1. Roles
You are the data controller for personal data of your customers and affiliates. Rekomi, operated by Uplup Inc., is the data processor. Each party complies with applicable data protection law.
2. Scope of processing
Rekomi processes personal data only on documented instructions from you, except as required by law. Personal data covered: affiliate names, emails, addresses, tax forms, payout history; customer email or hashed identifier when used for attribution; fraud signals on clicks and forms (hashed IP, user agent, device fingerprint, and risk scores); lead data submitted through CPL lead forms; the content of messages exchanged between you and your affiliates on the platform; creator profile text and connected social account statistics shown to you; Shopify protected customer data received through our Shopify app; and historical affiliate, conversion, commission, and customer-attribution records (including customer emails and Stripe customer/subscription identifiers) that you import from a previous affiliate platform. Rekomi is an independent controller, not your processor, for the account data of your own brand users and for affiliates’ direct relationship with Rekomi (their Rekomi account, profile, and payout identity), as described in our Privacy Policy.
3. Sub-processors
Rekomi uses sub-processors listed at /legal/subprocessors. We post additions to /legal/subprocessors with the Updated date and email organization owners at least 30 days before a new sub-processor processes Customer personal data, except where a change is needed urgently for security or continuity, in which case we notify as soon as practicable. You may object to a new sub-processor; if we cannot reasonably accommodate the objection, you may terminate the affected service.
4. Security measures
Multi-tenant row-level security, encryption at rest (AES-256) and in transit (TLS 1.3), signed webhooks, and audit logging. Detailed security model at /security.
5. International transfers
Personal data may be processed in the United States by sub-processors. Where required by EU, UK, or Swiss law, we rely on the Standard Contractual Clauses (SCCs) for EU data, the UK International Data Transfer Addendum for UK data, and the SCCs with the Swiss adaptations described below for Swiss data, with sub-processors handling EU, UK, or Swiss personal data.
Swiss adaptations. For transfers subject to the Swiss Federal Act on Data Protection (FADP), the SCCs apply with the adaptations recognised by the Swiss Federal Data Protection and Information Commissioner (FDPIC): the FDPIC is the competent supervisory authority under Clause 13 insofar as the transfer is governed by the FADP; references to the GDPR are read as references to the FADP, and references to a Member State or the European Union are read as including Switzerland, so that data subjects in Switzerland may enforce their rights and bring claims in Switzerland under Clause 18; and where a transfer is subject exclusively to the FADP, the SCCs are governed by Swiss law under Clause 17. Where a transfer is subject to both the GDPR and the FADP, the SCCs apply as adopted by the European Commission, with these adaptations applying in parallel to the Swiss data.
6. Personal data breach notification
Rekomi notifies you without undue delay and no later than 72 hours after we confirm a personal data breach affecting your personal data, including the nature of the breach, affected categories, likely consequences, and remediation taken.
7. Data subject requests
Rekomi assists you in responding to data subject access, rectification, erasure, and portability requests. You can correct affiliate records and export your program data as CSV directly from the dashboard. For erasure, the affiliate deletes their own account from their Settings, or you forward the request to support@rekomi.com and Rekomi handles it within 30 days. For anything else, contact support@rekomi.com.
8. Audit rights
On-site audit is available for Enterprise customers with reasonable advance notice. Independent third-party audit reports will be made available under NDA when those engagements complete.
9. Data return and deletion
On termination, Rekomi keeps personal data available for export and reactivation, and deletes it at the Customer’s request or when the Customer deletes the account. Backups containing personal data are retained for up to 7 days and overwritten on rotation.
10. Conflict
Where this DPA conflicts with the Terms of Service, this DPA prevails for matters of personal data processing.
We keep this addendum current as the product evolves. Enterprise variants and custom amendments are available on request at support@rekomi.com.