1. Parties and incorporation into the Agreement
This Data Processing Agreement, referred to as the DPA, is entered into between the customer of the Reevals service as controller and CREALAB s.r.o., Terézie Vansovej 1167/1, 050 01 Revúca, Slovak Republic, Company ID No. 50 156 896, as processor.
The DPA forms part of the Agreement for the Reevals service to the extent that CREALAB processes personal data contained in Customer Data on the customer's behalf. Capitalised terms have the meaning given in the Terms of Service unless otherwise defined in the DPA.
In the event of a conflict, the DPA takes precedence on personal-data protection matters. A separately signed agreement between the parties takes precedence over this online DPA to the extent of an express conflict.
2. Subject matter, duration and instructions
The subject matter is the processing needed to provide, secure, support and terminate the Reevals service under the Agreement. Processing continues during the Agreement and afterwards for the period required for export, deletion, secure retirement of backups and compliance with binding legal obligations.
The Agreement, service configuration, authorised use of functions, support requests and the customer's written instructions constitute documented instructions. CREALAB processes personal data only on those instructions, including with regard to transfers to a third country, unless processing is required by Union or Member State law. CREALAB will inform the customer of such a legal requirement before processing unless the law prohibits this on important grounds of public interest.
If CREALAB believes that an instruction infringes the GDPR or other data-protection law, it will inform the customer without delay and may suspend the affected part until the instruction is clarified or lawfully amended.
3. Customer obligations
- Determine the purposes and means of processing and have a valid legal basis for it.
- Provide data subjects with the required information and handle the exercise of their rights.
- Submit only data proportionate to the purpose and not use the service for prohibited or unreasonably high-risk processing.
- Configure permissions, retention rules, integrations and security functions appropriately for the risk.
- Protect login credentials and report suspected compromise without delay.
- Not submit special categories of data, criminal-conviction data or large-scale data relating to children without prior written agreement and appropriate additional safeguards.
4. Confidentiality and authorised persons
CREALAB will ensure that persons authorised to process personal data are bound by confidentiality or an appropriate statutory duty of confidentiality and have access only to the extent required for their work.
CREALAB provides authorised persons with appropriate security and data-protection training and regularly reviews their access permissions. The duty of confidentiality continues after their authorisation or employment ends.
5. Security of processing
CREALAB will implement and maintain appropriate technical and organisational measures in accordance with Article 32 of the GDPR, taking into account the state of the art, costs, nature, scope, context, purposes and risk. The basic framework of measures is set out in Annex 2.
The customer acknowledges that security is a shared responsibility. The customer is responsible for configuring its own users, roles, sources, integrations, exports and devices. CREALAB may change the measures provided that it does not reduce the overall level of protection relevant to the service.
6. Subprocessors
The customer gives CREALAB general written authorisation to engage subprocessors. The current list, purpose and place of processing are available at /subprocessors. An external service is used only to the extent necessary for an activated function or operation of the service.
CREALAB will give at least 15 days' advance notice of a planned addition or replacement of a subprocessor by email, in-service notice or an update to the list with an option to subscribe to notices. During that period, the customer may submit a reasoned objection relating to personal-data protection.
The parties will try to resolve an objection through a reasonable change, supplementary measure or disabling of the affected optional function. If no reasonable solution is possible, the customer may terminate the affected part of the service. CREALAB will impose substantially the same data-protection obligations on the subprocessor and remains responsible to the customer for the subprocessor's performance to the extent required by Article 28 of the GDPR.
7. Transfers to third countries
CREALAB will not transfer personal data outside the European Economic Area without a valid mechanism under Chapter V of the GDPR. It may use an adequacy decision, standard contractual clauses adopted by the European Commission or another lawful mechanism, together with supplementary measures where appropriate to the risk.
Where standard contractual clauses are used between the customer as exporter and CREALAB or a subprocessor as importer, the applicable module, the annexes to this DPA and the subprocessor list supplement the clauses to the required extent.
8. Data-subject rights
Taking into account the nature of the processing, CREALAB will assist the customer through appropriate technical and organisational measures in fulfilling obligations relating to data-subject requests. If CREALAB receives a request directly, it will forward the request to the customer without undue delay and will not respond substantively without an instruction unless required to do so by law.
Standard self-service functions for export, correction, restriction and deletion are included in the service where supported by the plan. Non-standard assistance beyond a reasonable scope may be charged as agreed if the need was not caused by CREALAB's non-compliance with the DPA.
9. Personal data breach
CREALAB will notify the customer of a personal data breach involving Customer Data without undue delay after becoming aware of it. Notice will be sent to the customer's contractual or security contact.
