Updated Oct 2026

Data Processing Agreement

Version 1.0 · Last updated: 26 October 2026

This Data Processing Agreement (“DPA”) forms part of the Prisma Terms of Service between you (“Customer”, the controller) and Sopa Lab SL (“Sopa”, the processor). It applies when Sopa processes personal data on your behalf to provide the Prisma reviews API, and sets out the terms required by Article 28 of the General Data Protection Regulation (EU) 2016/679 (“GDPR”).

1. Parties

• Controller: the Customer identified in the Prisma account. Where the Customer is an agency acting for its own clients, the agency acts as processor for those clients and Sopa acts as its subprocessor; the agency is responsible for having an equivalent agreement with each client.
• Processor: Sopa Lab SL, tax ID B23884570, Calle Reina Mercedes 1, 7º D, 28020 Madrid, Spain. Contact: privacy@prismareviews.com.

2. Definitions

Terms such as “personal data”, “processing”, “controller”, “processor”, “data subject”, “personal data breach” and “supervisory authority” have the meaning given in the GDPR. “Subprocessor” means any processor engaged by Sopa to process Customer Personal Data. “Customer Personal Data” means personal data processed by Sopa on behalf of the Customer under the Terms.

3. Subject matter, duration, nature and purpose

• Subject matter: providing the Prisma API, dashboard and webhooks to read and reply to reviews of locations and apps the Customer owns or manages.
• Duration: the term of the Customer’s subscription, plus the deletion period in section 12.
• Nature: collection from connected platforms, storage, structuring, retrieval, transmission (API responses, webhooks, replies to platforms) and deletion.
• Purpose: solely to provide the service to the Customer as described in the Terms and the Customer’s documented instructions.

Details are in Annex I.

4. Customer instructions

Sopa processes Customer Personal Data only on the Customer’s documented instructions, including with regard to international transfers. The Terms, this DPA and the Customer’s use of the API and dashboard are the Customer’s complete instructions. Sopa will inform the Customer immediately if, in its opinion, an instruction infringes the GDPR or other data protection law. If Sopa is required by EU or Member State law to process data otherwise, it will inform the Customer first unless that law prohibits it.

5. Customer obligations

The Customer confirms that it has a lawful basis to process the personal data in the reviews of its locations and apps, that it is entitled to connect those accounts, and that its instructions comply with data protection law and the terms of each platform.

6. Confidentiality

Sopa ensures that everyone authorised to process Customer Personal Data has committed to confidentiality or is under a statutory obligation of confidentiality, and accesses the data only as needed to provide the service, for security, or to comply with the law.

7. Security

Sopa implements the technical and organisational measures in Annex II, appropriate to the risk as required by Article 32 GDPR. Sopa may update them as long as the overall level of protection is not reduced.

8. Subprocessors

• The Customer gives general authorisation for Sopa to engage subprocessors. The current list is in Annex III and on our Security page.
• Sopa will notify the Customer of any intended addition or replacement at least 30 days in advance by email. The Customer may object on reasonable data-protection grounds within that period. If the parties can’t resolve the objection, the Customer may terminate the affected service and receive a pro-rata refund of prepaid fees.
• Sopa imposes on each subprocessor, by contract, data protection obligations equivalent to those in this DPA, and remains fully liable to the Customer for their performance.

9. International transfers

Sopa processes Customer Personal Data in the European Union, and with the subprocessors in Annex III. Sopa will only transfer Customer Personal Data outside the European Economic Area where an adequacy decision applies or under the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, with supplementary measures where required.

10. Assistance

Taking into account the nature of the processing, Sopa will:

• help the Customer respond to data subject requests (access, rectification, erasure, restriction, portability, objection), by providing API and dashboard functions and, where needed, reasonable assistance. Sopa will forward to the Customer any request it receives directly and will not answer it unless authorised;
• help the Customer meet its obligations under Articles 32 to 36 GDPR (security, breach notification, data protection impact assessments and prior consultation).

11. Personal data breaches

Sopa will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, as far as known, the nature of the breach, categories and approximate number of data subjects and records, likely consequences, and measures taken or proposed. Sopa will update the Customer as more information becomes available.

12. Deletion or return

When the Customer disconnects a location or app, or at the end of the service, Sopa will delete the related Customer Personal Data within 30 days, unless EU or Member State law requires storage. Before closing the account, the Customer can export its data through the API. Backups are overwritten within 30 days.

13. Audits

Sopa will make available all information necessary to demonstrate compliance with Article 28 GDPR and allow audits, including inspections, by the Customer or an auditor it mandates. Audits must be requested with at least 30 days’ notice, take place during business hours, no more than once per year unless required by a supervisory authority or following a breach, and be subject to confidentiality. Sopa may first answer through documentation, questionnaires and any certifications or reports it holds (it holds none yet).

14. Platform-specific restrictions

Where Customer Personal Data is received from Google APIs, Sopa will also comply with the Google API Services User Data Policy, including the Limited Use requirements, as described in the Privacy Policy. Equivalent restrictions apply under the terms of Trustpilot, Apple and Google Play.

15. Liability and precedence

Each party’s liability under this DPA is subject to the limitations in the Terms, except where the GDPR provides otherwise. If this DPA conflicts with the Terms on data protection, this DPA prevails.

16. US state privacy laws

Where the California Consumer Privacy Act (CCPA) or a similar US state privacy law applies, Sopa is the Customer’s “service provider”, “contractor” or “processor” for Customer Personal Data, and Sopa:

• won’t sell or share it, as those terms are defined in those laws;
• won’t retain, use or disclose it for any purpose other than providing Prisma under the Terms, or outside the direct business relationship with the Customer;
• won’t combine it with personal information from other sources, except as those laws allow;
• will comply with those laws, give the same level of privacy protection they require, and tell the Customer if it can no longer meet its obligations.

The Customer may take reasonable steps to stop and remediate any unauthorized use of Customer Personal Data. Sopa certifies that it understands and will comply with these restrictions.

17. Governing law

This DPA is governed by Spanish law, and the courts of Madrid, Spain, have jurisdiction, without prejudice to the rights of data subjects and the powers of supervisory authorities.

Annex I — Description of the processing

Annex II — Technical and organisational measures

• Encryption in transit (TLS 1.2+) and at rest (AES-256).
• Application-level encryption of OAuth tokens and platform credentials.
• API keys stored hashed; keys rolled (replaced) from the dashboard, which shows the new key once.
• Account passwords stored only as a hash; email verification before keys are issued; first-party HttpOnly session cookies that expire after at most 7 days.
• Role-based access to production, least privilege, multi-factor authentication, access logging.
• Logical separation of customer data by workspace.
• Daily encrypted backups, retained 30 days; restores tested every quarter.
• Dependency and vulnerability scanning; critical security patches applied within 7 days, others within 30 days.
• Incident response procedure with breach notification as in section 11.
• Staff confidentiality commitments and data protection training.

Annex III — Subprocessors

Signatures

For Sopa Lab SL: accepted electronically, on the date the Customer accepts the Terms.

For the Customer: Name, title, date (accepted electronically when accepting the Terms).