Data Processing Agreement

Last updated: October 19, 2026

This Data Processing Agreement (“DPA”) supplements the Terms of Use between the customer identified in the applicable account or service agreement (“Customer”) and RETENTION YES SP. Z.O.O. (“Reteno”) where Reteno processes Personal Data on Customer's behalf and the GDPR applies. It covers the Reteno platform and authorized API and MCP integrations used as part of those services.

This DPA becomes binding through the Customer's acceptance of the applicable Terms of Use or the parties' service agreement. A separately executed DPA governs the processing it covers. Publication of an updated website version does not by itself amend a separately executed DPA. In a conflict about data processing, the applicable DPA takes precedence over the Terms of Use; applicable Standard Contractual Clauses take precedence over conflicting provisions of either document.

THIS AGREEMENT IS ENTERED BETWEEN:

1. Customer

AND

2. RETENTION YES SP. Z.O.O, Warsaw city, Poland, duly represented by Oleksii Danchenko with due power and authority for the purposes hereof, having its principal office Poland, 02-972, voivodeship Mazovetsky, Warsaw city, Adama Branickiego Street, No. 21, office U3

IT IS HEREBY AGREED AS FOLLOWS:

1. Scope and order of precedence

This Data Processing Agreement applies to Reteno's Processing of Personal Data on behalf of Customer under the applicable service agreement, order or accepted Terms of Use (the “Agreement”). It does not govern Reteno's separate processing as a controller for its own purposes, which is described in the Privacy Policy.

This Data Processing Agreement is subject to the terms of the Agreement and is incorporated into the Agreement. Except as otherwise stated in this Data Processing Agreement, in the event of any conflict between the terms of the Agreement and the terms of this Data Processing Agreement, the relevant terms of this Data Processing Agreement shall take precedence.

2. Definitions

Capitalized terms not otherwise defined in this Data Processing Agreement will have the respective meanings assigned to them in the Agreement.

“Customer” means the contracting customer identified above. Customer acts as controller for Personal Data whose purposes and means it determines. If Customer acts as a processor for another controller, Customer confirms its authority to instruct Reteno and to appoint Reteno as a subprocessor, and references to Customer's instructions include the documented instructions it is authorized to pass on.

“Standard Contractual Clauses” or “SCCs” means the clauses adopted by Commission Implementing Decision (EU) 2021/914 for transfers of personal data to third countries, using the applicable module, options and completed annexes, where those clauses are legally available for the transfer. Sections 7 and 8 and Appendix 3 describe the relevant requirements.

“Personal Data” means any information relating to an identified or identifiable natural person that (i)Customer or any person acting on Customer’s behalf provides to You or (ii) You Process as part of the services provided under the Agreement. An identified or identifiable natural person (a “Data Subject”) is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

“Process” or “Processing” means any operation or set of operations which is performed by You as part of the Agreement upon Personal Data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

“Processor”, “You” or “Reteno” means RETENTION YES SP. Z.O.O., acting as processor or subprocessor for the processing covered by this DPA.

“Subprocessor” means a third-party subcontractor engaged by You which, as part of the subcontractor’s role of delivering the services under the Agreement, will Process Personal Data belonging to Customer.

The “Regulation” means Regulation 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.

Other terms have the definitions provided for them in the Agreement or as otherwise specified below.

3. Categories of Personal Data and purpose of the Personal Data Processing

The data subjects include Customer's users and business contacts and the subscribers, customers and other individuals whose data Customer instructs Reteno to process. The categories of Personal Data depend on the services and operations Customer selects:

A. Customer and Users: identification and contact data (name, address, title, contact details, username); financial information ( account details, payment information); employment details (employer, job title, geographic location, area of responsibility);

B. Subscribers: identification and contact data (name, date of birth, gender, general, occupation or other demographic information, address, title, contact details, including email address), personal interests or preferences (including purchase history, marketing preferences); IT information (IP addresses, usage data, cookies data, online navigation data, location data, browser data).