Subject to availability, CREALAB will describe the nature of the incident, affected categories of data and persons, likely consequences, measures taken or proposed and a contact point. Information may be provided in phases. Notice does not constitute an admission of liability. CREALAB will take reasonable measures to contain and remedy the incident.
The customer is responsible for assessing and complying with its own notification obligations to the supervisory authority and data subjects. CREALAB will provide the reasonable assistance available to it.
10. Impact assessments, consultations and information
CREALAB will provide the customer with information reasonably necessary to demonstrate compliance with Article 28 of the GDPR and for an impact assessment or prior consultation under Articles 35 and 36 of the GDPR, where these concern processing in the service and the customer cannot reasonably obtain the information elsewhere.
Assistance is based on the information and functions available to CREALAB. The customer remains responsible for assessing its purposes, legal bases, proportionality and risks.
11. Audits
CREALAB will first provide available security documentation, results of independent assessments or answers to a reasonable questionnaire. If this is insufficient to demonstrate compliance, the customer may conduct an audit or appoint an independent auditor no more than once every 12 months, unless a more frequent audit is required because of an incident, a supervisory authority or a reasonable suspicion of material non-compliance.
An audit must be announced at least 30 days in advance, conducted during business hours, limited to relevant systems and must not jeopardise security, the confidentiality of other customers or operations. The auditor must be bound by confidentiality and must not be a direct competitor of CREALAB. The customer bears its costs unless the audit demonstrates material non-compliance by CREALAB.
12. Return and deletion
After termination of the service, CREALAB will, at the customer's choice, return available Customer Data in a standard format or delete it, unless the law requires further retention. A request for a standard export must be submitted within the period specified in the Terms of Service.
Copies in secure backups will be made unavailable for ordinary use and deleted or overwritten through the normal rotation cycle. During this period, they remain protected under the DPA and are not restored to active operations except where needed for continuity, security or compliance with a legal obligation.
13. Liability, changes and termination
The parties' liability under the DPA is subject to the limitations agreed in the Agreement to the fullest extent permitted by law. This does not affect data-subject rights or the powers of supervisory authorities.
We may update the DPA when the law or service changes, provided that we do not materially reduce the level of protection. We will notify a material change under the rules for changes to the Terms. Obligations intended by their nature to survive remain effective until all personal data processed on the customer's behalf has been deleted.
Annex 1. Description of processing
| Element | Description |
|---|---|
| Subject matter | Operation of the Reevals B2B SaaS, data imports and collection, product matching, monitoring, pricing workflows, reports, exports, APIs, integrations, support and security according to the customer's configuration. |
| Nature of operations | Receipt, transmission, storage, organisation, normalisation, comparison, retrieval, display, analysis, export, restriction, backup and deletion. |
| Purpose | Providing functions ordered and configured by the customer, securing the service, handling support and carrying out documented instructions. |
| Duration | During the Agreement and the subsequent period for export, deletion and secure retirement of backups. |
| Data subjects | The data subjects include the customer's Authorised Users, employees and contact persons. They also include employees and contact persons of its suppliers, partners or clients and other persons whose data the customer lawfully submits or makes available. |
| Categories of data | Identification, contact and employment data, user identifiers, roles, audit events, communication data, online identifiers, business and product data, integration data and other data determined by the customer. |
| Sensitive data | The service is not intended for special categories of personal data, criminal-conviction data or large-scale data relating to children without a separate written agreement. |
| Frequency | Continuously or according to the schedule, configuration, API calls and customer instructions. |
| Deletion | In accordance with Section 12 of the DPA, the Terms of Service, the configuration and binding legal obligations. |
Annex 2. Basic technical and organisational measures
- Identity and access management with individual accounts, roles and the principle of least privilege.
- Logical separation of customer accounts and data-ownership controls at the application layer.
- Encryption in transit using current protocols and protection of sensitive credentials or tokens at rest.
- Hashing of user passwords and protection of login and recovery processes.
- Audit, operational and security records proportionate to the risk and diagnostic needs.
- Management of updates, dependencies, vulnerabilities and changes in the production environment.
- Backup, recovery and continuity procedures appropriate to the service and ordered scope.
- Security incident management, escalation, communication and remediation procedures.
- Personnel confidentiality, security training and regular access reviews.
- Supplier assessment and contractual obligations for subprocessors.
- Secure development, input validation, protection of secrets and separation of development and production permissions as appropriate.
- Regular review of the effectiveness of measures and adjustment according to risk, incidents and developments in the state of the art.
Annex 3. Subprocessors
The current list of external providers, their purpose, place of processing and conditional activation is published at /subprocessors. That page forms a continuously updateable annex to the DPA.
The contact email for objections, security questions and requests under the DPA is support@reevals.com. DPA version 1.0 is effective from 25 August 2026.