Data Processing Agreement

Last updated 12 October 2026

This agreement sets out how Repli AI Pty Ltd (ABN 51 674 082 896) processes personal information on a brand's behalf when the brand uses the Repli AI platform. It supplements our Terms of Service, or a signed agreement between us where one exists, and forms part of that agreement automatically from the date the brand starts using the platform. There is nothing further to sign for this document to apply.

1. Definitions
2. Roles and scope
3. Processing instructions
4. Confidentiality
5. Security measures
6. Sub-processors
7. International transfers
8. Assistance with data subject requests
9. Personal data breaches
10. Deletion and return of data
11. Audit
12. Liability
13. Term and governing law
14. Annex 1: description of processing
15. Annex 2: technical and organisational measures
16. Annex 3: sub-processors

1. Definitions

"Applicable Data Protection Law" means the privacy and data protection laws that apply to the processing of personal data under this agreement, including the Privacy Act 1988 (Cth), the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the UK GDPR as it forms part of UK law. "Brand", "you" and "your" mean the business using the platform. "Controller", "processor", "data subject", "personal data", "processing" and "personal data breach" have the meanings given in the GDPR, applied equally under other Applicable Data Protection Law. "Platform" has the meaning given in our Terms of Service. "Services" means the platform and any services we provide under a signed agreement, such as our Master Services Agreement. "Sub-processor" means another company we engage to process personal data on your behalf in order to provide the Services.

2. Roles and scope

This agreement applies whenever we process personal data about your customers or other individuals as part of providing you the Services. In that processing, you are the controller and we are the processor. We are not responsible for your compliance with Applicable Data Protection Law generally, only for our own obligations as a processor set out here. Annex 1 describes the subject matter, duration, nature, purpose, and the categories of data subjects and personal data involved.

This agreement does not apply to personal data we collect about you or your team as our own customer, for example your account and billing details, which we handle as controller under our privacy policy.

3. Processing instructions

We will process personal data only on your documented instructions, which consist of this agreement, the Terms of Service, and any configuration you make in the platform, such as connecting a channel, setting up an automation, or asking our team to build your setup. If we believe an instruction breaches Applicable Data Protection Law, we will tell you before carrying it out. We will not process personal data for our own purposes, and in particular will not use it to train AI models of our own, as set out in our Terms of Service.

We will ensure that people authorised to process personal data under this agreement, including our staff and contractors, are bound by confidentiality obligations.

4. Confidentiality

We will keep personal data confidential and will not disclose it to a third party except as this agreement allows, as you instruct, or as the law requires. This section supplements, and does not replace, the confidentiality obligations in our Terms of Service.

5. Security measures

We apply the technical and organisational measures described in Annex 2, appropriate to the risk of the processing. We keep these measures under review and may update them provided they do not materially reduce the level of protection.

6. Sub-processors

You authorise us to engage the sub-processors listed in Annex 3 to provide the Services. We will impose data protection terms on each sub-processor that are no less protective than this agreement, and remain responsible to you for their performance. We will update Annex 3, and the sub-processor table in our privacy policy, before a new sub-processor begins processing your customers' personal data, and will tell account owners by email when we do. If you object to a new sub-processor on reasonable data protection grounds, tell us within 14 days of that notice and we will work with you to address the objection, which may include not proceeding with that sub-processor for your account.

7. International transfers

Personal data processed under this agreement is stored on Microsoft Azure in Sydney, Australia. Some sub-processors listed in Annex 3 are located in the United States, so providing the Services involves transferring personal data from Australia to the United States.

Where personal data of a data subject in the European Economic Area is transferred to a country the European Commission has not recognised as providing adequate protection, the transfer is governed by the Standard Contractual Clauses approved by the European Commission under Commission Implementing Decision (EU) 2021/914 of 4 June 2021, Module Two (Controller to Processor), which the parties agree to enter into and which are incorporated into this agreement by reference. The official text of those clauses is published by the European Commission and is not reproduced here; a brand that requires the completed clauses as a standalone signed document can request one from us. Annex 1 and Annex 2 of this agreement serve as Annex I and Annex II to those clauses.

