Data Processing Addendum

Version 1.0Effective September 15, 2026

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between Attune Systems, Inc. (“Attune”, “processor”) and the brand that accepts them (“you”, “controller”). It applies whenever Attune processes personal data of your customers on your behalf. It is accepted with the Terms of Service and does not require a separate signature.

1. Roles

For personal data of your customers that you make available to Attune, or that Attune reaches through your email or SMS provider, you are the controller and Attune is the processor. Attune is a separate controller for the data described in the Privacy Policy (your account data, and public reviews and community content Attune reads to understand products); that processing is not covered by this DPA.

2. Instructions

Attune will process your customers’ personal data only to provide the service as described in the Terms, as configured by you in the app, and as otherwise instructed by you in writing. We will tell you if we believe an instruction breaks the law, and we may stop processing until it is resolved.

3. Two processing modes

How much personal data Attune holds depends on how you configure delivery. The applicable row in the Schedule is determined by your configuration; nothing else in this DPA changes.

Mode 1: you send through your own provider (for example Klaviyo or Attentive). Attune sends your provider an opaque identifier for the customer plus the rendered message content. Your provider resolves the identifier to a contact and sends. Attune does not hold your customers’ email addresses or phone numbers in this mode. The identifier is pseudonymous, not anonymous; it remains personal data under GDPR because your provider can resolve it, and this DPA applies.

Mode 2: Attune sends directly. Attune holds the contact details needed to deliver messages (email address and/or phone number) together with order details you provide.

In both modes, if a customer replies to a message, the free-text reply is stored by Attune and may incidentally contain personal data the customer chose to include, such as an email address or phone number. We do not scrub replies. We treat reply text as personal data and it is covered by this DPA and the Schedule.

4. Confidentiality and personnel

Personal data is accessible only to Attune personnel who need it to provide the service, and who are bound by confidentiality obligations. Today that is the founder.

5. Security

Attune maintains technical and organisational measures appropriate to the risk, described on our Security page, which forms part of this DPA. Those measures include encryption in transit, access limited to authenticated personnel, and hosting with providers that maintain their own recognised security certifications.

6. Subprocessors

You authorise Attune to use the subprocessors listed at /subprocessors, which is incorporated into this DPA. We will notify your account’s admins by email at least 30 days before a new subprocessor begins processing your customers’ personal data. If you object on reasonable data-protection grounds within that period and we cannot resolve the objection, you may terminate the affected service and receive a pro-rated refund of prepaid fees. Attune remains responsible for its subprocessors’ performance.

7. Data subject requests

If a customer of yours sends Attune a request to access, correct, delete, or port their data, we will forward it to you within 5 business days and will not respond directly except to acknowledge receipt and point them to you. We will assist you in responding, using the tools in the app where they exist and manually where they do not.

8. Personal data breach

If we become aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to your customers’ personal data, we will notify your account’s admins without undue delay and in any event within 72 hours of becoming aware, with the information we have at the time and updates as we learn more. Notification is not an admission of fault.

9. Audit

On written request no more than once per year, we will provide the information reasonably necessary to demonstrate compliance with this DPA, which may include our security documentation and any third-party reports we hold. On-site audits are not offered at this time. If a regulator requires more, we will cooperate reasonably at your expense.

10. Deletion and return

On termination of the service, and after the 30-day export window in the Terms, we will delete your customers’ personal data from our systems within 30 days, and from backups within 90 days, unless law requires retention. You may request deletion earlier from the app. We will confirm deletion on request.

11. Liability

Each party’s liability under this DPA is subject to the limitation of liability in the Terms of Service, and the cap there applies to the Terms and this DPA together, not separately.

12. Precedence

Where this DPA conflicts with the Terms on the subject of personal data, this DPA controls. Where mandatory data-protection law conflicts with this DPA, the law controls.

Schedule: details of processing