Data Processing Addendum

What changed since edition 2

7 lines added, 7 removed

1. Last updated: 2026-10-21
2. −Removed: This Addendum forms part of the Terms of Service between the merchant (“Controller”) and Referally (“Processor”) and applies where Referally processes personal data on the Controller’s behalf — principally end-user attribution and conversion data.
3. +Added: This Addendum forms part of the Terms of Service between the merchant (“Controller”) and Referalli (“Processor”) and applies where Referalli processes personal data on the Controller’s behalf — principally end-user attribution and conversion data.
4. 1. Roles and scope
5. −Removed: The Controller determines the purposes and means of processing end-user data; Referally processes it only on documented instructions, which include the Terms and use of the Service. For account data of the Controller’s own users, Referally acts as an independent controller under its Privacy Policy.
6. +Added: The Controller determines the purposes and means of processing end-user data; Referalli processes it only on documented instructions, which include the Terms and use of the Service. For account data of the Controller’s own users, Referalli acts as an independent controller under its Privacy Policy.
7. 2. Processor obligations
8. Process only on the Controller’s instructions and as required by law.
9. ⋯
10. Delete or return personal data at the end of the engagement, subject to legal retention.
11. 3. Sub-processors
12. −Removed: The Controller authorizes Referally to engage the following sub-processors, under written terms no less protective than this Addendum:
13. +Added: The Controller authorizes Referalli to engage the following sub-processors, under written terms no less protective than this Addendum:
14. Sub-processor
15. Purpose
16. ⋯
17. Transactional and notification email
18. The current list is kept in our Privacy Policy. We will give notice of new sub-processors and allow reasonable objection.
19. −Removed: Billing, payout, and AI providers that the Controller connects with its own account (for example Stripe, PayPal, Wise, Payoneer, or Tremendous) are engaged by the Controller, not by Referally, and are not Referally’s sub-processors. Referally sends them only the data needed to carry out the Controller’s instructions, such as a payout amount and the partner’s payout details.
20. +Added: Billing, payout, and AI providers that the Controller connects with its own account (for example Stripe, PayPal, Wise, Payoneer, or Tremendous) are engaged by the Controller, not by Referalli, and are not Referalli’s sub-processors. Referalli sends them only the data needed to carry out the Controller’s instructions, such as a payout amount and the partner’s payout details.
21. 4. Security measures
22. −Removed: Encryption in transit, delegated authentication with passkey and two-factor support (no passwords stored by Referally), tenant isolation via row-level security, least-privilege access, append-only financial audit trails, rate limiting and fraud controls, and centralized logging with secret redaction.
23. +Added: Encryption in transit, delegated authentication with passkey and two-factor support (no passwords stored by Referalli), tenant isolation via row-level security, least-privilege access, append-only financial audit trails, rate limiting and fraud controls, and centralized logging with secret redaction.
24. 5. Data-subject requests
25. −Removed: Referally provides tooling for export and erasure and will assist the Controller in responding to access, correction, deletion, and portability requests within the timelines the law requires.
26. +Added: Referalli provides tooling for export and erasure and will assist the Controller in responding to access, correction, deletion, and portability requests within the timelines the law requires.
27. 6. International transfers
28. Where processing involves cross-border transfers, the parties rely on lawful transfer mechanisms (e.g., Standard Contractual Clauses) as applicable.
29. 7. Audits
30. −Removed: On reasonable notice and subject to confidentiality, Referally will make available information necessary to demonstrate compliance with this Addendum.
31. +Added: On reasonable notice and subject to confidentiality, Referalli will make available information necessary to demonstrate compliance with this Addendum.
32. This document is a template provided for completeness. Have it reviewed by qualified counsel for your jurisdiction before relying on it.