Data Processing Agreement

Applicable Data Protection Laws means applicable privacy and data protection laws, including the EU GDPR, UK GDPR, Israeli Protection of Privacy Law, and other applicable legislation.

Customer Personal Data means Personal Data processed by Rumata on Customer's behalf through the Services.

Controller, Processor, Personal Data, Processing, and Personal Data Breach have the meanings assigned under Applicable Data Protection Laws.

Subprocessor means a third party engaged by Rumata to process Customer Personal Data on Customer's behalf.

Customer-Connected Provider means an external AI model provider, API, integration, or other service independently selected or connected by Customer using Customer-provided credentials or configuration.

2.1. Customer acts as Controller of Customer Personal Data, or as Processor where Customer processes Personal Data on behalf of another Controller.

2.2. Rumata acts as Processor, or Subprocessor as applicable, when processing Customer Personal Data to provide the Services.

2.3. Rumata acts as an independent Controller for its own account administration, billing, security, customer communications, legal compliance, and other independently determined processing purposes, as described in its Privacy Policy.

2.4. Customer determines the purposes and lawful basis for processing Customer Personal Data and is responsible for obtaining necessary rights, permissions, notices, and consents.

2.5. Rumata will process Customer Personal Data only on documented instructions from Customer, except where otherwise required by applicable law. The Agreement, this DPA, and Customer's authorized configuration and use of the Services constitute such instructions.

2.6. Rumata will notify Customer if, in its opinion, an instruction violates Applicable Data Protection Laws, unless prohibited by law.

Rumata processes Customer Personal Data to provide, secure and support its application-development and hosting Services, including storage, authentication, AI features and Customer-authorized integrations. Annex I describes the processing scope and duration, data categories and data subjects.

4.1. Primary hosting of Customer Applications and associated data is in Frankfurt, Germany.

4.2. Authorized providers, integrations and support may involve processing in other countries. The primary hosting region is not an exclusive processing-location guarantee.

4.3. International transfers are subject to Section 9. Material hosting changes are subject to applicable notice obligations.

5.1. Rumata will ensure that personnel authorized to process Customer Personal Data are subject to appropriate confidentiality obligations.

5.2. Access to Customer Personal Data will be limited to authorized personnel and service providers with a legitimate need to perform their responsibilities.

5.3. Rumata will take reasonable measures to prevent unauthorized access, use, or disclosure of Customer Personal Data.

6.1. Rumata will maintain technical and organizational measures appropriate to the processing risks and Applicable Data Protection Laws, as described in Annex II.

6.2. Customer is responsible for configuring its applications, access permissions and connected services securely.

6.3. Additional security, availability or recovery commitments require written agreement. No independent certification or guarantee against all incidents is implied.

6.4. Neither party is relieved of its mandatory data-protection obligations.

7.1 Rumata-Provided AI

AI features may send Customer-submitted content and relevant application data to authorized AI providers. Applicable providers and processing locations are described in Annex III and the provider register.

7.2 AI Model Training

Third-party retention and training practices vary. Rumata will disclose applicable practices and will not authorize its Subprocessors to use Customer Personal Data for independent model training without valid documented instructions and compliance with Applicable Data Protection Laws. Accepting this DPA does not itself authorize such training. Independently determined provider uses require assessment of the parties' actual legal roles.

7.3 Customer-Connected Providers

Customer authorizes transfers needed to operate services it independently connects and is responsible for reviewing those providers' terms and data practices. Their status as Subprocessors depends on the actual contractual and processing arrangements. Rumata remains responsible for its own processing under this DPA.

7.4 AI Agent Access

Authorized AI features may read, change or delete Customer data within configured permissions. Customer controls those permissions; Rumata processes the data only under this DPA and Customer's documented instructions.

8.1. Customer grants Rumata general authorization to engage Subprocessors necessary to provide the Services, subject to this section.

8.2. Rumata will maintain an up-to-date list of Subprocessors processing Customer Personal Data.

8.3. Rumata will impose appropriate contractual data-protection obligations on its Subprocessors as required by Applicable Data Protection Laws.

8.4. Rumata remains responsible for the performance of its Subprocessors' applicable data-protection obligations to the extent required by law.

8.5. Rumata will inform Customer of intended additions or replacements of Subprocessors and provide a reasonable opportunity to object on data-protection grounds before the relevant change takes effect, except where applicable law permits another arrangement.

8.6. If Customer raises a reasonable objection, the parties will work in good faith to resolve it. Where resolution is not possible, Customer may discontinue the affected processing or terminate the affected Services in accordance with applicable law and the Agreement.

