GapLap Data Processing Agreement

1.1 "Applicable Data Protection Law" means the EU GDPR (Regulation (EU) 2016/679), relevant Cypriot implementing legislation and other mandatory data-protection laws applicable to a particular processing operation. "Customer Personal Data" means personal data contained in, or processed on Customer’s documented instructions in relation to, User Content within the Services. "Personal Data Breach", "Controller", "Processor", "Sub-processor", "Processing" and "Data Subject" have the meanings in the GDPR.

1.2 "User Content" and "Subscriber" have the meanings in the Terms. Schedule 1 describes the processing; Schedule 2 describes technical and organisational security measures; Schedule 3 identifies the Sub-processor register and authorisation arrangements; Schedule 4 describes approved instructions and relevant constraints. The Schedules are integral to this DPA.

1.3 This DPA prevails over the Terms only in the event of a direct conflict concerning the processing of Customer Personal Data on Customer’s behalf. It does not alter agreed subscription prices, cancellation deadlines or other commercial terms except where required by mandatory law. No provision limits data-subject rights or legally non-excludable duties under data-protection law.

2.1 The Customer determines the purposes and essential means of processing Customer Personal Data and acts as Controller, unless it lawfully acts as Processor for another Controller. In the latter case, Zorevia acts as Sub-processor and Customer warrants that it has the underlying Controller’s authorisation and documented instructions permitting the appointment and onward processing. Zorevia is Processor or Sub-processor only for Customer Personal Data.

2.2 Customer shall establish and maintain a lawful basis, give required notices, manage applicable consent and data-subject rights, minimise content and ensure that the uploaded campaign materials and media links can lawfully be processed. Customer shall not provide special-category data, criminal-offence data, credentials, full card details, minors’ data or other prohibited high-risk data contrary to the Terms, unless the parties separately agree in writing on additional safeguards and the Services are capable of supporting them.

2.3 Zorevia’s processing as independent Controller of business contacts, accounts, security records, invoices, payment events and general support communications is outside this DPA and is governed by the Privacy Policy and applicable provider arrangements. Merely naming a supplier in the Privacy Policy does not make it a Sub-processor for Customer Personal Data.

3.1 Zorevia shall process Customer Personal Data only on documented instructions from Customer, including as set out in the Terms, this DPA, the selected Service configuration, authorised user actions and written instructions consistent with the Services; and only insofar as necessary to provide the requested functionality, prevent misuse, provide instructed support and protect the Services. Processing outside those instructions requires further written agreement or a binding law requirement.

3.2 Where Union or Member State law requires other processing, Zorevia shall inform Customer before processing unless that law prohibits notice for important public-interest reasons. Zorevia shall immediately inform Customer if, in its opinion, an instruction infringes Applicable Data Protection Law and may suspend the affected instruction pending resolution, to the extent lawful.

3.3 Optional AI features are invoked by an Authorised User. Depending on the feature, the request may transmit selected campaign text, supporting technical instructions and, for a JSON-fix operation, the entire submitted RCS JSON through the Lovable AI Gateway to a downstream Google Gemini model. The Customer shall not send Customer Personal Data to these optional AI features under the standard subscription; names, recipients, telephone numbers, email addresses and other identifying data must first be removed or appropriately anonymised. Zorevia applies bounded, pre-charge automated screening intended to detect certain obvious identifiers. Such screening is an additional precaution, not a guarantee that every identifier will be detected, nor a substitute for the Customer’s duty to minimise and lawfully control its inputs. The availability, data-use, location and retention terms of independent AI providers are governed by the applicable service agreements and relevant Data Protection Law. Zorevia does not use User Content to train its own AI models.

4.1 Zorevia shall restrict access to Customer Personal Data to authorised personnel and approved Sub-processors with a demonstrated need for the requested Services, support or security. Zorevia shall ensure persons acting under its authority are bound by confidentiality obligations or an appropriate statutory duty and receive suitable privacy/security instructions.

4.2 Zorevia shall not sell Customer Personal Data, use it for targeted advertising, reuse it to train its own models or independently exploit the substance of the Customer’s campaigns. It shall not disclose Customer Personal Data to unauthorised parties except as instructed, permitted by this DPA or required by law.