C. Messaging, audience and event records: contact and external-customer identifiers, custom fields, subscription status, audience membership, preferences, device and installation identifiers, push tokens, campaign and message identifiers, delivery and engagement activity, and associated event properties and timestamps. Purchase and transaction events may include order identifiers, products or services, dates, amounts, currencies and transaction status supplied by Customer about its end users.

D. Customer content and requested outputs: email HTML and editor models, message text, brand assets, images, templates, workflow settings, reporting exports and any Personal Data included in that content. For requested AI image operations, this includes prompts or editing instructions, source and reference images, masks, selected settings, generated or edited images and resulting URLs.

E. Connection and operation information needed to provide the services: account and organization identifiers, permissions and authorization records, request, job, upload and export identifiers, retry keys and request hashes, status and error information, timestamps, file metadata, client IP address, user agent, tool name and processing duration, to the extent these constitute Personal Data processed on Customer's behalf.

Processing of special categories of personal data is forbidden.

Processing takes place throughout the provision of the agreed services. Transfers occur as required by the services Customer selects, including task-specific requests and responses for authorized AI integrations; connecting an AI client does not instruct Reteno to transmit the entire contact database or full conversation history.

Processing includes collection, organization, storage, retrieval, analysis, modification, generation of requested content and reports, transmission, restriction, return and deletion, as necessary to perform Customer's documented instructions.

The purpose is to provide the agreed marketing, messaging, audience-management, reporting and content-design services, including authorized AI operations, and to maintain the security and reliable operation of those services. Data supplied for a particular task must be limited to what that task requires.

Retention periods and deletion requirements are specified in the applicable Agreement, this DPA and Customer's documented instructions. They may differ by customer, data category and purpose, including for behavioral events and end-user purchase history. Customer determines lawful periods that are no longer than necessary for its purposes. Reteno returns or deletes Personal Data at the end of the applicable period, on Customer's valid instruction or on termination, as provided in section 12, unless applicable law requires retention. The duration of the commercial relationship does not override an earlier applicable deletion requirement.

4. Controller’s Instructions

During the term of the Agreement, Customer may provide instructions to You in addition to those specified in the Agreement with regards to the processing of Personal Data. You will comply with all such instructions without additional charge to the extent necessary for You to comply with laws applicable to You as a data processor in the performance of the Agreement.

You shall Process Personal Data only on Customer's documented instructions, including with regard to transfers to a third country, unless required to do so by Union or Member State law to which You are subject. In that case, You shall inform Customer of the legal requirement before Processing, unless that law prohibits such information on important grounds of public interest.

You shall immediately inform Customer if, in Your opinion, an instruction infringes the GDPR or other applicable data-protection provisions.

Instructions include authorized settings and task-specific requests submitted through the Service, its APIs and connected AI clients within the relevant account permissions. Such instructions do not waive the authorization and transfer requirements in sections 7 and 8. Reteno returns the requested results to the AI client selected by Customer; the processing of copies received by that client is governed by Customer's arrangements with its provider. Reteno's separate engagement of an API provider to perform an operation remains subject to this DPA's subprocessor requirements.

Customer remains responsible for the lawful basis, transparency and instructions for its processing, and for any authorization it needs from another controller. Reteno does not become the controller of Customer's data merely because Customer uses an AI integration.

5. Rights of Data Subject

You undertake to assist Customer in responding to the requests of data subjects exercising their rights to access, to rectify, to erase, to restrict, to data portability, or to object.

In particular, upon Customer’s instructions, You will delete, release, correct or restrict access to any specific Personal Data and undertake to pass on promptly to Customer any requests of an individual data subject to access, to rectify, to erase, to restrict or to object Personal Data Processed under the Agreement.