8.7. Customer-Connected Providers independently engaged by Customer are addressed in Section 7.3.

9.1. Rumata will process and transfer Customer Personal Data in compliance with applicable international data-transfer requirements.

9.2. Where required, appropriate safeguards may include adequacy decisions, approved Standard Contractual Clauses, applicable UK transfer instruments, and supplementary measures.

9.3. Where EU or UK transfer instruments are required, the parties will validly incorporate the relevant instruments and complete the required details.

9.4. This DPA does not independently replace mandatory international data-transfer instruments.

9.5. Customer-directed transfers to Customer-Connected Providers will be assessed according to the parties' respective roles and applicable transfer obligations.

10.1. Rumata will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data.

10.2. Rumata will provide information reasonably available concerning:

• The nature of the incident.
• Categories of Personal Data affected.
• Known or estimated scope.
• Likely consequences.
• Measures taken or proposed to address the incident.

10.3. Information may be provided in stages as the investigation progresses.

10.4. Rumata will take reasonable steps to investigate, contain, mitigate, and remediate breaches affecting processing for which Rumata is responsible.

10.5. Rumata will reasonably assist Customer with applicable breach-notification obligations.

10.6. Customer remains responsible for determining and fulfilling its own notification obligations, except where Rumata has an independent legal obligation.

11.1. Rumata will provide reasonable assistance to Customer in responding to requests from individuals exercising their rights under Applicable Data Protection Laws.

11.2. Where Customer can independently fulfill requests through available platform functionality, Customer should use those capabilities.

11.3. If Rumata receives a request relating to Customer Personal Data, it will, where legally permitted, notify Customer or direct the requester to Customer.

11.4. Rumata will not independently respond on Customer's behalf unless instructed or legally required.

12.1. Rumata will retain Customer Personal Data as necessary to provide the Services, subject to applicable retention requirements.

12.2. After paid subscription access ends, the standard recovery window is seven days of read-only access to retained Customer Data for export. Requesting cancellation of automatic renewal does not itself begin that window while paid access continues. Customer should export before the window ends.

12.3. After the recovery window, retained application storage, hosted databases and associated backups become eligible for permanent deletion under the service deletion procedures. Rumata will delete Customer Personal Data unless applicable law requires its retention. Any retained data remains protected and restricted to the applicable retention purpose.

12.4. Backup coverage is limited to the managed hosted databases described in Annex II; it does not extend to all files or connected services.

12.5. Backup copies may remain for a limited period under Rumata's documented backup-retention schedule. During that period, retained copies remain subject to appropriate security and confidentiality protections.

12.6. The standard export window is described in Section 12.2. Hosted-database backup retention is defined by the applicable plan and shown with the database recovery information. The Privacy Policy describes other data classes and lawful retention exceptions.

12.7. Upon termination of processing, Rumata will, at Customer's choice, return or delete Customer Personal Data and delete existing copies unless applicable law requires storage. Customer may export through available service functions or send an instruction to the privacy contact. Technical procedures do not override mandatory return or deletion obligations.

13.1. Customer may use the Services to develop applications that process sensitive or regulated Personal Data, subject to Applicable Data Protection Laws, the Agreement, and any applicable service restrictions.

13.2. Customer is responsible for determining the lawful basis for such processing and ensuring that its applications provide required notices, safeguards, and permissions.

13.3. Rumata will implement appropriate measures for the processing it performs, taking into account the risks and legal requirements applicable to that processing.

13.4. Processing that requires specific regulatory certifications, contractual safeguards, or specialized compliance commitments may require a separate written agreement.

13.5. Nothing in this section represents that Rumata is certified or approved for a particular regulated use case unless expressly confirmed in writing.

14.1. Rumata will provide reasonable assistance with data-protection impact assessments and consultations with supervisory authorities, taking into account the nature of processing and information available to Rumata.

14.2. Rumata will make available information reasonably necessary to demonstrate compliance with its obligations under this DPA.

14.3. Where required by Applicable Data Protection Laws, Customer may conduct or commission appropriate audits or inspections.

14.4. Audits will be subject to reasonable confidentiality, security, scheduling, and operational safeguards.

14.5. Where permitted by law, Rumata may provide security documentation, independent reports where available, or written responses to satisfy audit requirements.

14.6. Nothing in this section limits mandatory audit rights under Applicable Data Protection Laws.

15.1. Rumata may disclose Customer Personal Data where required by a valid legal obligation.

15.2. Where legally permitted, Rumata will notify Customer of such requests.

15.3. Rumata will take reasonable steps to limit disclosure to information legally required.

16.1. The limitation-of-liability provisions of the Agreement apply to this DPA to the maximum extent permitted by applicable law.

