Data Processing Agreement

Effective upon acceptance during signup or onboarding · Last updated: 19 September 2026

In plain language

This is the agreement that governs how LuxeReply handles personal data on your behalf. In short: you remain the owner and controller of your data, we process it only to draft and manage your review replies, we never sell it, we protect it with encryption and access controls, and when you leave we delete it.

This summary is for convenience only — the numbered sections below are the binding text.

The parties & acceptance

This Data Processing Agreement ("DPA") is an addendum to the Terms of Service and is entered into by and between:

Client ("Controller") – the individual or legal entity that creates an account and uses LuxeReply's services,
and
LuxeReply, operated by Edem Inn single member PC, a company established under the laws of Greece, with its registered address at Corfu Kassiopi 49081 ("Processor").

By accepting the Terms of Service and Privacy Policy via checkbox during account registration or onboarding, the Client acknowledges and agrees to this DPA as of the date of their first use of the services.

Definitions

For the purposes of this Data Processing Agreement:

"Applicable Data Protection Law" means all data protection and privacy laws and regulations applicable to the processing of Personal Data under this DPA, including, where applicable, the EU General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679), the UK GDPR, the UK Data Protection Act 2018, and other relevant international, federal, or state privacy laws, such as the California Consumer Privacy Act (CCPA) and Australia's Privacy Act 1988.

"Personal Data" means any information relating to an identified or identifiable natural person ("Data Subject") that is processed by LuxeReply on behalf of the Client as part of the Services.

"Processing", "Data Controller" (or "Controller"), "Data Processor" (or "Processor"), "Data Subject", and "Supervisory Authority" shall have the meanings given to them under the GDPR or equivalent terms under other Applicable Data Protection Laws.

Subject Matter and Duration

This Data Processing Agreement ("DPA") is an addendum to and forms part of the Terms of Service (the "Agreement") between the Client and LuxeReply.
This DPA applies to the processing of Personal Data by LuxeReply on behalf of the Client in connection with the provision of LuxeReply's subscription-based services, as described in the Agreement.

This DPA shall:
Enter into force on the date the Client accepts the Agreement and subscribes to the LuxeReply services;
Remain in effect for the duration of the Client's active subscription term;
Continue to apply for as long as LuxeReply retains or processes any Personal Data on behalf of the Client, including during any applicable retention or deletion period following termination of the subscription, as required by this DPA, the Agreement, or applicable law.
Upon termination or expiration of the Client's subscription, this DPA remains in effect until all Personal Data processed on behalf of the Client has been either returned or securely deleted, except where retention is required by applicable law.

Nature and Purpose of Processing

LuxeReply processes Personal Data solely on behalf of the Client and only as necessary to provide, maintain, and improve the LuxeReply services. These services include, but are not limited to:

AI-generated responses to customer reviews
Review analytics, sentiment analysis, and reporting
Business location and customer communication management
Response templates and automation tools
User account management and access control
Customer support and troubleshooting related to service usage

All processing activities are carried out in accordance with the Client's documented instructions, as set forth in the Agreement and this DPA, and solely for the purpose of enabling the Client to manage online reputation and customer communication through the LuxeReply platform.

Categories of Data Subjects and Data

Data Subjects may include:

End users and customers of the Client's business (e.g., diners, salon and wellness clients, real-estate clients)
Individuals submitting reviews via third-party platforms connected to LuxeReply (currently the Google Business Profile platform)
Client personnel authorized to use LuxeReply services

Categories of Personal Data may include:

Names, usernames or profile information
Email addresses or other contact information (if available via APIs)
Review content and ratings
Publicly available profile pictures (as provided by the connected platform)
Communication logs or message content processed for automation purposes
Metadata (e.g., timestamps, platform identifiers)

Special Categories of Data:
LuxeReply does not knowingly collect, require, or process any sensitive Personal Data (as defined under Article 9 of the GDPR), such as:

Health data
Biometric or genetic data
Financial or payment information
Political, religious, or philosophical beliefs

The Client is responsible for ensuring that no sensitive data is submitted or processed through LuxeReply in violation of applicable data protection laws or this Agreement.

