--- title: "Data Processing Agreement" description: "Retily's data processing agreement: our role as your processor, international transfers, security measures and subprocessors." url: https://retily.com/dpa language: en last_modified: 2026-10-29T13:00:29Z --- # Data Processing Agreement Last updated: October 29, 2026 This Data Processing Agreement (“DPA”) is between FORMATILY FZCO, Building A1, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates, the company that operates Retily (“Retily”, “we”, “us”), and the business that has accepted the Retily Terms of Service (“Customer”, “you”). It forms part of the Terms and applies whenever we process Customer Personal Data on your behalf. You accept it when you accept the Terms. No signature is needed. If you need a countersigned copy, email support@retily.com. ## 1. Definitions “Data Protection Law” means all laws that apply to the processing of Customer Personal Data under this DPA, including the EU General Data Protection Regulation 2016/679 (“GDPR”), the UK GDPR and Data Protection Act 2018, and the Swiss Federal Act on Data Protection (“FADP”). “Customer Personal Data” means personal data we process on your behalf when providing the Service, such as the messages, contact details and files of the people who contact your business through Retily, and personal data in the knowledge you add. “Service” means Retily as described in the Terms. “Subprocessor” means a third party we engage to process Customer Personal Data. “Security Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data. “SCCs” means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914. “UK Addendum” means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner. “Controller”, “processor”, “data subject”, “personal data” and “processing” have the meanings given in the GDPR. ## 2. Roles and scope 2.1 You are the controller of Customer Personal Data, or a processor acting for another controller. We are your processor, or your subprocessor where you are a processor. 2.2 We are an independent controller for the data we need to run our business: your account and team member login details, billing, security logs, website visitors and the /try demo. Our Privacy Policy covers that data, not this DPA. 2.3 Annex 1 describes the processing. ## 3. Our obligations 3.1 Instructions. We process Customer Personal Data only on your documented instructions. The Terms, this DPA and your use and settings of the Service are your complete instructions. If we think an instruction breaks Data Protection Law, we will tell you. If a law requires us to process Customer Personal Data in another way, we will tell you first, unless that law forbids it. 3.2 Confidentiality. Everyone we authorise to process Customer Personal Data is bound by confidentiality. 3.3 Security. We apply the technical and organisational measures in Annex 2, as Article 32 GDPR requires. We may update them as long as the overall level of protection does not go down. 3.4 No other use. We do not sell Customer Personal Data, use it for advertising, or use it to train AI models, and we do not allow our Subprocessors to do so. 3.5 Data subject requests. The Service lets you find, export, correct and delete Customer Personal Data. If one of your data subjects contacts us, we will pass the request to you and only tell the person to contact you. We will help with requests you cannot handle in the Service, as far as reasonably possible. 3.6 Other help. Taking into account the nature of the processing and the information available to us, we will help you meet your obligations on security, Security Incident notification, data protection impact assessments and prior consultation with supervisory authorities (Articles 32 to 36 GDPR). ## 4. Your obligations 4.1 You are responsible for having a lawful basis for the processing, for the content you and your users send into the Service, and for giving your data subjects the information the law requires, including that your chat uses AI and that Retily processes data for you. 4.2 You will not use the Service to collect payment card numbers, government identity numbers, passwords or special categories of personal data, unless you have a lawful basis and have checked that the safeguards in this DPA are suitable. ## 5. Subprocessors 5.1 You give us general authorisation to engage Subprocessors. The current list is in Annex 3 and at [retily.com/dpa#subprocessors](https://retily.com/dpa#subprocessors). 5.2 We will tell you at least 14 days before we add or replace a Subprocessor, by email to your workspace owner and by updating the list. You may object on reasonable data protection grounds within that period. If we cannot resolve your objection, you may end your subscription and we will refund any prepaid fees for the period after it ends. 5.3 In an emergency, for example to keep the Service secure or available, we may replace a Subprocessor at once and tell you as soon as possible, with the same right to object. 5.4 We give each Subprocessor data protection obligations at least as protective as this DPA, and we remain responsible to you for their work. ## 6. International transfers 6.1 We are established in the United Arab Emirates. We and some Subprocessors process Customer Personal Data outside the European Economic Area (EEA), the United Kingdom and Switzerland. 