Data Processing Addendum

Last updated: 2026-08-25

This Addendum forms part of the Terms of Service between the merchant (“Controller”) and Referally (“Processor”) and applies where Referally processes personal data on the Controller’s behalf — principally end-user attribution and conversion data.

1. Roles and scope

The Controller determines the purposes and means of processing end-user data; Referally processes it only on documented instructions, which include the Terms and use of the Service. For account data of the Controller’s own users, Referally acts as an independent controller under its Privacy Policy.

2. Processor obligations

• Process only on the Controller’s instructions and as required by law.

• Ensure personnel are bound by confidentiality.

• Implement appropriate technical and organizational security measures.

• Assist the Controller with data-subject requests and breach notification.

• Delete or return personal data at the end of the engagement, subject to legal retention.

3. Sub-processors

The Controller authorizes Referally to engage sub-processors (payout providers, email delivery, hosting) under written terms no less protective than this Addendum. We maintain a current list and provide notice of changes, allowing reasonable objection.

4. Security measures

Encryption in transit, tenant isolation via row-level security, least-privilege access, append-only financial audit trails, rate limiting and fraud controls, and centralized logging with secret redaction.

5. Data-subject requests

Referally provides tooling for export and erasure and will assist the Controller in responding to access, correction, deletion, and portability requests within the timelines the law requires.

6. International transfers

Where processing involves cross-border transfers, the parties rely on lawful transfer mechanisms (e.g., Standard Contractual Clauses) as applicable.

7. Audits

On reasonable notice and subject to confidentiality, Referally will make available information necessary to demonstrate compliance with this Addendum.

This document is a template provided for completeness. Have it reviewed by qualified counsel for your jurisdiction before relying on it.