Processor Obligations

LuxeReply, as the Data Processor, agrees to:

a. Process Personal Data solely on the documented instructions of the Client, including with regard to international data transfers, unless otherwise required by Union or Member State law. In such cases, LuxeReply will inform the Client of that legal requirement before processing, unless prohibited by law.
b. Implement and maintain appropriate technical and organizational security measures that ensure a level of security appropriate to the risk, in accordance with Article 32 of the GDPR. These measures include protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage of Personal Data.
c. Ensure that all personnel authorized to process Personal Data are bound by confidentiality obligations (contractual or legal) and receive ongoing data protection training to maintain awareness and compliance.
d. Assist the Client, to the extent reasonably possible, in fulfilling their obligations to respond to Data Subject requests under Chapter III of the GDPR, including rights to access, rectification, erasure, restriction of processing, data portability, and objection to processing.
e. Notify the Client without undue delay, and at the latest within 48 hours, upon becoming aware of a Personal Data Breach affecting the Client's data, providing sufficient details to assist with breach management and legal notifications.
f. Maintain detailed records of all processing activities carried out on behalf of the Client, as required under Article 30(2) of the GDPR, and make such records available to the Client or relevant supervisory authority upon request.
g. Cooperate fully with any audits or inspections initiated by the Client or their appointed auditor, provided reasonable prior notice is given and such audits do not unduly disrupt LuxeReply's business operations.
h. Ensure that any subcontractors or Sub-Processors engaged in processing Personal Data comply with equivalent data protection obligations and that the Client is informed of such arrangements in advance.

Security Measures

LuxeReply shall implement and maintain appropriate technical and organizational security measures to ensure a level of security appropriate to the risk, in accordance with Article 32 of the GDPR. These measures are designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access.

The implemented security measures include, but are not limited to:

Data encryption during transmission (TLS) and at rest
Role-based access controls to restrict Personal Data access to authorized personnel only
Authentication safeguards, including strong password policies and session controls
System activity logging and continuous monitoring to detect and respond to anomalies
Regular software updates, vulnerability assessments, and security patches
Data backup and recovery procedures to protect against accidental data loss
Internal access reviews and employee training on data protection and security policies

LuxeReply may update its security practices over time, provided such updates do not result in a reduction of the overall level of protection.

Sub-Processors

LuxeReply may engage Sub-Processors to support the delivery of its services (e.g., cloud infrastructure, analytics, automation tools), subject to the following conditions:

Each Sub-Processor is bound by a written agreement imposing data protection obligations equivalent to those set out in this DPA, in accordance with Article 28(4) of the GDPR.
LuxeReply remains fully liable to the Client for the performance of each Sub-Processor's obligations with respect to the processing of Personal Data.

The Client will be notified at least 15 days in advance, via email or in the dashboard, of any intended changes concerning the addition or replacement of Sub-Processors, giving the Client the opportunity to object on reasonable grounds relating to data protection.

Current Sub-Processors include:

Xano, Inc.: backend infrastructure and database hosting
WeWeb: web application hosting
OpenAI: AI-assisted generation of draft review replies
Google LLC: Google Business Profile API (review retrieval and reply publishing)
Google Ireland Limited: Google Analytics on our public website, and only where the visitor has consented
Stripe, Inc.: subscription billing and payment processing
Resend: transactional email delivery
Cloudflare, Inc.: bot protection on our forms, cookieless web analytics, and storage of the cookie consent record in the European Union

An up-to-date list of Sub-Processors is available at any time upon request at [email protected].

By accepting this DPA, the Client provides general written authorization for the use of Sub-Processors as described above.

International Data Transfers

LuxeReply may transfer Personal Data outside the European Economic Area (EEA), United Kingdom (UK), or other jurisdictions with similar data transfer restrictions, strictly in accordance with Chapter V of the GDPR and the UK GDPR.

Such transfers will only occur:

To countries that have received an adequacy decision from the European Commission or relevant UK authority;
Pursuant to Standard Contractual Clauses (SCCs) adopted by the European Commission and, where applicable, the UK International Data Transfer Addendum;
Or via other appropriate safeguards, such as binding corporate rules, approved codes of conduct, or certifications, as permitted by applicable law.