6.2 Where the GDPR applies to a transfer of Customer Personal Data from you to us, the SCCs are incorporated into this DPA by reference: Module Two where you are a controller, and Module Three where you are a processor. You are the data exporter and we are the data importer. Clause 7 (docking clause) applies. Under Clause 9(a), Option 2 applies, with the notice period in section 5.2. The optional wording in Clause 11(a) does not apply. Under Clause 13, the competent supervisory authority is the one that Clause determines. Under Clause 17, the SCCs are governed by the law of Ireland, and under Clause 18, disputes are resolved by the courts of Ireland. Annexes 1, 2 and 3 of this DPA complete Annexes I, II and III of the SCCs. 6.3 Where the UK GDPR applies, the UK Addendum is incorporated by reference. Table 1 is completed with the details in this DPA, Table 2 with the SCC choices in section 6.2, and Table 3 with Annexes 1 to 3. For Table 4, either party may end the Addendum as set out in its Section 19. 6.4 Where the FADP applies, the SCCs apply with these changes: the Swiss Federal Data Protection and Information Commissioner is a competent supervisory authority for those transfers, references to the GDPR include the FADP, and data subjects in Switzerland may enforce their rights where they habitually live. 6.5 When we or a Subprocessor transfer Customer Personal Data onward outside the EEA, the UK or Switzerland, we make sure a valid transfer mechanism applies, such as an adequacy decision (including the EU-US Data Privacy Framework where the recipient is certified) or the SCCs. 6.6 If the SCCs or the UK Addendum conflict with this DPA, the SCCs or the UK Addendum prevail. ## 7. Security Incidents 7.1 We will notify you without undue delay, and in any case within 48 hours, after we become aware of a Security Incident. 7.2 The notice will describe, as far as we know at the time: what happened, the categories and approximate number of data subjects and records concerned, the likely consequences, what we have done or plan to do, and who you can contact. We may provide information in stages as we learn more. 7.3 We will take reasonable steps to contain the incident and limit its effects. Notifying you is not an admission of fault. ## 8. Audits 8.1 We will make available the information you reasonably need to show that we meet this DPA, including answers to a reasonable security questionnaire once a year. 8.2 If that information is not enough, if a supervisory authority requires it, or after a Security Incident, you may audit our compliance yourself or through an independent auditor bound by confidentiality. You will give us at least 30 days' notice. Audits take place during business hours, no more than once a year (except after a Security Incident or when a supervisory authority requires it), start with documents and remote review, never give access to other customers' data, and are at your cost. ## 9. Deletion and return 9.1 During your subscription you can export and delete Customer Personal Data in the Service. 9.2 When your subscription ends, you may ask us for an export in a common machine-readable format within 30 days. We delete Customer Personal Data from our live systems within 30 days after the account closes, and copies in our encrypted backups are deleted within a further 30 days, unless a law requires us to keep them. On request, we will confirm the deletion in writing. ## 10. Liability Each party's liability under this DPA is subject to the limits in the Terms, except where Data Protection Law or the SCCs do not allow such limits, including toward data subjects. ## 11. Term, changes and precedence 11.1 This DPA applies for as long as we process Customer Personal Data. 11.2 We may update this DPA to reflect changes in law, guidance or our Subprocessors. We will not reduce the protection of Customer Personal Data, and we will tell you about material changes at least 30 days in advance. 11.3 If this DPA conflicts with the Terms on data protection, this DPA prevails. Apart from the SCCs, this DPA is governed by the same law as the Terms. ## Annex 1: Description of the processing Data exporter: the Customer, as identified in its Retily account. Contact: the workspace owner. Activities: using Retily for customer support and team communication. Role: controller, or processor. Data importer: FORMATILY FZCO, Building A1, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates. Contact: support@retily.com. Activities: providing the Service. Role: processor, or subprocessor. Categories of data subjects: people who contact the Customer through Retily (website visitors who use the chat widget or forms, people who email the Customer's support address), people named in the Customer's knowledge, and the Customer's team members as they appear in conversations, tickets, tasks and notes. Categories of personal data: names and contact details; message content (chat, email, forms, voice messages and attachments); conversation details such as times, language, page address, and browser and device information; IP address, and for visitors before October 29, 2026 the country found from it; tickets, tasks, notes and ratings; personal data contained in the Customer's knowledge. Special categories: none intended. The Customer controls what is sent, and the Annex 2 measures apply to all data. Frequency: continuous, for the duration of the subscription. Nature of the processing: hosting and storage; search and retrieval of the Customer's knowledge; AI answers, summaries, drafts and translations; sending and receiving email; backups; and support we give at the Customer's request. Purpose: providing the Service under the Terms. Retention: for the duration of the subscription, then as set out in section 9. Transfers to Subprocessors: as listed in Annex 3, for the purposes stated there. ## Annex 2: Technical and organisational measures - Encryption in transit: TLS on every connection between browsers and Retily, and between Retily and its Subprocessors. Plain HTTP requests are redirected to HTTPS, and app.retily.com tells browsers to use HTTPS only (HSTS). - Encryption at rest: files in Cloudflare R2 are encrypted at rest, and backups are encrypted on our server before they are