5.1 Taking account of the state of the art, implementation cost, nature, scope, context and purposes of processing, and risk to individuals, Zorevia shall implement and maintain appropriate technical and organisational measures meeting Article 32 GDPR. The minimum control objectives and the currently described product architecture are set out in Schedule 2. Zorevia shall review their effectiveness and make appropriate improvements as threats and the Services evolve.

5.2 Customer remains responsible for its own devices, credentials, access authorisations and instructions, including the sensitivity and lawfulness of User Content and external campaign/media URLs. Zorevia remains responsible for its own processing operations and approved Sub-processors; the Customer’s duties do not displace Zorevia’s statutory processor obligations.

6.1 Customer grants general written authorisation for Sub-processors expressly identified in the completed Schedule 3 or a subsequently notified version of the register, solely for the specified processing services. Before adding or replacing a Sub-processor that will process Customer Personal Data, Zorevia shall provide reasonable advance written notice (normally at least 30 calendar days) including the proposed entity, service function and relevant processing location, and shall give Customer a meaningful opportunity to object on documented data-protection grounds.

6.2 Customer may object within 15 calendar days of that notice. The parties shall discuss reasonable alternatives in good faith. Zorevia shall not disclose Customer Personal Data to an objected-to new Sub-processor while an unresolved, valid objection makes the processing unlawful. If no legally acceptable alternative exists, affected processing must cease; any contractual remedy is subject to the Terms and mandatory law. The parties shall document material changes to the register and authorisation.

6.3 Zorevia shall impose on each Sub-processor by written contract obligations equivalent in substance to the data-protection obligations of this DPA, particularly appropriate security measures. Zorevia shall remain fully liable to Customer for performance of the Sub-processor’s data-protection obligations under Article 28(4) GDPR. Sub-processors must be selected and monitored with due care.

7.1 Zorevia shall not transfer Customer Personal Data outside the EEA, or authorise an onward transfer subject to Chapter V GDPR, without a valid applicable transfer mechanism and necessary supplementary measures. Appropriate mechanisms may include an adequacy decision, the legally applicable EU standard contractual clauses for international transfers under Implementing Decision (EU) 2021/914, or another lawful route where its conditions are satisfied.

7.2 The Article 28 processor-contract standard clauses under Implementing Decision (EU) 2021/915, which may inform this DPA, do not by themselves legalise a Chapter V international transfer. Any applicable transfer modules, appendices and transfer assessments must be completed separately with the actual exporter/importer; this DPA does not falsely claim that such instruments have been signed with every vendor.

7.3 The main database infrastructure for the Service is configured in Frankfurt, Germany. Hosting in the EEA does not prevent limited support, gateway processing or access by approved suppliers in other jurisdictions. The relevant transfers and safeguards must be identified in the applicable supplier arrangements and maintained in the current Sub-processor register.

8.1 Taking account of the nature of processing and information available, Zorevia shall assist Customer through appropriate technical and organisational measures with requests for access, rectification, erasure, restriction, portability, objection and other applicable rights concerning Customer Personal Data. Where possible, Customer should use the Services’ self-service export or deletion features.

8.2 If a data subject contacts Zorevia directly in relation to Customer Personal Data for which Customer is Controller, Zorevia shall, unless legally prohibited, direct the request to Customer without determining its merits independently and provide reasonable assistance. It shall not disclose data to the requester without Customer instruction or legal requirement.

9.1 Zorevia shall notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data. The notice shall include reasonably available facts concerning its nature, categories and approximate number of affected individuals and records (if known), likely consequences, measures taken or proposed, and a suitable contact point. Information not initially available may be supplied in phases without undue further delay.

9.2 Zorevia shall cooperate with Customer’s assessment, mitigation, evidence preservation and reporting obligations under Articles 33 and 34 GDPR. Customer, where Controller, remains responsible for decisions on notification to supervisory authorities or data subjects, unless mandatory law otherwise requires. Zorevia shall not notify affected individuals on Customer’s behalf except on instruction or legal requirement.