6. Processor’s Obligations

In addition to other provisions of this Data Processing Agreement, You undertake to:

i. appoint a data protection officer, where required by applicable law, and to supply Customer with his/her contact details;

ii. ensure that all persons who have access to Personal Data belonging to Customer under the terms of the Agreement and Data Processing Agreement undertake to maintain confidentiality and have signed agreements with You containing protections no less stringent than those herein and will be informed by You of any data protection requirements related to the Processing of the Personal Data, including the limitation of use to the specific purpose of the Agreement and instructions of Customer;

iii. assist Customer in ensuring compliance with its obligations in terms of the security of personal data. In particular, You undertake to promptly notify Customer of any data breach as described in section 11 below and to provide all reasonable assistance to Customer in the carrying out of a data protection impact assessment related directly or indirectly to the Agreement and/or the Data Processing Agreement.

iv. taking into account the nature of Processing and the information available to You, assist Customer with its obligations under Articles 32 to 36 of the GDPR, including any required prior consultation with a supervisory authority.

7. Cross Border and Onward Data Transfer

You will treat all Personal Data in compliance with the requirements of the Agreement and this Data Processing Agreement in all locations globally.

Reteno's core customer-data platform is hosted in Dublin, Ireland. Processing by a Subprocessor or remote access from another country must be assessed separately from that core hosting location.

Before making a transfer subject to Chapter V of the GDPR, You shall establish a valid transfer mechanism, such as an applicable adequacy decision under Article 45 or appropriate safeguards under Article 46. Where the parties rely on the SCCs, the applicable module and options must be selected, the annexes completed and the clauses made binding on the relevant exporter and importer before the transfer. The parties shall assess the transfer and implement supplementary measures where required. Appendix 3 sets out the requirements for that transfer documentation.

For Personal Data protected by Swiss data-protection law, the parties shall meet the applicable Swiss transfer requirements, including any necessary adaptations to the transfer documentation. An EU adequacy decision does not by itself determine compliance with Swiss law.

No transfer of Customer's Personal Data to a country outside the EEA or Switzerland shall be made without Customer's prior written authorization and the safeguards required by applicable law. Authorization is not itself a substitute for a lawful transfer mechanism. You shall not make or continue a transfer where the required safeguards cannot be maintained.

8. Subprocessors

You shall not subcontract any of the Processing operations performed on behalf of Customer under the Agreement without the prior written consent of Customer.

Customer hereby expressly agrees to You using the Subprocessors listed in Appendix 1.

Before engaging an additional or replacement Subprocessor to Process Customer's Personal Data, You shall request Customer's written authorization and provide the Subprocessor's identity, proposed service, relevant data categories, processing locations and applicable transfer safeguards. You shall obtain that authorization before the new processing starts and maintain an up-to-date list.

Where You engage Subprocessors with the consent of Customer, You shall do so only by way of a written agreement with the Subprocessor which imposes the same obligations on the Subprocessor as are imposed on You under this Data Processing Agreement.

You remain responsible at all times for compliance with the terms of the Agreement and this Data Processing Agreement by Your Subprocessors.

Customer may request that You audit the Subprocessor or provide confirmation that such an audit has occurred (or, where available, obtain or assist customer in obtaining a third-party audit report concerning Subprocessor’s operations) to ensure compliance with its obligations. Customer will also be entitled, upon written request, to receive copies of the relevant terms of Your agreement with Subprocessors that may Process Personal Data.

9. Technical and Organizational Measures

When Processing Personal Data on behalf of Customer in connection with the Agreement, You warrant that You have implemented and will maintain appropriate technical and organizational security measures for the Processing of such data, including the measures specified in Appendix 2.

These measures are intended to protect Personal Data against accidental or unauthorized loss, destruction, alteration, disclosure or access, and against all other unlawful forms of processing. Additional information concerning such measures may be specified in the Agreement.

You undertake to document the implementation of the technical and organisational measures to provide this documentation to Customer upon request and to present any update of this documentation to Customer.

