RINDOGATAN LLC · Version 1.8 · 26 October 2026 · PrivacyCloud edition of 5 November 2026
This data processing agreement (the "DPA") forms part of the subscription terms you accepted (the EU Subscription Terms or the USD Subscription Terms, the "Subscription Terms") and of the PrivacyCloud Terms of Service (together, the "Terms") and implements Article 28 of Regulation (EU) 2016/679 (GDPR) and Article 33 of Spanish Organic Law 3/2018 (LOPDGDD).
Parties: (a) You, the business or professional that opens a free pilot account on PrivacyCloud or takes out the EU Subscription or the USD Subscription (the "Customer"), as controller. (b) RINDOGATAN LLC, a Wyoming limited liability company with US employer identification number (EIN) 92-1306337, its registered office at 2120 Carey Avenue, Cheyenne, WY 82001, USA ("Rindogatan" or "we"), as processor.
Subject matter: the processing of personal data we carry out on your behalf to provide the PrivacyCloud privacy program, AI governance program and vendor catalog in the cloud (the "Services"), both in the free pilot (the "Pilot") and in the paid subscription you take out, the EU Subscription or the USD Subscription (the "Subscription"), and the rights-request module included in it. Details are in Annex I.
You accept this DPA when you open a Pilot account or take out the Subscription, without any further signature; the Services record the version you accepted and when. If you move from the Pilot to the Subscription, this DPA continues to apply without a new acceptance. If you prefer, we will send you a copy to sign.
For customers subject to US state privacy laws, the US Privacy Addendum (privacycloud.com/legal/us-privacy-addendum) forms part of this DPA and prevails on the matters it covers.
This DPA applies from the moment you open a Pilot account or take out the Subscription, for as long as you use the Pilot or hold the Subscription, and afterwards until we delete or return the data under clause 13. Confidentiality obligations, and those which by their nature should survive, continue afterwards.
We process the data only to provide the Services: hosting, storing, organising and displaying it to your users, backing it up, exporting it when you ask, deleting it and, only if your organisation's administrator switches AI on, sending to the AI provider in Annex III the details of the record being drafted, to produce the results you ask for.
We do not use it for our own purposes, do not sell it, do not analyse its content and do not use it to train AI models. If we ever processed it for our own purposes, we would be regarded as controller of that processing (Article 28(10) GDPR and Article 33.2 LOPDGDD).
The types of data and categories of data subjects are set out in Annex I. In short, we process the data of your organisation's users and what your team records in the Services. On the base subscription: We do not receive or hold data subjects' requests, nor their data or identity documents. We hold the data of the people who use the service and what your team records, as a processor.
You decide what you record. Please do not enter special categories of data or data on criminal offences unless it is essential and, if so, only the minimum.
AI features and sensitive data. While the AI features run on the AI engine we provide (Annex III), do not use them on a record that contains any of the following about an identified or identifiable person: special categories of data (Article 9 GDPR: health, genetic or biometric data, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, sex life or sexual orientation); data on criminal convictions, offences or records; employment, financial or credit information about the person, beyond their name, role and work contact details; government identification numbers (such as social security, passport, driving licence or tax numbers); payment card numbers; or account passwords. We apply this rule as a precaution; if we lift it, we will tell you by e-mail and update this DPA. The Services do not examine the content of your records (clause 3), so this rule depends on your users: keep AI switched off, or do not use it on such a record. Naming a category in general terms (for example "employee health data" as a category in a record of processing) does not include such data about any person and is not affected.
We process the data on your documented instructions. Your instructions are these Terms, the settings you choose in the Services and what your users do in them. Any other instruction must be given in writing (e-mail is enough); if it means work outside the Subscription, we may quote for it first.
We will tell you immediately if, in our opinion, an instruction infringes the GDPR or other data protection law, and we may stop following it while you confirm or change it.
We will transfer data to a third country only on your instructions or where Union or Member State law requires it; in that case we will tell you first unless that law forbids it. The transfers described in clause 9 are deemed instructed by you.
Only Rindogatan staff who need access to provide, maintain or protect the Services, or to help you when you ask, have access to the data. All of them have committed in writing to confidentiality or are under a statutory duty of confidentiality, which continues after their relationship with us ends. They are a small number of authorised people, bound by confidentiality; on request we will tell you their roles.
We apply the technical and organisational measures in Annex II, appropriate to the risk under Article 32 GDPR. We may change them over time provided the level of protection does not fall.
No measure removes all risk. We do not guarantee that an incident will never happen; we do commit to apply the Annex II measures and to notify you under clause 12. You are responsible for what is in your hands: who has an account, with which role, and how they keep their access safe.
You give us general authorisation to use the sub-processors in Annex III. Before adding or replacing one we will give you at least thirty (30) days' notice, by e-mail to your account's administrative address and on our public sub-processor page (privacycloud.com/legal/eu-cloud-plan-subprocessors).
