TapRevView pricing

Data Processing Addendum

Data Processing Addendum (DPA)

This Data Processing Addendum ("DPA") forms part of the TapRev Terms & Conditions and applies to the extent TapRev processes personal data on behalf of a business customer ("Customer") in its role as a data processor.

This DPA was adapted from the General Legal CC0-licensed Data Processing Addendum template (https://github.com/General-Legal/legal-templates) and tailored to TapRev's actual operations.

1. Definitions

  • "Controller" means the Customer, who determines the purposes and means of processing personal data.
  • "Processor" means TapRev, who processes personal data on behalf of the Controller.
  • "Personal Data" means any information relating to an identified or identifiable natural person processed by TapRev in connection with the Service.
  • "Sub-processor" means a third party engaged by TapRev to assist in processing Personal Data.

2. Scope and Roles

TapRev acts as a Processor processing Personal Data on behalf of the Customer (Controller). The scope, purposes and duration of processing are described in the TapRev Privacy Policy, Terms & Conditions, and the Customer's plan or custom proposal.

3. Processing Instructions

TapRev will process Personal Data only on documented instructions from the Customer, including with regard to transfers of Personal Data to a third country or international organisation, unless required to do so by applicable law. TapRev will not process Personal Data for its own purposes.

4. Data Subject Rights

TapRev will assist the Customer in fulfilling its obligations to respond to data subject rights requests (access, rectification, erasure, restriction, portability, objection). The Customer is responsible for verifying the identity of the data subject and determining the response.

5. Security Measures

TapRev implements appropriate technical and organisational security measures including:

  • Encrypted data transmission (TLS/HTTPS).
  • Hashed passwords and secure token-based authentication.
  • Row-level security (RLS) enforcing tenant isolation.
  • Server-side validation and permission checks.
  • Private file storage for uploaded content.
  • Rate limiting on public endpoints.
  • Access controls limiting data access to authorised personnel.

6. Sub-processors

TapRev engages the following categories of sub-processors:

  • Cloud hosting provider — data storage and compute infrastructure.
  • Email delivery provider — transactional email delivery.
  • Payment provider (Stripe) — subscription billing.
  • AI provider — AI assistant chat and image analysis.

TapRev requires all sub-processors to provide sufficient guarantees of data protection and to process Personal Data only on TapRev's instructions.

7. International Transfers

TapRev may transfer Personal Data to sub-processors located outside the EEA. Such transfers are subject to appropriate safeguards, including standard contractual clauses or other valid transfer mechanisms under applicable data protection law.

8. Data Breach Notification

TapRev will notify the Customer without undue delay after becoming aware of a personal data breach. TapRev will provide reasonable information to help the Customer meet its own breach notification obligations.

9. Data Return and Deletion

Upon termination of the Service, TapRev will return or delete Personal Data at the Customer's choice, subject to any legal retention obligations. Default retention is 90 days for recovery purposes, after which data is permanently deleted.

10. Audit Rights

The Customer may audit TapRev's compliance with this DPA, subject to reasonable notice and confidentiality obligations. TapRev will provide reasonable cooperation and access to relevant documentation.

11. Contact

For questions about this DPA, contact us at:

  • Email: taprevshop@gmail.com
  • Phone: +356 7901 9591

Last updated: October 2026

This DPA was adapted from the General Legal CC0-licensed Data Processing Addendum (Global) template and tailored to TapRev's actual operations. It is a drafting resource, not a guarantee of compliance. Jurisdiction-specific clauses may require professional legal review.