Data Processing Addendum

Scope and roles

This Data Processing Addendum (DPA) applies where Rabtafy processes personal data on behalf of a business customer in connection with the Rabtafy services and applicable data-protection law treats that business as a controller, business or equivalent principal and Rabtafy as a processor, service provider or equivalent recipient.

The DPA forms part of the agreement governing the customer's use of Rabtafy. If applicable law assigns the parties different statutory labels, the substance of their respective obligations will apply according to those roles.

Customer instructions

Rabtafy will process covered personal data only to provide, secure, support and improve the contracted services, to follow documented customer instructions, or as otherwise permitted or required by applicable law. The customer's configuration and use of Rabtafy constitute documented instructions for ordinary service processing.

The customer is responsible for ensuring that its instructions and use of the service comply with applicable law and that it has provided required notices and obtained any required permissions or lawful bases.

Confidentiality and security

Rabtafy will limit access to covered personal data to personnel and service providers who need access for authorized purposes and who are subject to appropriate confidentiality obligations.

Rabtafy will maintain technical and organizational safeguards appropriate to the nature of the service and risk, including access controls, tenant isolation, protected secrets, logging and other security controls described in Rabtafy documentation or implemented in the service.

Subprocessors

Rabtafy may use subprocessors for hosting, authentication, communications, billing, analytics, security, AI processing and other functions needed to provide the service. Rabtafy will require subprocessors that process covered personal data to protect it through contractual or other legally appropriate obligations.

Where applicable law requires notice or an opportunity to object to new subprocessors, Rabtafy may provide that notice through the service, legal center, documentation or another reasonable business communication channel.

Individual rights requests

Taking into account the nature of the processing, Rabtafy will provide reasonable assistance, where required by applicable law, so the customer can respond to verified requests for access, correction, deletion, restriction, portability or other applicable data rights.

If Rabtafy receives a request relating primarily to personal data controlled by the customer, Rabtafy may direct the requester to the customer unless prohibited by law.

Security incidents

Rabtafy will notify the affected customer without undue delay after becoming aware of a confirmed security incident involving covered personal data where notification is required by applicable law or the parties' agreement. Rabtafy may provide information in phases as investigation proceeds.

Notification of an incident is not an admission of fault or liability.

Deletion and return

At the end of the applicable service, Rabtafy will delete or return covered personal data in accordance with the service's available export/deletion functionality, documented retention practices and applicable law, unless retention is legally required.

Residual copies may remain temporarily in backups, security records or disaster-recovery systems until overwritten or deleted under normal retention schedules, provided they remain protected and are not used for unrelated purposes.

International transfers

Where covered personal data is transferred across borders and applicable law requires a transfer mechanism, the parties will use an available legally recognized safeguard, which may include standard contractual clauses, contractual commitments or another approved mechanism as appropriate to the transfer.

Audit and compliance information

Rabtafy may make available reasonable information needed to demonstrate compliance with this DPA. Where applicable law requires an audit right, the parties will first seek to satisfy the request through current security documentation, certifications or written responses before arranging a more intrusive audit.

Any audit must be reasonable in scope, protect the confidentiality and security of other customers, avoid unnecessary disruption and comply with applicable contractual and legal restrictions.