Effective date: 14 November 2026. This agreement replaces any earlier data processing terms published by us. A document signed on our behalf under section 14 applies as that document states.
1. Scope and parties
This Data Processing Agreement ("DPA") is between Reoon Technology ("Reoon", "we", "us"), Akhalia, Sylhet 3100, Bangladesh, and you, the customer. It covers the personal data you submit to the services listed in Annex 1 and the results we produce from it ("Customer Data"). You act as controller and we act as your processor; where you process the data for your own clients, you act as processor and we act as your sub-processor. Where a law uses other terms, such as "business" and "service provider", they apply accordingly. This DPA forms part of our Terms and Conditions and applies automatically from the first time you submit personal data to a listed service; nothing needs to be signed. Save or print this page for a dated copy. "Support" means our support page, which is also our contact point for questions, requests, objections and notices under this DPA. Unless this DPA says otherwise, our notices to you go to your account email address, so please keep it up to date. "Data Protection Laws" means every data protection and privacy law that applies to the processing, wherever you are. "GDPR" means the EU General Data Protection Regulation (Regulation (EU) 2016/679). This DPA does not cover your own account data, which we hold as described in our Privacy Policy, or payment data, which our merchant of record (currently PayPro Global, or any other merchant of record we appoint) handles as its own controller.
2. Roles, instructions and your obligations
We process Customer Data only on your documented instructions, including with regard to transfers, unless a law that applies to us requires otherwise; in that case we tell you before processing, unless that law forbids it. Your instructions are the Terms, this DPA, and the settings and actions you choose in the service; together with any request we agree to in writing as described below, they are your complete instructions. Our service works automatically and in the same way for every customer, so you give instructions by choosing among the options the service offers. If you need something the service does not offer, you are welcome to ask support, and we will let you know whether we can do it; such a request becomes an instruction once we have agreed to it in writing. If we cannot follow an instruction, or believe it breaks Data Protection Laws, we will tell you promptly and may pause the processing concerned. You are responsible for having a lawful basis for the data you submit, for giving the people concerned any notice the law requires, and for making sure your instructions are lawful. You are also responsible for keeping your account, passwords and API keys secure, for the people you give access to, and for what you choose to include in the data you submit. By using the service, you confirm that the measures in Annex 2 are appropriate for that data. Where you act for your own clients, you confirm that your instructions, including your use of us as your sub-processor, are authorised by them.
3. Confidentiality and personnel
We treat Customer Data as confidential. Only authorised members of our team can access it, and only where their work on the service requires it. Everyone with such access is bound by a duty of confidentiality, and the providers that process Customer Data for us are bound by equivalent obligations, as section 5 describes. We use Customer Data only to provide the service to you, as section 2 describes, and never for purposes of our own. We never sell it, never share it with third parties for their own use, and never use it for advertising or to send email. We do not keep or reuse it to develop or improve our services. If a public authority asks us for Customer Data, we disclose it only where the law requires it and only as far as required, and we tell you about the request promptly unless the law forbids it.
4. Security
Protecting Customer Data is a priority for us. We protect it with appropriate technical and organisational measures, designed to give a level of security appropriate to the risk, as described in Annex 2. These include encryption of Customer Data in transit and at rest, and access limited to authorised staff who need it. We may update these measures as technology and risks change, and we never reduce the overall level of protection below what Data Protection Laws require. No online service can be completely secure, so these measures cannot guarantee absolute security.
5. Sub-processors
You give us general authorisation to use providers that process Customer Data for us (sub-processors). Annex 3 describes the categories we use now, and the current list of providers is available from support on request. At least 15 days before we add or replace a provider that processes Customer Data, we tell you by email to your account email address or inside the service. You may object on reasonable data protection grounds by writing to support within that period; if you do not, you accept the change. Where you act for your own clients, you pass our notice on to them and send us their objections within that period. If we cannot resolve your objection before the change takes effect, you may end the affected service by notice to us, and we will not charge you anything further for it; if you keep using the service after that date, you withdraw your objection and accept the change. We bind each provider by a written contract to data protection obligations equivalent to this DPA and remain responsible to you for their performance of those obligations.
