Data Processing Addendum

Last updated: November 5, 2026

This Data Processing Addendum ("DPA") forms part of the agreement between Divanova Inc. (doing business as Repull) ("Repull", "we") and the customer that accepted the Repull Terms of Service ("Customer", "you") (the "Agreement"). It applies when Repull processes Personal Data on the Customer's behalf through the Repull API, dashboard and related services (the "Service"). If this DPA and the Agreement conflict on the processing of Personal Data, this DPA governs.

1. Definitions

  • Applicable Data Protection Laws: all laws on the processing of Personal Data that apply to the Service, including the EU GDPR, the UK GDPR and Data Protection Act 2018, the California Consumer Privacy Act (CCPA/CPRA), and Thailand's Personal Data Protection Act (PDPA), as amended.
  • Personal Data: any information relating to an identified or identifiable natural person that Repull processes on the Customer's behalf through the Service, such as guest names, contact details, reservation details and messages.
  • Anonymized Data: data that has been de-identified or aggregated so that it no longer identifies, and cannot reasonably be used to identify, any natural person or the Customer.
  • Service Data: data about the use and operation of the Service, such as API request logs, usage volumes, performance metrics, error data and security events.
  • Controller, Processor, Data Subject, Processing, Personal Data Breach, Sub-processor: as defined in the GDPR, or the equivalent terms in other Applicable Data Protection Laws (including "Business" and "Service Provider" under the CCPA).

2. Roles

2.1 The Customer is the Controller (or, where the Customer acts for its own clients, a Processor) of the Personal Data. Repull is a Processor (or Sub-processor) acting on the Customer's behalf. Under the CCPA, the Customer is the Business and Repull the Service Provider.

2.2 The Customer is responsible for having a lawful basis for the processing and for giving Data Subjects any required notices, including when the Customer connects channel, PMS or other third-party accounts to the Service.

2.3 Repull will not sell or share Personal Data, as those terms are defined under the CCPA.

3. Scope and instructions

3.1 Repull processes Personal Data only to provide, maintain, secure, support and improve the Service, and otherwise only on the Customer's documented instructions. The Customer's use of the Service, including its API calls, settings and connected accounts, constitutes its instructions.

3.2 If a law requires Repull to process Personal Data other than on the Customer's instructions, Repull will inform the Customer before doing so, unless the law prohibits it.

3.3 Schedule 1 describes the processing.

4. Anonymized Data and Service Data

4.1 Repull may create Anonymized Data from Personal Data and other Customer data processed through the Service.

4.2 Anonymized Data and Service Data are not Personal Data and are not subject to this DPA. Repull owns them and may use them for any lawful purpose, during and after the term of the Agreement, including to develop, train and improve machine-learning and artificial-intelligence models, pricing and revenue models, market analytics, benchmarks and new products and services.

4.3 Repull will not attempt to re-identify any natural person from Anonymized Data, and will not publish or disclose Anonymized Data in a form that identifies the Customer.

5. Confidentiality

Repull takes reasonable steps to ensure that its staff, agents and contractors who have access to Personal Data are bound by confidentiality obligations, and that access is limited to those who need it to provide the Service.

6. Security

Repull implements appropriate technical and organizational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing. Schedule 3 describes these measures. Repull may update them, provided the overall level of protection is not materially reduced.

7. Sub-processors

7.1 The Customer authorizes Repull to engage Sub-processors. The current list is published at repull.dev/subprocessors (Schedule 2).

7.2 Repull will give notice of new Sub-processors by updating the list and notifying Customers who subscribe to updates. For Restricted Transfers (Section 12), the notice will be given at least 30 days in advance.

7.3 The Customer may object to a new Sub-processor on reasonable data-protection grounds within that period. The parties will then discuss a commercially reasonable alternative in good faith. If none is found, the Customer's sole remedy is to terminate the affected part of the Service.

7.4 Repull binds each Sub-processor by a written agreement with data-protection obligations no less protective than this DPA, and remains liable for its Sub-processors' performance of those obligations.

8. Data Subject requests

8.1 If Repull receives a request from a Data Subject about Personal Data processed for the Customer, Repull will notify the Customer and will not respond directly, except to direct the Data Subject to the Customer or where the law requires.

8.2 Taking into account the nature of the processing, Repull will provide reasonable assistance to help the Customer respond to Data Subject requests. Much of this is available self-service through the Service.

9. Personal Data Breach

9.1 Repull will notify the Customer without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach affecting the Customer's Personal Data.

9.2 Repull will provide the information reasonably available to it to help the Customer meet its own notification obligations, and will take reasonable steps to contain and remediate the breach. The Customer will reimburse Repull's reasonable costs of cooperation, except where the breach was caused by Repull's breach of this DPA.

9.3 Repull will not notify regulators or Data Subjects of a breach on the Customer's behalf without the Customer's consent, unless the law requires it.

9.4 Repull's notification of, or response to, a Personal Data Breach is not an acknowledgment of fault or liability.

10. Assistance

Repull will provide reasonable assistance, at the Customer's cost, with data-protection impact assessments and prior consultations with supervisory authorities that relate to the Service, to the extent the Customer cannot reasonably meet these obligations on its own.

