Data processing addendum

This Data Processing Addendum (DPA) forms part of the agreement between the customer identified in an order form or Rabona Intel account (Customer) and Rabona Tech LTD. (Rabona) for the Service. It applies only where Rabona processes Personal Data on Customer’s documented instructions as a processor. Capitalised terms not defined here have the meaning in the Terms of Service or Applicable Data Protection Law.

1. Definitions

- Applicable Data Protection Law means data-protection and privacy law applicable to the Processing, including the UK GDPR, EU GDPR and national implementing law where applicable.

- Customer Personal Data means Personal Data contained in Customer Data that Rabona Processes solely on Customer’s behalf to provide the Service.

- Data Subject, Personal Data, Process, Controller, Processor and Supervisory Authority have the meanings given by Applicable Data Protection Law.

- Personal Data Breach means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Customer Personal Data. It excludes unsuccessful attempts that do not compromise Customer Personal Data.

- Subprocessor means a third party engaged by Rabona to Process Customer Personal Data on Customer’s behalf.

2. Roles and scope

Customer is the Controller and Rabona is the Processor for Customer Personal Data, except where Customer acts as a Processor for another Controller, in which case Rabona is Customer’s Subprocessor. Customer will disclose that Controller’s instructions and remains Rabona’s sole point of contact.

Rabona acts as an independent Controller for account administration, billing, fraud prevention, security, Service telemetry, legal compliance, and Rabona’s independently determined collection and analysis of public news sources. Those activities are outside this DPA and covered by the Privacy Policy. Service output derived from public sources does not become Customer Personal Data merely because Customer retrieves it.

3. Customer instructions and responsibilities

Rabona will Process Customer Personal Data only to provide, secure and support the Service; comply with this DPA and the agreement; follow Customer’s documented use of supported features; and comply with law. If law requires other Processing, Rabona will inform Customer beforehand unless prohibited.

Customer instructs Rabona to Process Customer Personal Data as described in Annex 1 and to use the Subprocessors needed to provide the Service. Additional instructions require written agreement and may be subject to reasonable fees. Rabona will inform Customer if, in its opinion, an instruction infringes Applicable Data Protection Law and may suspend the affected Processing while the parties resolve it.

Customer is responsible for:

- the lawfulness, fairness and transparency of its Processing and instructions;

- providing required notices and obtaining required permissions or lawful bases;

- configuring access, retention and integrations appropriately;

- responding to Data Subjects and regulators as Controller;

- ensuring its use of source material and Service output complies with law and third-party rights; and

- not submitting data the Service is not designed to process.

4. Restricted data

Unless an order form expressly states otherwise, Customer must not submit special-category data, criminal- conviction data, children’s data, government identifiers, full payment-card data, health records, biometric templates, precise location trails or authentication secrets for third-party systems. Public-source output may incidentally refer to such matters; that does not authorise Customer to upload additional restricted data or use the Service for regulated decision-making.

5. Confidentiality and personnel

Rabona will ensure persons authorised to Process Customer Personal Data are bound by confidentiality and receive access only where needed for their duties. Rabona will provide appropriate privacy and security guidance to such persons and remain responsible for their compliance with this DPA.

6. Security measures

Rabona will maintain appropriate technical and organisational measures designed to protect Customer Personal Data, taking account of the state of the art, implementation cost, nature and risk of Processing. The current measures are summarised in Annex 2. Rabona may update measures provided the overall protection is not materially reduced. Customer acknowledges that no system eliminates all risk and is responsible for securely configuring and using the Service.

7. Subprocessors

Customer grants general authorisation for Rabona to use Subprocessors. Rabona will contractually require each Subprocessor to protect Customer Personal Data to a standard materially consistent with this DPA and remains responsible for its obligations to the extent required by Applicable Data Protection Law.

The expected production Subprocessors for Customer Personal Data include Cloudflare (edge, application and security infrastructure), DigitalOcean (compute, managed database and object storage) and Resend where it sends customer-directed transactional email. Stripe’s controller or processor role depends on the payment activity; OpenAI processing of Rabona-controlled public-source material is outside this DPA. Counsel and engineering must verify each provider, entity, location, purpose and transfer mechanism against production contracts before publication.

Rabona will provide notice of a new Subprocessor through a maintained list, account notice or email where required. Customer may object on reasonable data-protection grounds within 15 days. The parties will work in good faith on a commercially reasonable alternative. If none is available, Rabona may stop the affected feature and Customer may terminate only that affected Service; this is Customer’s sole remedy for the objection.

8. International transfers

Rabona will not transfer Customer Personal Data to a country lacking an applicable adequacy decision unless it uses a lawful transfer mechanism. Where required, the then-current EU Standard Contractual Clauses and/or UK International Data Transfer Addendum are incorporated by reference with Customer as exporter and Rabona as importer, Module Two or Module Three as appropriate, and the Annexes to this DPA completing their appendices. The optional docking clause applies; optional clause 7 applies; general authorisation under clause 9 applies; and the competent authority, governing law and forum must be completed by counsel for Rabona’s confirmed establishment before publication. If the clauses conflict with this DPA, the clauses control.