6. International transfers
Customer Data is stored and processed in the European Union. Our team accesses it from Bangladesh, and some processing may pass through other countries without the data being kept there, as Annex 1 describes for each service. Where your Data Protection Laws require a transfer tool for this, the following apply and are incorporated into this DPA by reference:
- The standard contractual clauses adopted by the European Commission in Decision (EU) 2021/914: Module Two where you are a controller and Module Three where you are a processor. Clause 7 (docking) is not included; for Clause 9, Option 2 (general written authorisation) applies, with the notice period in section 5; the optional wording in Clause 11 is not included; for Clause 17, Option 1 applies, with the member state set by the rule below. For Clause 13, Clause 17, Clause 18(b) and Annex I.C, the member state is the one in which you are established (where you are established in more than one, the one of your main establishment) or, where you have no establishment in the European Union, the one in which your representative under Article 27(1) of the GDPR is established or, where you have none, the one in which most of the people whose data you transfer are located. Annex 1 of this DPA serves as Annex I and Annex 2 as Annex II of the clauses; for Clause 9, the agreed list of sub-processors is the current list of providers available from support on request, whose categories Annex 3 describes; you are the data exporter and we are the data importer, each identified by your account details and our details in section 1.
- For transfers subject to UK data protection law, the International Data Transfer Addendum to the EU clauses issued by the UK Information Commissioner (version B1.0), with Tables 1 to 3 completed by the information above and, in Table 4, neither party able to end the Addendum under its section 19.
- For transfers subject to Swiss data protection law, the clauses apply with the adjustments required by the Swiss Federal Data Protection and Information Commissioner: references to the GDPR are read as references to the Swiss Federal Act on Data Protection for the transfers it governs; the Commissioner is the competent authority for those transfers, alongside the authority under Clause 13 where the GDPR also applies; the term member state does not prevent people who habitually live in Switzerland from enforcing their rights there; and for transfers subject only to Swiss law, Clause 17 and Clause 18(b) refer to Switzerland.
The text of the clauses and of the Addendum is published by the European Commission and the UK Information Commissioner and is available from us on request. On request we also provide the information about our processing that you need for a transfer assessment.
Where the clauses or the Addendum apply under this section, each of us is treated, by accepting this DPA, as having signed them, including their annexes, on the day this DPA first applies to you, which is also the start date of the Addendum. Our contact point for them is our support page, and yours is your account email address.
7. Assistance
Taking into account the nature of the processing and the information available to us, we help you, as far as reasonably possible, to respond to requests from the people whose data you submit, and with your security, breach notification, impact assessment and prior consultation obligations, where you need information or help that the service does not already give you. If a person whose data you submitted contacts us directly with a request, we do not answer it ourselves unless you authorise us to or the law requires it. Where we can tell which customer the request concerns, we pass it on to you promptly; otherwise we ask the person to contact the organisation that holds their data. We may charge a reasonable cost, agreed with you in advance, for help that the service does not already provide, unless the law does not allow a charge.
8. Personal data breaches
We take the protection of Customer Data seriously and work to prevent personal data breaches through the measures in section 4 and Annex 2. If we become aware of a personal data breach affecting Customer Data, we tell you without undue delay, with the information we have at the time, keep you informed as we learn more, and take appropriate steps to contain the breach and limit its effects. Our notice describes, as far as we know at the time, what happened, the kinds of data and the approximate number of people affected, the likely consequences, and the steps taken or proposed. A notice under this section is not an admission of fault or liability.
9. Deletion and return
Customer Data is deleted under each service's own rule in Annex 1. When a service ends, we delete or return the Customer Data still held, at your choice, and delete anything remaining within 30 days of the end, unless the law requires us to keep it. This period never extends a service's own shorter rule. Returning data means making it available for you to download from the service, where the service allows, while it is still held. On request, we confirm in writing that Customer Data has been deleted. If the law requires us to keep any Customer Data, we keep protecting it under this DPA and use it only as that law requires. This section applies to Customer Data only. Your account data is outside this DPA: ending a service does not by itself delete it, and we keep or delete it as our Privacy Policy describes.
10. Audits and information
We make available the information needed to show compliance with this DPA, answering your questions and providing documentation first. An inspection is available only where Data Protection Laws require it, once in any 12 months (unless those laws or the standard contractual clauses require more, for example where there is reason to believe this DPA is not being followed), on reasonable prior notice, during our business hours, under confidentiality, without disrupting the service, and at your cost. It may be carried out by you or by an independent auditor you appoint who is bound by confidentiality and is not one of our competitors. It covers our own systems and records for Customer Data; for our providers, we give you the information they make available to us. We hold no third party certification and promise none.