10. Audit Rights

Customer may audit, at its own expense, Your compliance with the terms of the Agreement and this Data Processing Agreement. If a third party is to conduct the audit, the third party must be mutually agreed to by Customer and You and must execute a written confidentiality agreement before conducting the audit.

To request an audit, Customer must submit an audit plan at least two weeks in advance of the proposed audit date to You describing the proposed scope, duration, and start date of the audit. You will review the audit plan and provide Customer with any concerns or questions You undertake to work cooperatively with Customer to agree on a final audit plan.

The audit will be conducted during regular business hours at the applicable facility and may not unreasonably interfere with Your business activities.

Customer will provide You a copy of any audit reports generated in connection with any audit under this section, unless prohibited by law. Customer may use the audit reports only for the purposes of meeting its regulatory audit requirements and/or confirming compliance with the requirements of the Agreement, this Data Processing Agreement and applicable law. The audit reports are Confidential Information of the parties under the terms of the Agreement.

You undertake to provide reasonable assistance with any audit conducted by Customer.

You agree that the competent data protection authority has the right to conduct an inspection of You, and of any Subprocessor.

You undertake to make available to Customer and/or the competent data protection authority all information necessary to demonstrate compliance with the obligations laid down in this Data Processing Agreement and applicable law and to fully cooperate with Customer and/or any competent data protection authority in the course of any audit and/or inspection.

11. Data Breach Notification

For purposes of this section, “Security Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data Processed on Customer's behalf by You or Your Subprocessors. You shall inform Customer without undue delay after becoming aware of a Security Breach. Notification shall not be postponed until the investigation is complete. Information may be provided in phases as it becomes available.

You will promptly investigate the Security Breach and take reasonable measures to identify its root causes and prevent a recurrence. As information is collected or otherwise becomes available, You will provide Customer with a description of the Security Breach, the type of data that was the subject of the breach, and other information Customer may reasonably request concerning the affected persons. The parties agree to coordinate in good faith on developing the content of any related public statements or any required notices for the affected persons and/or the relevant data protection authorities.

12. Return and Deletion of Personal Data upon End of the Agreement or at Customer’s Request

At the end of the services, You shall, at Customer's choice, return or delete Personal Data Processed on its behalf and delete existing copies unless Union or Member State law requires storage. During the services, You shall also implement Customer's valid deletion instructions and the applicable contractual retention schedule. The Agreement and documented instructions specify the applicable return and deletion process and timing; they do not override mandatory data-protection obligations.

Any Personal Data that must be retained by law shall remain protected and be Processed only for the required purpose. You shall ensure that the corresponding obligations are passed to relevant Subprocessors. Disconnecting an AI client does not itself terminate the Agreement, undo completed operations or delete copies already received by that client.

13. Legally Required Disclosures

Except as otherwise required by law, You will promptly notify Customer of any subpoena, judicial, administrative or arbitral order of an executive or administrative agency or other governmental authority (“Demand”) that it receives and which relates to the Personal Data You are Processing on Customer’s behalf.

At Customer’s request, You will provide Customer with reasonable information in Your possession that may be responsive to the Demand and any assistance reasonably required for Customer to respond to the Demand in a timely manner.

Appendix 1: List of Subprocessors

Providers are used for the applicable services; inclusion in this list does not mean every provider receives every customer's data. The locations below identify provider addresses and are not a statement of processing or hosting locations. Processing locations and any applicable transfer safeguards depend on the service and the relevant agreement. Customer may request information about these safeguards by contacting info@reteno.com.

Customer's independently selected ChatGPT, Codex or Claude service receives tool results under Customer's arrangements with that service. That recipient role is separate from a provider's role as a Subprocessor engaged by Reteno. The Privacy Policy describes the data flows for AI integrations.