LuxeReply shall ensure that any international transfer is subject to appropriate safeguards to guarantee a level of protection of Personal Data that is essentially equivalent to that provided in the EEA/UK.

Personal Data Breach Notification

In the event of a Personal Data Breach involving the Client's Personal Data, LuxeReply shall:

Notify the Client without undue delay, and in any case no later than 48 hours after becoming aware of the breach;
Provide all relevant details known at the time, including:
The nature of the breach;
Categories and approximate number of affected data subjects and records;
Likely consequences of the breach;
Measures taken or proposed to address the breach and mitigate possible adverse effects;
Provide timely updates as further information becomes available;
Assist the Client in complying with any legal obligations, including notification to supervisory authorities or affected data subjects, where required under applicable data protection law.

LuxeReply shall document all breaches in accordance with its internal incident response policy and applicable law.

Term and Termination

This Data Processing Agreement (DPA) remains in effect for the duration of the Client's subscription to LuxeReply services and as long as LuxeReply processes Personal Data on behalf of the Client.

Upon termination or expiration of the Agreement:

LuxeReply shall, at the choice of the Client, either delete or return all Personal Data processed on behalf of the Client;
Deletion shall be performed securely and irreversibly, in accordance with industry best practices and applicable law;
LuxeReply may retain copies of Personal Data only to the extent required by applicable law, and in such cases, shall continue to ensure compliance with the confidentiality and data protection obligations set forth in this DPA.

The Client's instruction on deletion or return must be provided within 30 days of termination. If no instruction is received, LuxeReply will securely delete the data by default.

Liability and Indemnity

Each party shall be liable for any damages resulting from its own breach of this DPA or Applicable Data Protection Laws.

The Client (as Controller) is solely responsible for:

Ensuring that Personal Data is collected and processed lawfully;
Securing any necessary Data Subject consents;
Determining the lawful basis for processing and the scope of instructions issued to LuxeReply.

LuxeReply (as Processor) shall be responsible for:

Processing Personal Data only in accordance with the Client's lawful instructions;
Complying with its direct obligations under Applicable Data Protection Laws;
Implementing appropriate security measures.

Each party agrees to indemnify, defend, and hold harmless the other party against any claims, losses, or damages (including legal fees and costs) arising from its own breach of this DPA or data protection laws, except to the extent caused by the other party's actions or omissions.

To the maximum extent permitted by law, LuxeReply's total liability under this DPA shall be subject to the limitations and exclusions of liability set forth in the Terms of Service, unless otherwise required by law.

Governing Law and Jurisdiction

This Data Processing Agreement shall be governed by and construed in accordance with the laws of Greece, without regard to conflict of law principles.

Any dispute arising from or in connection with this DPA shall be subject to the exclusive jurisdiction of the courts located in Corfu, Greece.

This clause is without prejudice to any mandatory rights of Data Subjects or Supervisory Authorities under applicable Data Protection Laws.

Changes to This DPA

LuxeReply may update this Data Processing Agreement from time to time to reflect:

Changes in applicable Data Protection Laws,
Modifications to its services or processing practices, or
Updates to Sub-Processors or security measures.

Material changes (i.e., those affecting the scope, purpose, or legal basis of data processing, or Client rights or obligations) will be communicated to the Client via email or through the LuxeReply platform at least 30 days in advance, unless earlier enforcement is required by law.

The Client's continued use of the services after the effective date of any update shall constitute acceptance of the revised DPA. If the Client objects to any material change that substantially impacts their rights under applicable law, they may terminate the Agreement in accordance with the Terms of Service.

Electronic Acceptance

By clicking to accept during account registration, onboarding, or by continuing to use LuxeReply services after being presented with this DPA, the Client:

Acknowledges that they have read, understood, and agreed to this Data Processing Agreement;
Confirms that the individual accepting the DPA has the authority to bind the Client to its terms;
Agrees that this electronic acceptance shall have the same legal effect as a signed written agreement.

This method of acceptance complies with applicable electronic signature laws, including the eIDAS Regulation (EU), UK Electronic Communications Act, and ESIGN Act (USA).