16.2. Claims arising under this DPA and the Agreement are subject to the single aggregate contractual liability cap specified in the Agreement.

16.3. Nothing in this DPA creates a separate or additional contractual liability cap.

16.4. Nothing in this DPA limits obligations, liabilities, data-subject rights, or regulatory powers that cannot lawfully be excluded or limited.

17.1. This version of the DPA takes effect when Customer expressly accepts it together with the Agreement during registration or otherwise validly enters into it in writing, including electronic form. It applies only to processing performed on Customer's behalf. Publishing this DPA does not create historical acceptance for an existing account.

17.2. It remains effective while Rumata processes Customer Personal Data on Customer's behalf.

17.3. Obligations relating to retained Customer Personal Data continue for as long as such data is retained.

18.1. If this DPA conflicts with the Agreement regarding the processing of Customer Personal Data, this DPA prevails to the extent of the conflict.

18.2. Applicable mandatory transfer instruments prevail where required by law.

This DPA is governed by the laws of the State of Israel, except where mandatory Applicable Data Protection Laws or incorporated transfer instruments require otherwise.

Rumata Ltd.

Israel

Email: privacy@rumata.dev

Israeli Company Number: 517315560

Processor: Rumata Ltd., Israel.

Customer: The customer identified in the Agreement.

Subject Matter: Processing Customer Personal Data in connection with Rumata's AI-driven cloud platform.

Duration: For the term of the Services and applicable post-termination retention periods.

Nature and Purposes: Application development and hosting, storage, authentication, AI features, authorized integrations, security and support.

Categories of Data Subjects:

• Customer employees and contractors.
• Customers and business contacts.
• End Users of Customer Applications.
• Website and application visitors.
• Other individuals whose information Customer processes.

Categories of Personal Data:

• Identification and contact information.
• User account information.
• Authentication and authorization data.
• Application database records.
• Uploaded files.
• Prompts and AI interactions.
• Workflow data.
• Application logs and technical metadata.
• Other information Customer chooses to process.

Sensitive Data: May include special categories of Personal Data depending on Customer's applications and applicable safeguards.

Primary Hosting Region: Frankfurt, Germany.

Other Processing Locations: Dependent on authorized Subprocessors, AI providers, customer-selected integrations, and other applicable processing arrangements.

Rumata maintains the following measures for the standard Services and will not materially reduce protection during the term:

• Access: User and project permissions, logical customer-data separation, and administrative access restricted to authorized personnel with confidentiality obligations.
• Data protection: Encrypted public web/API connections, encryption of managed project secrets, and one-way password hashing. These controls do not imply universal end-to-end encryption.
• Recovery: Scheduled daily backups for managed hosted databases, with plan-dependent retention (currently three or seven days). Available recovery points depend on successful backups and are shown in the service. Other files and connected systems are outside this backup coverage; no fixed recovery time or zero-data-loss guarantee is made.
• Monitoring: Operational logging for security and troubleshooting, normally retained for 30 days, with justified incident or legal exceptions. Access and use are limited to the operational purpose.
• Incident handling: Investigation, notification and assistance under Sections 10 and 11. Security reports may be sent to the privacy contact.

Customer remains responsible for application permissions and connected services. Additional security information needed to assess compliance is available under Section 14, subject to appropriate confidentiality safeguards.

Provider use depends on the selected Services. The current subprocessor register is maintained under Section 8, including its notice and objection requirements.

• DigitalOcean: Hosting and storage; primary region Frankfurt, Germany. Support may involve other countries.
• Cloudflare: Content delivery and security; global processing.
• OpenRouter and its AI providers: AI processing; locations depend on the provider used. Applicable providers and safeguards must be established before processing; this is not unrestricted authorization for unidentified providers.

Customer-connected services, including OpenAI Codex, are subject to Section 7.3. Account, payment and analytics processing is described in the Privacy Policy. Provider details and applicable transfer safeguards may be requested from the privacy contact.

Transfers, including remote access and onward processing, require an applicable adequacy decision or other lawful safeguards. Where required, the relevant EU Standard Contractual Clauses, UK transfer instrument or approved alternative must be completed and validly incorporated before transfer, with necessary assessments and supplementary measures.

This DPA does not itself incorporate incomplete transfer instruments. Information about applicable safeguards is available from the privacy contact. Customer-directed transfers remain subject to Section 9.

Customer instructs Rumata to process Customer Personal Data to provide, secure and support the Services described in Annex I, perform Customer-authorized operations and provider transfers, and return or delete data under Section 12. Any processing beyond these instructions requires a separate valid instruction or other lawful basis, as applicable.