Data Processing Agreement (DPA)

This Data Processing Agreement ("DPA") forms part of the agreement between Nextgrid Digital, operating RevCollect ("Processor"), and the customer entity that accepts RevCollect's Terms of Service ("Controller"). It applies when the Controller processes personal data subject to the GDPR, UK GDPR, or similar laws and uses RevCollect to process that data on the Controller's behalf.

Processor will process personal data only to provide the RevCollect collections follow-up service for the duration of the subscription and for up to 30 days after termination for data export and deletion, unless law requires longer retention.

• Syncing invoice and contact data from accounting integrations.
• Sending and receiving collection emails on behalf of the Controller.
• AI-assisted reply classification and draft generation (inference only).
• Reporting on outstanding balances and collection activity.

Contact details, financial account data, email content, and behavioral metadata as described in our Privacy Policy.

The Controller's clients (debtors), the Controller's employees and contractors who use RevCollect, and individuals who correspond via collection emails.

• Process personal data only on documented instructions from the Controller.
• Ensure persons authorized to process data are bound by confidentiality.
• Implement appropriate technical and organizational measures (see Security page).
• Assist the Controller with data subject requests within 30 days.
• Notify the Controller of a personal data breach within 72 hours.
• Delete or return all personal data after termination, subject to legal retention.
• Make available information necessary to demonstrate compliance.

Controller authorizes Processor to engage sub-processors listed at /sub-processors. Processor will notify Controller of material changes. Controller may object on reasonable grounds relating to data protection.

Where personal data is transferred outside the EEA or UK, Processor relies on Standard Contractual Clauses or equivalent mechanisms provided by sub-processors.

Processor uses commercial AI APIs (Anthropic, OpenAI) for inference only. Customer data is not used to train or fine-tune models. This processing is disclosed in the sub-processor list.

By using RevCollect, Controller agrees to this DPA. For a countersigned copy, email legal@revcollect.app.