Data processing agreement

• Subjects: the controller’s customers who open an offer page.
• Data: Stripe customer and subscription identifiers and plan details; reasons and comments; offers shown and confirmations given; on the feedback-only page, email address, IP address and browser type.
• Purpose: running the offer page, applying confirmed billing changes through the controller’s Stripe account, and reporting outcomes to the controller.
• Duration: for as long as the controller’s account is open, then as set out in section 7.

Reoffer processes this data only on the controller’s documented instructions, which are the controller’s settings in Reoffer and these terms. If an instruction appears to break data protection law, Reoffer will say so.

Anyone at Reoffer with access to this data is bound by a duty of confidentiality and sees only what their role needs.

• Encryption in transit (HTTPS) and at rest by our hosting and database providers.
• One-way hashing of session tokens and API keys; secrets held only on the server.
• Database rules that separate each controller’s data, and least-privilege access for staff.
• Signature checks on every Stripe webhook and an audit trail of billing actions that cannot be edited.
• Rate limits and abuse controls on public endpoints.

The controller authorises the subprocessors listed on the subprocessors page. Reoffer will give at least 30 days’ notice by email before adding or replacing one, and the controller may object on reasonable data-protection grounds. Reoffer remains responsible for its subprocessors.

• Reoffer will help the controller answer data subject requests and data protection impact assessments, as far as the service allows.
• Reoffer will notify the controller without undue delay, and within 72 hours of confirming a personal data breach, with the information it has.

When the controller closes their account, Reoffer deletes the controller’s customer data within 30 days, unless the law requires it to be kept. The controller can export session data as CSV from the dashboard before closing.

Reoffer will make available the information reasonably needed to show compliance with this agreement. Data is stored in [to complete: data storage region]. Where data leaves the controller’s region, the transfer relies on the safeguards offered by each subprocessor, such as standard contractual clauses.