Data Processing Agreement

1. Scope

This DPA forms part of the Terms of Service between you ("Controller") and Aventura Virtual Solutions Inc. ("Processor"). It applies to personal data contained in the files you upload and the results derived from them ("Customer Data"). This version is dated 2 October 2026.

2. Subject matter and duration

We process Customer Data solely to provide the matching and reporting service, for as long as your account is active and within the retention set out in section 9 — or until you delete the data, whichever comes first.

3. Nature of the processing

4. Health information, and what not to upload

CloseRev does not sign business associate agreements (BAAs), and you must not upload protected health information (PHI) as HIPAA defines it — for example a diagnosis, a treatment, insurance details or an appointment tied to a patient. A sale record with a name, phone number, email address, amount and date for a service that says nothing about anyone's health is fine. If you are a health provider, leave out anything that reveals a person's health, including a service name or campaign that does. The same applies to other special-category data, payment card numbers and government identifiers; our Acceptable Use Policy has the full list.

5. Our obligations

• Process Customer Data only on your documented instructions — using the product is such an instruction.
• Tell you promptly if, in our opinion, an instruction would infringe data protection law, and not act on it until it is confirmed or changed.
• Never sell it, use it for our own marketing, or use it to train machine-learning models.
• Bind everyone with access to confidentiality.
• Apply the technical and organizational measures in section 7.
• Help you respond to data-subject requests, and with DPIAs and regulator consultations where relevant.
• Notify you without undue delay, and in any case within 72 hours of becoming aware, of a personal data breach affecting your data.
• Delete or return Customer Data on termination, per section 9.

6. Your obligations

You confirm you have a lawful basis to collect the data and to have us process it, that you've given any notices your customers are owed, and that you upload only the fields the service needs.

7. Security measures

• Encryption in transit (TLS 1.2+) and at rest.
• Per-workspace isolation, with every query scoped so one tenant cannot reach another's records.
• Passwords hashed with scrypt at OWASP's recommended parameters with per-password salts, and refused if they appear in known breach corpora; sessions are opaque, expiring, server-revocable and stored only as a hash, with a seven-day inactivity limit.
• Single-use, expiring, hashed tokens for email verification and password reset.
• Card data never touches our servers — payment is handled entirely by Stripe.
• An audit log of uploads, matches, overrides, exports and deletions within each workspace.
• Least-privilege access for staff, granted only where needed to operate or support the service.
• Every access to a customer account by CloseRev staff is recorded in a tamper-evident log — who, what was viewed, and when — and the internal console requires single sign-on with multi-factor authentication and cannot read uploaded records.
• Optional workspace-wide two-factor requirement, so a Controller can require every user who reaches its data to hold a second factor.

8. Sub-processors

You give general authorization for the sub-processors listed on our Subprocessors page. Before adding or replacing one we will email the owner of every workspace at least 30 days in advance. You may object on reasonable data-protection grounds within that period; if we cannot resolve the objection, you may terminate the affected service and receive a pro-rata refund of fees paid for the period after termination. Each sub-processor is bound by terms no less protective than these.

9. Retention, deletion and return

Customer Data is kept for your workspace's retention window — 6 months on Starter, 13 on Growth, and 24 on Enterprise and Agency and during a free trial; you can shorten it in Settings, and at your request we can extend it to up to 36 months. A nightly job deletes each import once it is older than the window. Deleting an import yourself removes its records, its match results and the original uploaded file from storage at once, and closing the account that owns a workspace deletes the workspace and all of its Customer Data. Deleted data leaves our database backups within 30 days, when they age out; uploaded files are not kept in those backups at all. You can export your data at any point before deletion. We keep nothing beyond this except where law requires it.

10. International transfers

We are established in Canada, which the European Commission recognizes as providing adequate protection for commercial organizations subject to PIPEDA. Where Customer Data is transferred from the EEA, the UK or Switzerland to a sub-processor outside an adequate jurisdiction, the transfer relies on the Standard Contractual Clauses adopted by the European Commission in 2021, together with supplementary technical measures including encryption.

Where a transfer between you and us needs the Standard Contractual Clauses — because it is not covered by an adequacy decision — they are incorporated into this DPA by reference: Module 2 (controller to processor) where you are the controller, and Module 3 (processor to processor) where you are yourself a processor acting for your own client. Clause 9 Option 2 (general written authorization) applies, with the notice in section 8, and the annexes are completed by sections 3, 7 and 8 of this DPA and our Subprocessors page. For transfers from the United Kingdom, the International Data Transfer Addendum issued by the UK Information Commissioner applies alongside them. For transfers from Switzerland, they apply with the amendments the Swiss Federal Data Protection and Information Commissioner requires: references to the GDPR are read as the Swiss Federal Act on Data Protection, the Commissioner is the competent supervisory authority for transfers governed by Swiss law, and people in Switzerland may enforce their rights there. If anything in this DPA conflicts with those clauses, the clauses prevail.

We carry out a transfer impact assessment before adding any sub-processor outside an adequate jurisdiction, covering the destination country's access laws, the nature of the data and the technical measures protecting it, and we keep the assessment on file. If you need a copy for your own records, email legal@closerev.com. If an assessment concludes that a transfer can no longer be adequately protected, we will change the arrangement or stop the transfer rather than continue it.

Our representative in the Union under Article 27 of the GDPR is CONSTANTLY CURIOUS, LDA, Avenida dos Combatentes, n.º 43, 5.º B, São Domingos de Benfica, 1600-042 Lisboa, Portugal, telephone +351 936 661 068. Supervisory authorities and data subjects may address them in addition to, or instead of, us. It does not change who is accountable under this DPA, which remains Aventura Virtual Solutions Inc.

11. United States: service-provider terms

Where the California Consumer Privacy Act as amended by the CPRA, or a comparable US state law, applies, we act as your service provider (or processor) for Customer Data, and:

• we do not sell or share it, as those laws define selling and sharing;
• we do not retain, use or disclose it for any purpose other than providing the service to you, or outside the direct business relationship between you and us;
• we do not combine it with personal information we receive from anyone else or collect ourselves, except as those laws permit a service provider to;
• we comply with those laws and give Customer Data the same level of protection they require of you;
• we will tell you if we can no longer meet these obligations; and
• you may take reasonable and appropriate steps to stop and remedy any use of Customer Data that these terms do not allow, including the audits in section 12.

12. Audits and inspections

On reasonable written request we will make available the information needed to demonstrate compliance with this DPA — first our own documentation: the Security page, our record of processing, and answers to your questionnaire. If that does not settle the question, you or an independent auditor you appoint may carry out an audit, including an inspection, on reasonable written notice, during business hours, no more than once a year unless a personal data breach or a supervisory authority requires otherwise, at your cost, and under a confidentiality agreement that protects our other customers' data and our security. We will cooperate in good faith.

13. Signature

Accepting the Terms of Service accepts this DPA — no signature required. If your compliance process needs a countersigned copy or your own paper, email legal@closerev.com.