Legal
Data Processing Addendum
Last updated 13 October 2026
Scope
This addendum applies when Rezule processes personal data on behalf of a customer (the controller) in providing the service, and forms part of the Terms of Service. Where the EU GDPR or UK GDPR applies to a transfer of personal data out of the EU or UK, the EU Standard Contractual Clauses (Module 2, controller to processor) and the UK International Data Transfer Addendum are incorporated by reference, with the details in this addendum completing their annexes.
Processing details
| Item | Detail |
|---|---|
| Subject matter | Providing the Rezule service |
| Duration | The term of the agreement, then deletion as described below |
| Nature and purpose | Hosting, drafting with AI on request, review, publishing, collecting replies and statistics, notifications, exports |
| Personal data | Names, email addresses, social media handles and public profile data, the content of posts, comments and messages, usage data |
| Data subjects | The customer's users and reviewers, and people who interact with the customer's social accounts |
Our commitments
- Process personal data only on the customer's documented instructions, including these terms and the customer's use of the service.
- Keep people with access bound by confidentiality.
- Apply the security measures described on the Trust page: encryption in transit and at rest with per-workspace keys, tenant isolation in the database, access control, monitoring and incident response.
- Use subprocessors only as listed on the Subprocessors page, under equivalent obligations, and give 30 days' notice before adding one, during which the customer may object.
- Help the customer answer data subject requests; the export and deletion tools in the product cover most of them.
- Notify the customer of a personal data breach without undue delay, and no later than 48 hours after becoming aware of it, with what is known.
- At the end of the service, delete the customer's personal data (after a 30-day export window) unless the law requires keeping it.
- Make available the information needed to show compliance, and allow audits under reasonable conditions.
Data location and transfers
The customer chooses the US or EU region for its organization's data at creation. Transfers outside the region (for example to an AI provider) are covered by the Standard Contractual Clauses or another lawful mechanism.