Appendix 2: Organizational and Technical Measure implemented by You

1. Physical Access Control (measures in order to prevent unauthorized persons from gaining access to the data processing equipment (e.g. devices, database and application servers and related hardware) where the personal data are processed or used)

Outsourced processing: We host our Service with outsourced cloud infrastructure providers. Additionally, we maintain contractual relationships with vendors in order to provide the Service in accordance with our DPA. We rely on contractual agreements, privacy policies, and vendor compliance programs in order to protect data processed or stored by these vendors.

Physical and environmental security: We host our product infrastructure with multi-tenant, outsourced infrastructure providers. The physical and environmental security controls of providers are audited for SOC 2 Type II and ISO 27001 compliance, among other certifications.

2. System Access Control (measures to prevent data processing systems from being used by unauthorized persons)

Authorization: Customer Data is stored in multi-tenant storage systems accessible to Customers via only application user interfaces and application programming interfaces. Customers are not allowed direct access to the underlying application infrastructure. The authorization model in each of our products is designed to ensure that only the appropriately assigned individuals can access relevant features, views, and customization options. Authorization to data sets is performed through validating the user’s permissions against the attributes associated with each data set.

Authentication: We implement a uniform password policy for our customer products. Customers who interact with the products via the user interface must authenticate before accessing non-public customer data.

3. Data Access Control (measures to ensure that the persons entitled to use the data processing systems are only able to access the data within the scope and to the extent covered by their respective access permission (authorization) and that personal data cannot be read, copied or modified or removed without authorization)

Product access: A subset of our employees have access to the products and to customer data via controlled interfaces. The intent of providing access to a subset of employees is to provide effective customer support, to troubleshoot potential problems, to detect and respond to security incidents and implement data security. Access is enabled through “just in time” requests for access; all such requests are logged. Employees are granted access by role, and reviews of high-risk privilege grants are initiated daily. Employee roles are reviewed at least once every six months.

Background checks: All employees undergo a third-party background check prior to being extended an employment offer, in accordance with and as permitted by the applicable laws. All employees are required to conduct themselves in a manner consistent with company guidelines, non-disclosure requirements, and ethical standards.

4. Transmission Control (measures to prevent the personal data from being read, copied, altered or deleted by unauthorized parties during the transmission thereof or during the transport of the data media)

In-transit: We make HTTPS encryption (also referred to as SSL or TLS) available on every one of its login interfaces. Our HTTPS implementation uses industry standard algorithms and certificates.

At-rest: We store user passwords following policies that follow industry standard practices for security. We have implemented technologies to ensure that stored data is encrypted at rest.

5. Input Control (measures to ensure that it is possible to check and establish whether and by whom personal data have been input into data processing systems or removed)

Detection: We designed our infrastructure to log extensive information about the system behavior, traffic received, system authentication, and other application requests. Internal systems aggregated log data and alert appropriate employees of malicious, unintended, or anomalous activities. Our personnel, including security, operations, and support personnel, are responsive to known incidents.

Response and tracking: We maintain a record of known security incidents that includes description, dates and times of relevant activities, and incident disposition. Suspected and confirmed security incidents are investigated by security, operations, or support personnel; and appropriate resolution steps are identified and documented. For any confirmed incidents, we will take appropriate steps to minimize product and Customer damage or unauthorized disclosure. Notification to you will be in accordance with the terms of the Agreement.

6. Job Control (measures to ensure that the data are processed strictly in accordance with the instructions of Customer)

Our system is located in a secure cloud, we use encryption for any sensitive data, centralized access management with strict roles, and very limited access to databases for our stuff. Also, we log any actions on servers and cloud platform.

7. Availability Control (measures to ensure data are protected from accidental destruction or loss)

Infrastructure availability: The infrastructure providers use commercially reasonable efforts to ensure a minimum of 99.95% uptime. The providers maintain a minimum of N+1 redundancy to power, network, and HVAC services.

