Data Processing Agreement

Effective August 28, 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Revotech OÜ (registry code 17332344, Estonia) ("Processor", "we") and the Merchant that installs Salesreach on their Shopify store ("Controller", "you"), and applies whenever we process personal data about your Customers on your behalf and instructions, as described in our Privacy Policy.

1. Roles

For personal data about your Customers, you are the data controller and we are the data processor / service provider. For data about your own Merchant account, we are the controller — that data isn't covered by this DPA.

2. Subject matter and duration

Subject matter: providing the Salesreach AI sales agent service described in the Terms of Service. Duration: for as long as Salesreach is installed on your store, plus the retention/deletion windows described in Section 4 of the Privacy Policy.

3. Nature and purpose of processing

Receiving, storing, and generating conversational messages with your Customers over SMS/WhatsApp; creating and tracking single-use discount codes; attributing paid orders to the agent conversations that produced them; and the other purposes listed in Section 2 of the Privacy Policy.

4. Categories of data and data subjects

Data subjects: your store's Customers. Categories of data: name, email, phone number, shipping/billing address, order history, and message transcripts with the AI agent — see Privacy Policy Section 1 for the full breakdown by source.

5. Your instructions

We process Customer personal data only on your documented instructions — namely, the configuration you set in the app (discount policy, active personas, flow plans) and the standard functionality of the Service. We will notify you if we believe an instruction violates applicable data protection law.

6. Our obligations as processor

We ensure personnel authorized to process Customer data are bound by confidentiality obligations.
We implement the technical and organizational security measures described in our Security & Incident Response page, including encryption in transit and at rest, access-restricted internal tooling, and logged access to protected customer data.
We will not engage a new sub-processor without providing notice, giving you the opportunity to object. Our current sub-processors are listed in Privacy Policy Section 3.
We assist you, to the extent reasonably possible, in responding to Customer requests to exercise their data protection rights, and in fulfilling Shopify's customers/data_request and customers/redact compliance webhooks.
We notify you without undue delay after becoming aware of a personal data breach affecting your Customers' data, per our Security & Incident Response policy.
On termination (uninstall), we delete Customer personal data per the retention schedule in Privacy Policy Section 4, rather than returning it, since it has no further use once the store is disconnected.

7. International transfers

Where a sub-processor operates outside the EEA/UK, we rely on that provider's own data-protection commitments (such as Standard Contractual Clauses), consistent with Privacy Policy Section 6.

8. Audit

On reasonable written request, we will provide information reasonably necessary to demonstrate compliance with this DPA.

9. Liability

Liability under this DPA is subject to the limitation of liability set out in the Terms of Service.

10. Contact us

Revotech OÜ, registry code 17332344, Estonia.
Email: support@salesreach.net