pages |
Cloud hosting provider | Servers and database that run the Service |
Email delivery provider | Transactional and notification email |
The current list is kept in our Privacy Policy. We will give notice of new sub-processors and allow reasonable objection.
Billing, payout, and AI providers that the Controller connects with its own account (for example Stripe, PayPal, Wise, Payoneer, or Tremendous) are engaged by the Controller, not by Referalli, and are not Referalli’s sub-processors. Referalli sends them only the data needed to carry out the Controller’s instructions, such as a payout amount and the partner’s payout details.
4. Security measures
Encryption in transit, delegated authentication with passkey and two-factor support (no passwords stored by Referalli), tenant isolation via row-level security, least-privilege access, append-only financial audit trails, rate limiting and fraud controls, and centralized logging with secret redaction.
5. Data-subject requests
Referalli provides tooling for export and erasure and will assist the Controller in responding to access, correction, deletion, and portability requests within the timelines the law requires.
6. International transfers
Where processing involves cross-border transfers, the parties rely on lawful transfer mechanisms (e.g., Standard Contractual Clauses) as applicable.
7. Audits
On reasonable notice and subject to confidentiality, Referalli will make available information necessary to demonstrate compliance with this Addendum.
This document is a template provided for completeness. Have it reviewed by qualified counsel for your jurisdiction before relying on it.