Data Processing Addendum

Comeback acts as a data processor on behalf of every merchant using the Service. If your jurisdiction requires a signed Data Processing Addendum (GDPR Art. 28, PIPEDA, CCPA, etc.), we'll provide one at no cost.

How to request the DPA

Email legal@tap2comeback.com with your business name, your dashboard email, and your signatory's contact. We'll send back a counter-signed PDF within 2 business days.

What it covers

Our standard DPA includes the SCC-aligned data-transfer terms, our list of sub-processors, security commitments, breach notification timelines, and audit rights. The full text is the authoritative version. This page is just a pointer.

Sub-processors

The current sub-processor list is published in our Privacy Policy. If we add a sub-processor, we update that page and notify merchants who have signed our DPA.