11. Service provider terms
Where your Data Protection Laws treat us as a service provider, contractor or processor, you disclose Customer Data to us, and we process it, only for the specific purposes described in Annex 1, which are to provide the service to you, and for no other purpose, except as those laws allow, for example to comply with the law. We do not sell or share it. We do not retain, use or disclose it for any other purpose, including any other commercial purpose, or outside our direct business relationship with you. We do not combine it with other personal data except as those laws allow. We comply with the obligations those laws place on us and give Customer Data the level of privacy protection they require. We help you respond to requests from the people concerned, as section 7 describes, and we tell you if we can no longer meet these obligations. You may take reasonable and appropriate steps, including those in section 10, to make sure we use Customer Data in line with your obligations under those laws, and to stop and remedy any unauthorised use. We understand these restrictions and will comply with them.
12. Liability and precedence
Our liability under this DPA is subject to the exclusions and limits of liability in Part A item 13 of the Terms (Limitation of liability) and to the claim periods in Part A item 15 (Resolving problems and governing law), except where the standard contractual clauses or Data Protection Laws do not allow this, and without affecting the rights of the people whose data is processed. Your liability to us is not limited by this section. If documents conflict, the standard contractual clauses prevail over this DPA, and this DPA and Annex 1 prevail over the Terms and the Privacy Policy for the Customer Data they cover.
13. Term and changes
This DPA applies for as long as we process Customer Data for you. We may change it. Changes are posted on this page with a new effective date and apply from that date; if you keep using the services after it, you accept the change. We may also tell you about a change by email or inside the service. Where the law requires advance notice of a change, we give it before the change applies to you. No change alters the text of the standard contractual clauses or of the UK Addendum, and no change reduces the protection of Customer Data below what Data Protection Laws require.
14. Copies
This page, as published and changed under section 13, is the agreement between us, and nothing needs to be signed. You can save or print a dated copy for your records. If your organisation needs a signed copy or different terms, you can ask support, and we consider such requests case by case. Different terms apply only if they are set out in a document signed on our behalf, and then only as that document states; otherwise this page applies as published, including the changes described in section 13.
Annex 1. The services and the processing
1. Reoon Email Verifier (dashboard, bulk upload, API, plugin)
- Subject matter, nature and purpose: verifying whether the email addresses you submit exist and how risky they are, in order to deliver the results to you, including resolving problems with the service and checking, when needed, that a verification was done correctly.
- Types of data and categories of people: the email addresses you submit, any other columns of an uploaded file, and the results; the people whose addresses you submit, typically your contacts, customers or leads.
- Sensitive data: none intended. The service only needs email addresses, so you should remove any sensitive data, including special categories of personal data, from a file before you upload it.
- Frequency: continuous, whenever you submit data.
- Our role: processor, or sub-processor where you act for your own clients.
- Duration, retention and deletion: for as long as you use the service. Everything you submit, whether a list, a single check or an API call, is deleted automatically, together with its results, 15 days after submission, and cannot be recovered after that, including from backups. You can delete bulk verification data yourself at any time from the task page; to delete other data earlier, ask support.
- What remains: a record of the task with basic statistics, such as how many addresses were submitted, how many were verified and when. It contains none of the data you submitted, forms part of your account data and is kept as our Privacy Policy describes.
- Where processed: stored and processed in the European Union. The service checks the data automatically. Our team, based in Bangladesh, does not look at it unless that is needed to resolve a problem or to check that a verification was done correctly, and then only authorised staff do. To check an address, the service has to contact the mail system that handles it, and a check may pass through other countries without the data being kept there.
- Providers used: the categories in Annex 3.
Desktop applications are covered by the Privacy Policy and not by this DPA.
Annex 2. Security measures
- Encryption of Customer Data in transit and at rest.
- Access to Customer Data limited to authorised staff who need it.
- Staff confidentiality obligations.
- Protection of the services against unauthorised access and misuse.
- Backups to keep the services available, subject to the deletion rules in Annex 1.
- Handling of incidents affecting Customer Data as described in section 8.
- Help with requests from the people concerned: you can delete bulk data yourself from the task page, and we delete other data when you ask through support.
- Automatic deletion under the rules in Annex 1.
Annex 3. Categories of providers
- Hosting and network providers.
- Content delivery and security network.
- Communication tools for email delivery and support.
We use each provider only for its part of the service described in Annex 1, and only for as long as that requires. The current list of providers is available from support on request.