9. Data Subject requests

Taking account of the nature of Processing, Rabona will provide reasonable assistance through available functionality and appropriate technical measures so Customer can respond to Data Subject requests. If Rabona receives a request concerning Customer Personal Data, it will direct the requester to Customer where practical and will not respond substantively unless Customer instructs it or law requires. Customer will reimburse reasonable costs for assistance beyond standard Service functionality unless caused by Rabona’s breach.

10. Personal Data Breaches

Rabona will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data. Notice will include then-available information about the nature of the incident, likely consequences, affected data and subjects, and remediation. Information may be supplied in phases. Rabona’s notice is not an admission of fault. Customer is responsible for notifications to Data Subjects, regulators and others, and Rabona will provide reasonable assistance taking account of the Processing and information available.

11. Assessments and regulatory assistance

Rabona will provide information reasonably necessary for Customer to demonstrate compliance with processor obligations and will reasonably assist with data-protection impact assessments and regulator consultations relating specifically to Customer’s supported use. Assistance beyond standard documentation may be charged at reasonable rates unless required because of Rabona’s breach.

12. Audits

Rabona may satisfy audit requests with current independent reports, certifications, questionnaires or other documentation. If those are insufficient for a specific legal requirement, Customer may conduct one audit per year on at least 30 days’ notice, during normal business hours, using an independent auditor bound by confidentiality. Audits must be proportionate, avoid access to other customers’ data, and not compromise security or operations. Customer bears its costs and Rabona’s reasonable assistance costs unless an audit finds a material breach by Rabona. More frequent audits are permitted following a Personal Data Breach or regulator mandate to the extent legally necessary.

13. Return and deletion

During the term, Customer may retrieve Customer Personal Data through supported features. Following termination, Rabona will, at Customer’s choice communicated through the designated operational contact, delete or return Customer Personal Data and delete existing copies unless law requires retention. Deletion from active systems and backups follows documented retention and backup cycles that must be verified before this DPA is offered; until deletion, retained data remains protected and is not used for another purpose. Customer acknowledges that derived, aggregated or de-identified data and Rabona-controlled public-source records are not Customer Personal Data and need not be deleted under this section.

14. Liability and precedence

The liability exclusions and caps in the Terms or applicable order form apply in aggregate to this DPA and the agreement, not separately. This does not limit Data Subject rights or liability that cannot legally be limited. If this DPA conflicts with the Terms on Processing Customer Personal Data, this DPA controls; mandatory transfer clauses control over both.

Annex 1 — Processing details

Subject matter:

Provision, security and support of customer-directed Rabona Intel configuration and integrations.

Duration:

The subscription term plus the limited retention and deletion period described in the agreement and applicable law.

Nature and purpose:

Hosting, organising, searching, transmitting, securing, supporting and deleting personal data that Customer places in Saved Feed definitions, integration configuration or support requests, solely as needed to provide those supported functions.

Data Subjects:

Persons identified by Customer in Saved Feed definitions, integration configuration or customer-directed support material.

Personal Data:

Names, identifiers and other personal data included by Customer in Saved Feed definitions, integration configuration or customer-directed support material. Account administration, billing, fraud, telemetry, API metering, audit and security data processed for Rabona’s own purposes are outside this DPA.

Frequency:

Continuous or as initiated by Customer during the term.

Restricted categories:

None intended. Customer is prohibited from submitting the restricted data described in section 4 unless expressly agreed in writing.

Annex 2 — Technical and organisational measures

- Role-based access, organisation membership controls and least-privilege service credentials.

- Hashed or otherwise protected authentication and API credentials; secret values are not intended to be recoverable after issuance.

- TLS for network transport and provider-managed encryption at rest where supported.

- Segregated public, authenticated and administrative surfaces with fail-closed authorisation.

- Bounded requests, rate limits, input validation and controls designed to reduce abuse and resource exhaustion.

- Logging and audit records for security, authentication, billing and API activity, subject to retention controls.

- Managed infrastructure and automated deployment quality checks.

- Production access limited to authorised personnel and confidentiality obligations for persons handling Customer Personal Data.

- Data minimisation and operational retention controls appropriate to supported data categories.

- Written service and data-protection terms for relevant providers, to be verified before this DPA is offered.

Annex 3 — Parties and contacts

Customer details are the account and order-form details. Before this DPA is offered, qualified counsel must add Rabona Tech LTD.’s company number, registered office, country of incorporation, authorised signatory process, privacy contact and transfer-mechanism particulars. No placeholder in this draft should remain in a public or executed version.