Fault tolerance: Backup and replication strategies are designed to ensure redundancy and fail-over protections during a significant processing failure. Customer data is backed up to multiple durable data stores and replicated across multiple availability zones.

Online replicas and backups: Where feasible, production databases are designed to replicate data between no less than 1 primary and 1 secondary database. All databases are backed up and maintained using at least industry-standard methods.

Our products are designed to ensure redundancy and seamless failover. The server instances that support the products are also architected with the goal of preventing single points of failure. This design assists our operations in maintaining and updating the product applications and backend while limiting downtime.

8. Data Segregation (measures to separate the processing for different purposes and/or operations)

Measures to provide for separate processing (storage, amendment, deletion, transmission) of data for different purposes:

a) The environments used for development, testing and production purposes are physically separated

b) Usage of production un-anonymized data in the development environment is not allowed.

Appendix 3: International-transfer safeguards

The parties shall use a transfer mechanism permitted by applicable data-protection law for each transfer that requires one. The obsolete clauses adopted under Commission Decision 2010/87/EU are not incorporated into this DPA.

Transfers requiring the 2021 Standard Contractual Clauses

Where the SCCs adopted by Commission Implementing Decision (EU) 2021/914 are the chosen and legally available mechanism, the parties to the particular transfer shall enter into the applicable, unmodified clauses and complete their options and annexes before the transfer begins. The official clauses are also available through the European Commission's SCC publication page.

For a controller-to-processor transfer, the applicable module is Module Two. For a processor-to-processor transfer, including an onward transfer by Reteno as processor to a Subprocessor, the applicable module is Module Three. The parties must verify the actual roles, destination and scope of the SCCs before selecting a module. A transfer between Customer and Reteno within the EEA does not require third-country SCCs merely because this DPA applies.

Reteno shall ensure that its transfer agreements with relevant Subprocessors are binding and consistent with Customer's documented instructions and the authorizations required by sections 7 and 8. The fact that Customer accepts this DPA does not itself bind a third-party Subprocessor to SCCs with Reteno.

Required transfer documentation

The agreement for each covered transfer shall identify:

• The applicable SCC module and selected options, including any docking provision, subprocessor authorization process and associated period, optional independent dispute-resolution provision, governing law and competent courts.
• Annex I.A: the actual exporter and importer, their addresses, contact details, roles and activities, and the signatures and dates or other legally valid execution formalities required for the agreement.
• Annex I.B: the data subjects and Personal Data transferred, frequency, nature and purposes, retention periods or criteria, and, for a Subprocessor, the subject matter, nature and duration of its processing. Section 3 of this DPA supplies the general service description; the annex must be narrowed to the actual transfer.
• Annex I.C: the competent supervisory authority determined under SCC Clause 13 for the particular exporter. The parties must not assume that the same authority applies to every customer or transfer.
• Annex II: the technical and organizational measures applicable to the actual importer, service and transfer, including necessary supplementary measures. Appendix 2 describes Reteno's commitments and does not automatically describe every external provider's controls.
• Annex III, where required: the specifically authorized Subprocessors, with the information required by the selected SCC option. Appendix 1 can support this information once its entries and scope are verified.

The parties shall carry out and document the assessment required by the SCCs concerning the laws and practices affecting the transfer, apply required supplementary measures, and respond to relevant changes or government-access requests in accordance with the clauses. Transfers shall be suspended or ended where the required protection cannot be maintained.

The SCCs shall prevail over any conflicting term of the Agreement or this DPA. Nothing in the Agreement limits data-subject rights or liability that cannot be limited under the SCCs or applicable law.

For transfers governed by Swiss law, the transfer documentation shall include the adaptations required by that law. Any other applicable jurisdiction-specific transfer requirements must be addressed in the relevant agreement.

Customer may request information about the applicable safeguards and a copy of the relevant transfer clauses by contacting info@reteno.com, subject to lawful redaction of confidential information that does not prevent understanding of the safeguards.