Last updated: May 26, 2026
This Data Processing Agreement applies to Business and Enterprise customers and complements the Terms of Service in compliance with GDPR Article 28.
Customer (Controller) and Reviews Kokobeo / Goldman Services INC & Europe Services SE (Processor). The Processor processes personal data on behalf of the Controller solely to provide the Service.
Subject matter: providing the Reviews Kokobeo Service. Duration: term of subscription. Nature and purpose: monitoring reviews, identifying fake/defamatory content, submitting removal requests, generating reports. Categories of data subjects: review authors (public usernames only), Customer employees with dashboard access. Categories of personal data: usernames, review content (public), email addresses (Customer team).
Process data only on documented instructions from the Controller. Ensure personnel authorized to process data are bound by confidentiality. Implement appropriate technical and organizational security measures. Assist the Controller in fulfilling data subject rights requests. Notify the Controller without undue delay (within 48 hours) of a personal data breach. Delete or return all personal data at the end of the contract.
Customer authorizes the use of these sub-processors: AWS (hosting, eu-north-1), MongoDB Atlas (database), Mollie (payments), OpenAI (anonymized AI processing), Contabo (server hosting, Germany). We will notify Controllers of changes 30 days in advance and provide opt-out.
Encryption in transit (TLS 1.3) and at rest (AES-256). Access controls with MFA. Regular security audits. Incident response procedures. Personnel training. Logical and physical access restrictions. Backup and disaster recovery procedures.
The Processor assists the Controller in responding to data subject requests within reasonable timeframes. Requests received by the Processor will be forwarded to the Controller within 5 business days.
Where data is transferred outside the EEA, the Processor relies on Standard Contractual Clauses (SCCs) approved by the European Commission (Decision 2021/914). Specifically applies to: OpenAI (USA), AWS (multi-region with EU data residency option).
The Controller may audit the Processor compliance with this DPA upon 30 days written notice, not more than once per year. Audits at the Controller expense.
This DPA is effective from subscription start until termination. Upon termination, the Processor will delete all personal data within 30 days, unless legally required to retain. Backup data deleted within 60 days.
DPA matters: legal@kokobeo.com · Postal: as in Terms of Service.
Operated by Goldman Services INC & Europe Services SE
Goldman Services INC · 175 West Beaver Creek Rd Unit 10, Richmond Hill, ON L4B 3M1, Canada
Europe Services SE · IČO 03571785, Na Čeličičce 425/4, Smíchov, 150 00 Praha, Czech Republic
Kokobeo® registered trademark · UK Reg. UK00004201811 · EU Reg. 019185279
📧 legal@kokobeo.com · 📞 +1 (438) 900-4620
We use essential cookies for site operation and optional cookies to improve experience and analyze usage. You can accept all, reject optional, or manage your preferences. Learn more in our Cookie Policy