Data Processing Agreement
When Remitto processes personal data on a customer's behalf, it does so as a processor under a Data Processing Agreement (DPA). This page summarizes the DPA in plain language. The full text below is a working draft template and is pending final legal review before publication.
Working template for counsel review — not legally binding. The final, counsel-approved DPA is provided to customers under the Agreement.
Roles
The customer is the data controller; Remitto is the data processor, processing carrier and shipment data solely on the customer’s documented instructions to detect and recover refunds.
Scope of processing
Subject matter: refund detection and claim filing. Categories of data: shipment, invoice, and limited recipient data necessary for claims. Duration: the term of the customer agreement plus any required retention.
Security measures
Encryption in transit (TLS 1.3) and at rest (AES-256), access controls, audit logging, and EU-only data residency, as detailed in the Trust Center and Annex II of the draft DPA.
Sub-processing
Remitto engages the EU-based sub-processors listed in the Trust Center, each under equivalent data-protection obligations, and notifies customers of material changes before they take effect.
International transfers
No personal data is transferred outside the EU. All processing occurs within EU regions; any future transfer would require an appropriate Article 46 mechanism beforehand.
Breach notification
Remitto notifies the controller without undue delay after becoming aware of a personal data breach, with the information the controller needs to meet its Article 33 and 34 obligations.
Audits
Remitto makes available the information needed to demonstrate Article 28 compliance and allows for audits, subject to reasonable notice, confidentiality, and frequency limits set in the final DPA.
Assistance & deletion
Remitto assists the controller with data-subject requests, breach notification, and data-protection impact assessments, and deletes or returns data at the end of the engagement.
Questions about this document? Email legal@remitto.io.