Data Processing Addendum

For data you provide to Revcore Pro about your own customers, you are the data controller and Revcore Pro is the data processor.

We process that data only on your documented instructions, except where we are required to act otherwise by applicable law.

We use a short list of subprocessors to operate the platform, published at /subprocessors.

We will provide at least 30 days notice before adding or replacing a subprocessor, and you have the right to object on reasonable grounds.

Each subprocessor is contractually bound to data protection obligations equivalent to those in this DPA, and we remain responsible to you for their performance.

We implement the technical and organizational measures described on our security page, including encryption in transit and at rest, row-level security on tenant data, audit logging, and least-privilege access controls.

Our backend runs on Supabase and payments are processed through Stripe, both of which maintain their own security and compliance programs.

We will notify you without undue delay, and in any event within 72 hours, of becoming aware of a personal data breach affecting your data.

Our notice will include the information available at the time, with further updates as our investigation continues.

We will assist you in responding to data subject requests, including access, correction, deletion, and portability.

You can fulfill most requests using the tools within Revcore Pro, or you can send documented requests to privacy@revcorepro.com.

Where personal data is transferred from the EEA, the UK, or Switzerland to a country without an adequacy decision, the EU Standard Contractual Clauses, and the UK addendum where applicable, are incorporated by reference into this DPA.

On reasonable advance written notice, and no more than once per year except after a confirmed incident, you may request a summary of our most recent security audit and reasonably scoped information about our processing activities.

To request a countersigned copy, email legal@revcorepro.com with your business name, the scope of processing, and a contact for your data protection officer or equivalent.