uploaded. - Secrets: provider keys, platform secrets and the credentials of mailboxes a Customer connects are encrypted with AES-256-GCM. API keys are stored only as hashes. - Separation of Customers: every request for a workspace's data is checked against that workspace, on every surface: the dashboard, the API, the chat widget and live connections. - Access inside a workspace: roles and permissions decide who can see and change what. - Server access: by SSH key only. Password login and root login are disabled. - Passwords: stored only as bcrypt hashes (cost 12). Sign-in attempts are rate limited. - Cross-site scripting: content written by customers, team members and the AI is escaped or sanitised before it is shown. - Server-side request forgery: addresses supplied by users are checked before our servers fetch them, so they cannot reach internal systems. - Chat widget: each visitor's chat session is bound to a signed cookie that only our server can write and the page cannot read. - Files: stored privately and shown only to people with access to them, or through signed links that expire: 30 days for links in emails, 5 minutes for storage links. Every uploaded file is scanned for malware. - Logs and monitoring: application logs are kept for 14 days, and faults alert our operators by email. - Backups: taken every night, encrypted, and deleted within 30 days. - Updates: operating system security updates are installed automatically. - AI providers: Anthropic, OpenAI and Google may not train their models on the data we send. Groq does not keep the content of our requests. ElevenLabs is used with its training opt-out switched on. - Incident response: as set out in section 7. ## Annex 3: Subprocessors These Subprocessors process Customer Personal Data. Our Privacy Policy at [retily.com/privacy](https://retily.com/privacy) lists them too, with the providers that process only our own account and billing data. ### OVH SAS (OVHcloud) **Purpose** Hosting: the server that runs the application, its database, queues and search, our malware scanner, our own website reader, and this website. **Data processed** All data in the service, including Customer Personal Data. Files uploaded before October 22, 2026 stay on this server until we delete them after their move to Cloudflare. **Location** France **Transfer safeguard** None needed: it is in the European Economic Area ### Cloudflare, Inc. (R2 file storage) **Purpose** Storage of files and attachments, since October 22, 2026. **Data processed** Files and attachments sent through chats, contact forms and email, or added in the dashboard, including voice messages, logos and workspace exports. **Location** European Union (Cloudflare R2's EU jurisdiction) **Transfer safeguard** EU-US Data Privacy Framework ### Cloudflare, Inc. (R2 backups) **Purpose** Off-site backups, taken every night and deleted within 30 days. **Data processed** A copy of the database and of the files kept on our server, encrypted before it leaves the server. **Location** Western Europe (a Cloudflare location hint, which Cloudflare applies on a best-effort basis) **Transfer safeguard** EU-US Data Privacy Framework ### Cloudflare, Inc. (Turnstile) **Purpose** Bot checks on sign-up, the /try demo and contact forms. **Data processed** The visitor's IP address and browser signals. **Location** Cloudflare's global network **Transfer safeguard** EU-US Data Privacy Framework ### Anthropic, PBC **Purpose** AI answers in chats, and AI drafts, translations, summaries and knowledge tools for the workspace's team. **Data processed** The conversation, including images a customer sends, and the knowledge passages relevant to it. **Location** United States, where Anthropic stores data. The AI processing itself may run in other regions Anthropic uses. **Transfer safeguard** Standard Contractual Clauses ### Google Cloud EMEA Limited (Gemini on Google Cloud) **Purpose** AI answers when Anthropic is unavailable, and lighter AI tasks: preparing a customer's question for the knowledge search, translations, summaries and the /try demo's key facts. **Data processed** The text of the conversation and the knowledge passages concerned. Images are described in words, not sent. **Location** European Union (Google Cloud region europe-west1, Belgium) **Transfer safeguard** None needed: it is in the European Economic Area ### OpenAI, LLC **Purpose** Makes knowledge searchable for the AI (embeddings), and transcribes voice messages when Groq is unavailable. **Data processed** Knowledge text, customers' questions, and voice recordings when Groq is unavailable. **Location** United States **Transfer safeguard** Standard Contractual Clauses ### Groq LLC **Purpose** Transcribes voice messages and voice notes. **Data processed** Voice recordings. **Location** United States **Transfer safeguard** Standard Contractual Clauses ### Eleven Labs Inc. (ElevenLabs) **Purpose** Reads AI replies aloud, only in a workspace that turns on voice replies, and in the knowledge briefing call. **Data processed** The text to be spoken. **Location** United States **Transfer safeguard** EU-US Data Privacy Framework ### Plus Five Five, Inc. (Resend) **Purpose** Sends and receives email for workspaces, and sends our own emails about your account. **Data processed** Email content, attachments, addresses and delivery events. **Location** Ireland for sending and receiving. Resend stores email metadata and logs in the United States. **Transfer safeguard** EU-US Data Privacy Framework ### Joam Intelligence, LLC (Scrapfly) **Purpose** Fetches the public web pages we ask it to read. **Data processed** The address and content of a public web page that the site's robots.txt lets us read. **Location** United States **Transfer safeguard** Scrapfly's data processing agreement