11. Audits

11.1 On reasonable request, Repull will provide information reasonably necessary to demonstrate compliance with this DPA, such as security documentation and summaries of third-party assessments, subject to confidentiality.

11.2 If that information is not enough to meet a requirement of Applicable Data Protection Laws, the Customer may audit Repull's compliance with this DPA, subject to the following:

  • at least 60 days' prior written notice;
  • no more than once per calendar year, unless required by a supervisory authority or following a Personal Data Breach;
  • the audit is limited to documentation and does not include access to Repull's systems, networks or other customers' data;
  • it is conducted during normal business hours by the Customer or an independent auditor bound by confidentiality;
  • the Customer bears all costs of the audit, including Repull's reasonable internal costs.

12. International transfers

12.1 Repull stores Personal Data in the United States. Some Sub-processors may process it in other countries, as listed in Schedule 2. The Customer authorizes Repull and its Sub-processors to transfer Personal Data to the United States and to any other country where they operate, in compliance with Applicable Data Protection Laws.

12.2 Where Personal Data subject to the EU GDPR is transferred to a country without an adequacy decision ("Restricted Transfer"), the parties agree to the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module Two (Controller to Processor) or Module Three (Processor to Processor) as applicable, incorporated by reference with these choices:

  • Clause 7 (docking clause) applies;
  • Clause 9: option 2 (general authorization), with the notice period in Section 7.2;
  • Clause 11: the optional language does not apply;
  • Clauses 17 and 18: the law and courts of Ireland;
  • Annexes I and II are completed by Schedules 1 and 3 of this DPA.

12.3 For Restricted Transfers subject to the UK GDPR, the UK International Data Transfer Addendum to the EU Standard Contractual Clauses (version B1.0, issued by the ICO) applies and is incorporated by reference. Its Tables are completed with the information in this DPA, and either party may end it as set out in its Section 19.

12.4 For transfers subject to Thailand's PDPA or other laws with transfer restrictions, the parties will rely on the safeguards above, adapted as needed, or on another lawful transfer mechanism.

13. Return and deletion

13.1 After the Agreement ends, the Customer may export its data through the Service for 30 days. Repull will then delete Personal Data within a reasonable time, and in any event within 12 months, unless the Customer asks for earlier deletion.

13.2 If the Customer requests deletion during the Agreement, Repull will comply within one month, extendable by two further months where necessary.

13.3 Repull may retain Personal Data where required by law, in backups until they are overwritten in the normal course, and for legitimate business needs such as fraud prevention, dispute resolution and enforcing the Agreement, subject to this DPA for as long as it is retained. Anonymized Data and Service Data are not subject to deletion under this Section.

14. Liability and indemnity

14.1 Each party's total aggregate liability arising out of or related to this DPA, whether in contract, tort or otherwise, is subject to the limitations and exclusions of liability in the Agreement and in any case will not exceed the amounts paid by the Customer to Repull under the Agreement in the 12 months before the event giving rise to the claim. Neither party is liable for indirect, consequential, special or punitive damages, or loss of profits, revenue, goodwill or data.

14.2 The Customer will indemnify Repull against third-party claims, fines and penalties arising from the Customer's breach of this DPA or of Applicable Data Protection Laws, including processing on instructions that infringe those laws.

15. Term and general

15.1 This DPA applies for as long as Repull processes Personal Data on the Customer's behalf.

15.2 Governing law and jurisdiction follow the Agreement, except where the Standard Contractual Clauses require otherwise.

15.3 Repull may update this DPA to reflect changes in law or in the Service. A change that materially reduces the protection of Personal Data will be notified to the Customer at least 30 days in advance.

Schedule 1: Description of the processing

  • Data Subjects: the Customer's guests and prospective guests; property owners; the Customer's staff and users of the Service; contacts at the Customer's partners and suppliers.
  • Categories of Personal Data: names; email addresses and phone numbers; postal addresses; reservation details (dates, property, number of guests, prices, payout and payment status); guest messages and their attachments; reviews; identity or verification details where supplied by a connected channel; account and login details; IP addresses and device data.
  • Special categories: none intended. The Customer should not use the Service to process special-category data, although guests may include such data in free-text messages.
  • Nature of processing: collection from connected channels, PMSs and other accounts; storage; synchronization; transmission of messages and updates to connected accounts; delivery of webhooks; support; security monitoring; creation of Anonymized Data.
  • Purpose: providing, maintaining, securing, supporting and improving the Service, as described in the Agreement and this DPA.
  • Duration: the term of the Agreement plus the period in Section 13.
  • Frequency: continuous.

Schedule 2: Sub-processors

The current list of Sub-processors is published at repull.dev/subprocessors.

Schedule 3: Security measures

  • Encryption of data in transit (TLS 1.2+) and at rest.
  • API keys scoped per workspace; secrets held in managed secret stores, not in code.
  • Logical separation of each customer's data; access checks enforced on every API request.
  • Least-privilege access to production systems, restricted to authorized staff.
  • Request logging, monitoring and alerting on errors and abuse; rate limiting.
  • Database backups and recovery procedures.
  • Vendor review of Sub-processors before engagement.
  • Incident response procedures, including the breach notification in Section 9.