Replexa
Version française Log in Try it free

Legal information

Data processing agreement (DPA)

Last updated: 25 October 2026

This agreement governs the processing of personal data that Replexa carries out on behalf of its customers, in accordance with Article 28 of Regulation (EU) 2016/679 (GDPR). It forms part of the terms of use and applies as soon as an account is created. A signed copy can be requested at support@replexa.eu.

1. Parties and roles

The customer, who imports data about its prospects and contacts into Replexa, acts as the controller. Replexa (see the legal notice) acts as the processor for that data. For the customer's own account data (users, billing), Replexa is the controller, as explained in the privacy policy.

2. Subject matter, duration, nature and purpose of the processing

  • Subject matter: providing the Replexa service, namely sending outreach email campaigns from the customer's mailboxes, reading and centralising replies, classifying them and suggesting responses with an artificial intelligence agent, and managing a knowledge base and the integrations chosen by the customer.
  • Duration: the term of the subscription, then until erasure as set out in section 10.
  • Operations: hosting, storage, consultation, sending, classification, analysis by an AI model, export and erasure.
  • Categories of data: business identity and contact details (first and last name, email, company, job title, phone number, website address), content of emails exchanged, information added by the customer (variables, notes, status), interaction data (opens, clicks, unsubscribes), knowledge base documents.
  • Data subjects: the customer's prospects and contacts, and the people who reply to them.
  • The customer undertakes not to import special categories of data within the meaning of Article 9 of the GDPR.

3. Customer instructions

Replexa processes this data only on the customer's documented instructions: the terms of use, this agreement, and the customer's settings and actions in the application or through the API. Replexa informs the customer if an instruction appears to infringe the GDPR or another data protection rule. Replexa does not use this data for its own purposes and does not use it to train AI models.

4. Confidentiality

Persons authorised to process the data on Replexa's behalf are bound by a duty of confidentiality. Access to a customer's data is limited to what is needed for operations, security and support requested by the customer.

5. Security

Replexa implements the measures required by Article 32 of the GDPR, including:

  • data hosted in the European Union and encrypted in transit (TLS) and at rest;
  • mailbox passwords, keys and tokens encrypted (AES-256-GCM, each secret bound to its workspace);
  • isolation of each workspace's data, enforced by the application and tested automatically;
  • two-factor authentication available, and enforceable per workspace;
  • roles and permissions per member, API keys with limited scopes;
  • audit log of sensitive actions, rate limiting and bot protection;
  • content of incoming emails treated as data, never as an instruction given to the AI agent.

6. Sub-processors

The customer authorises Replexa to use the sub-processors listed in the privacy policy. Replexa imposes on them by contract data protection obligations equivalent to those in this agreement and remains liable for their compliance. Replexa informs the customer by email at least 30 days before adding or replacing a sub-processor. The customer may object on data protection grounds; failing agreement, the customer may terminate its subscription at no cost for the remaining period.

7. Transfers outside the European Union

Where a sub-processor processes data outside the European Economic Area, the transfer relies on an adequacy decision, in particular the EU-US Data Privacy Framework for certified providers, or otherwise on the standard contractual clauses adopted by the European Commission. Details are in the privacy policy.

8. Assistance to the customer

Replexa assists the customer, as far as possible, in responding to requests from data subjects (access, rectification, erasure, objection, portability). The application already lets the customer find, edit, export and delete a lead, and block an address. Replexa also assists the customer in meeting its obligations regarding security, breach notification and impact assessments (Articles 32 to 36 of the GDPR), taking into account the information available to it.

9. Personal data breach

Replexa notifies the customer of any personal data breach affecting it without undue delay, and no later than 48 hours after becoming aware of it, with the information available: nature of the breach, categories and approximate number of data subjects and records concerned, likely consequences, measures taken or proposed. As the controller, the customer is responsible for notifying the supervisory authority and, where required, the data subjects.

10. End of processing

The customer can export its workspace data at any time, in JSON format. When the customer deletes the workspace, or at its written request to support@replexa.eu at the end of the subscription, the data is erased from the production database, then from backup copies within 30 days at most, unless the law requires it to be kept.

11. Information and audits

Replexa makes available to the customer the information needed to demonstrate compliance with this agreement and answers its reasonable security questionnaires. The customer may have an audit carried out, at its own expense, no more than once a year except after a data breach, with 30 days' notice, by an auditor bound by confidentiality, without access to other customers' data or harm to the security of the service.

12. Customer obligations

The customer warrants that it has a legal basis for each processing it entrusts to Replexa, in particular a documented legitimate interest for business-to-business outreach or consent where required, that it informs data subjects, honours their unsubscribes and objections, and only imports fairly collected data.

13. Governing law

This agreement is governed by Luxembourg law. The courts of Luxembourg City have exclusive jurisdiction. In the event of a conflict with the terms of use on personal data protection, this agreement prevails.