10.1 Taking account of processing and available information, Zorevia shall reasonably assist Customer with security, data-protection impact assessments and prior consultation with the competent supervisory authority under Articles 32–36 GDPR. Additional extraordinary assistance and cost arrangements, if any, must not frustrate Customer’s mandatory GDPR rights.

10.2 Zorevia shall make available information reasonably necessary to demonstrate compliance with Article 28 GDPR, including relevant policies, measures and Sub-processor information, subject to lawful confidentiality restrictions and security safeguards. It shall inform Customer without undue delay of a material change that affects compliance with this DPA.

11.1 Zorevia shall allow for and contribute to audits and inspections by Customer or an auditor mandated by Customer, as required by Article 28(3)(h) GDPR. The parties shall first use proportionate evidence such as current policies, security summaries or independent reports where available; no specific certification or audit report is represented as currently held unless separately supplied.

11.2 Audits shall be carried out at reasonable intervals, on reasonable prior notice where practicable, during normal business hours, subject to confidentiality and safety, without unjustified disruption or access to another customer’s data. A competent regulator or an incident involving material risk may justify shorter notice or additional review. Audit logistics and ordinary external costs shall be agreed reasonably and shall not negate the statutory audit right.

12.1 At the end of processing on Customer’s behalf, at Customer’s choice, Zorevia shall return or delete Customer Personal Data, unless retention is required by Union or Member State law. The Customer should export available project data before the subscribed access period ends. If the Customer requires an alternative technically feasible return method, the parties shall coordinate it securely.

12.2 The original file used only for immediate validation or transformation is not retained as a separate independent original after completion. Customer-directed drafts, projects, QR previews and uploaded sender logos may remain as active data for the purposes and periods described in the Privacy Policy. Following confirmed account closure, active-system copies of Customer Personal Data will be deleted as promptly as reasonably practicable and, in any case, within the applicable maximum period disclosed in the Privacy Policy, except where lawful retention is required. Account closure includes eligible, account-scoped deletion of temporary logo objects through the Storage API. Expiration of a link or access token does not itself constitute deletion of the underlying content. Backup copies are protected from routine access and expire through the actual vendor-managed backup rotation cycle applicable to the contracted environment; no fixed backup expiration period or point-in-time recovery entitlement is guaranteed by this DPA unless expressly stated in a separately verified service schedule.

12.3 Local browser storage is distinct from Zorevia’s server-held data. The Customer and its Authorised Users control their own devices and may need to clear local browser data through appropriate device or browser functions. Where retention is required by law, Zorevia shall restrict the retained material to the relevant lawful purpose and protect it against use for incompatible purposes.

13.1 User-selected third-party media links, preview URLs or remote resources may cause a recipient’s browser to contact domains chosen by the Customer or present in the campaign. These recipients are not necessarily Sub-processors appointed by Zorevia and are subject to their own policies and the Customer’s content and notice obligations. Zorevia must not treat customer-initiated public URLs as a blanket waiver of its own data-protection duties.

13.2 The Services perform pre-delivery campaign assurance and do not transmit live RCS messages. Account authentication, hosted fonts, payment checkout and communications services may involve distinct Controller/Processor roles, to be described in the Privacy and Cookie Policies as applicable.

14.1 This DPA applies from valid acceptance for the duration of processing on Customer’s behalf, and thereafter for the time needed to fulfil deletion, confidentiality, audit-cooperation and other surviving statutory obligations. Any amendments must be made in writing or by a valid, recorded electronic process with adequate notice where required; a change in a website alone does not retroactively establish Customer acceptance of materially different processing terms.

14.2 Subject to mandatory applicable laws and non-waivable rights, the law and competent courts identified in the Terms govern this DPA. This clause does not alter supervisory-authority competence or data subjects’ rights under the GDPR.

14.3 This is a bespoke contract intended to meet Article 28(3) GDPR. It is not presented as the unchanged European Commission Article 28 standard clauses under Decision (EU) 2021/915, nor as an executed international-transfer agreement under Decision (EU) 2021/914. Any Chapter V transfer arrangements are additional to this DPA. The English-language DPA is the authoritative version; translations are provided for convenience unless mandatory law or an express written agreement requires otherwise.