Where personal data of a data subject in the United Kingdom is transferred to a country the UK has not recognised as providing adequate protection, the transfer is governed by the UK's International Data Transfer Addendum to the EU Standard Contractual Clauses, issued by the UK Information Commissioner's Office, which the parties agree to enter into and which is incorporated into this agreement by reference on the same basis as the previous paragraph.

8. Assistance with data subject requests

Where a data subject contacts us directly to exercise a right under Applicable Data Protection Law, such as access, correction, deletion, restriction, portability or objection, we will pass the request to you promptly and will not respond to it ourselves, unless you ask us to. We will give you reasonable assistance, having regard to the nature of the processing, so that you can respond to the request within the time Applicable Data Protection Law requires.

9. Personal data breaches

We will notify you without undue delay after becoming aware of a personal data breach affecting personal data we process on your behalf, with the information we have at the time and reasonable further detail as our investigation continues. We will take reasonable steps to contain and remediate the breach. You remain responsible for notifying any regulator or affected individuals where Applicable Data Protection Law requires it.

10. Deletion and return of data

When your use of the Services ends, we will, at your request, delete or return the personal data we hold on your behalf, on the terms set out in our Terms of Service: we delete it from our live systems within 30 days of your request, and copies in backups expire afterwards on a rolling basis. We may retain personal data where the law requires it, for no longer than that requirement lasts.

11. Audit

On reasonable written notice, and no more than once in any 12-month period unless Applicable Data Protection Law or a regulator requires otherwise, you may request information reasonably necessary to demonstrate our compliance with this agreement, and we will provide it or make it available for review. If you reasonably require an on-site audit, we will agree its scope, timing and cost with you in advance; it must not disrupt our operations or expose other customers' data, and anyone conducting it must be bound by confidentiality.

12. Liability

Each party's liability arising out of this agreement, however it arises, is subject to the liability provisions of our Terms of Service, or the signed agreement between us where one exists, as if this agreement were part of it. Nothing in this agreement expands either party's liability beyond what that document sets out.

13. Term and governing law

This agreement takes effect when you start using the Services and continues for as long as we process personal data on your behalf under the Terms of Service or a signed agreement between us, after which sections 4, 9, 10, 11 and 12 continue to apply as needed. It is governed by the laws of Victoria, Australia, on the same basis as our Terms of Service.

14. Annex 1: description of processing

Subject matter. Repli AI's processing of personal data on the brand's behalf in the course of providing the customer service platform, and, where engaged, building the brand's setup under our Master Services Agreement.

Duration. For as long as the brand uses the Services, and afterwards only as needed to complete deletion or return of data under section 10.

Nature and purpose of processing. Receiving customer messages from the brand's connected channels; storing and displaying them to the brand's team; drafting reply suggestions and sending the replies the brand's team chooses to send; running automations the brand configures; searching the brand's knowledge base; importing past conversations from a connected mailbox; running live chat on the brand's storefront and emailing chat shoppers verification codes, replies and chat copies from the brand's connected mailbox; making order changes in the brand's Shopify store; hiding comments; answering the brand's team's questions in the in-app assistant; and providing account, billing and support functions.

Categories of data subjects. The brand's customers and prospective customers who contact the brand through a connected channel, customers whose details are in the brand's connected Shopify store, and people the brand's team emails from the platform.

Categories of personal data. Name, email address, phone number, social media account names and identifiers, delivery address, order history and order details, and the content of messages the data subject sends, which may include any other information they choose to include. Repli AI does not deliberately collect special categories of personal data and asks brands not to send it unless a conversation genuinely requires it.

15. Annex 2: technical and organisational measures

• Encryption of personal data in transit and at rest.
• Sign-in through Clerk, with each user able to reach only the organisations they belong to.
• Access tokens for connected accounts encrypted with keys held in Azure Key Vault.
• Separate production and testing environments.
• Monitoring of the platform for errors and performance problems.
• Confidentiality obligations on staff and contractors with access to personal data.
• Contracts with every sub-processor listed in Annex 3.

16. Annex 3: sub-processors

This list covers sub-processors engaged to deliver the Services. It does not include a channel a brand connects directly, such as Google, Microsoft, Meta or Shopify, which the brand authorises in its own right, as described in our privacy policy.