You may object within that period on reasonable data protection grounds. If we cannot find a solution, you may cancel without penalty and we refund the unused part of anything you prepaid. If you do not object, the change is deemed accepted.
We impose on each sub-processor, by contract, data protection obligations equivalent to those in this DPA, and we remain liable to you for their performance (Article 28(4) GDPR). In a security or continuity emergency we may replace a sub-processor on shorter notice; we will explain why and you keep your right to object.
The AI provider's own sub-processors. The AI provider in Annex III runs the model itself, but it uses its own sub-processors (for example, cloud infrastructure providers), which it lists on its published sub-processor page (https://trust.groq.com/subprocessors) and changes on fifteen (15) days' notice to its customers. We cannot give you thirty (30) days' notice of those changes, so the notice and objection rights in this clause apply to the AI provider itself, not to each of its own sub-processors; we will pass on to you the changes it notifies to us. If you do not accept this, your administrator can leave AI switched off (it is off by default), and the rest of the Services is unaffected.
The Services' data is stored in European Union data centres (Annex III). Even so, it may be processed in, or be accessible from, the United States in the following situations, which we want you to know about:
(a) Rindogatan is a US company. Our staff may access the data from the United States, only in the cases in clause 6. That access is covered by the standard contractual clauses approved by Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor), incorporated by reference in the version we publish at privacycloud.com/legal/sccs/eu-c2p/, with these options: Clause 7 (docking clause) applies; Clause 9, Option 2 (general authorisation, with the notice period in clause 8 of this DPA); Clause 11 without the independent body option; Clause 13, the supervisory authority competent for you (for customers established in Spain, the Spanish Data Protection Agency); Clauses 17 and 18, Spanish law and courts. Annexes I to III of this DPA serve as the annexes to those clauses.
(b) Several sub-processors are US companies or subsidiaries of US companies. Even when they store data in the EU, they may be subject to US laws that allow US authorities to request access. Each relies on the EU-US Data Privacy Framework where it is certified and otherwise on standard contractual clauses (Annex III).
(c) The server functions of all three Services run in the hosting provider's Frankfurt region (fra1), in the European Union, next to their data.
(d) If your organisation's administrator switches AI on, the details of the record being drafted are sent to the AI provider in Annex III, which processes them in the United States (and, as its documents state, possibly in other countries where it or its sub-processors operate), under standard contractual clauses. Your whole programme is never sent.
If an authority asks us for access to your data, we will challenge the request where there are reasonable grounds, disclose only the minimum required and tell you, unless the law forbids it.
Taking into account the nature of the processing, we help you with appropriate technical and organisational measures to answer requests to exercise data subject rights (access, rectification, erasure, objection, restriction and portability). The Services let you view, correct, export and delete what your team records.
If we receive a request directly that concerns data we process for you, we do not answer it ourselves: we forward it to you within two (2) business days and tell the person to contact you. On the base subscription we do not receive data subjects' requests on your behalf; the optional module in Annex IV is the only exception.
With the information available to us, we help you comply with Articles 32 to 36 GDPR: security, breach notification, impact assessments and prior consultation of the supervisory authority. We provide the description of the Services, this DPA, Annex II and the sub-processor list. Help that requires extraordinary work may be quoted separately, unless it arises from our own breach.
We will notify you without undue delay, and in any case within forty-eight (48) hours of becoming aware of it, of any personal data breach affecting data we process for you. We will do so by e-mail to your account's administrative address and, if you give us one, also to your privacy address.
The notice will include, as far as we have it, the information in Article 33(3) GDPR: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed and a contact person. If we do not have all the information at once, we will provide it in phases.
Notifying the supervisory authority and, where needed, the data subjects is for you as controller; we will help you do it. Our notice is not an admission of fault.
When the Subscription ends, you may export your data for thirty (30) days using the Services' export functions, or ask us for an export, which we provide once at no charge. After that period we delete the data from the Services, including any copies we hold, and on request confirm it in writing.
Data deleted from the Services, during the Subscription or after it ends, leaves the copies described in Annex II when their periods end, at most thirty (30) days after the deletion: the history after seven (7) days, the daily copies and the database provider's internal copies after thirty (30) days. Until then the copies are used only to recover from an incident, and if we recover from one we delete again any data that had already been deleted.
We keep, duly blocked, only data that a law requires us to keep or that we need while liability may arise from our relationship with you (Article 33.3 LOPDGDD), such as invoices and the record of this contract. What your team records in the Services is deleted in every case.
Pilot organisations. When a Pilot organisation's editing period ends it becomes read-only, and you can still export everything in it. If no member of a Pilot organisation signs in for twelve (12) months, we delete the organisation and its data, after telling its administrators by e-mail at least thirty (30) days before; a sign-in during that period keeps it. You can also delete a Pilot organisation yourself at any time. Its deletion follows the second and third paragraphs of this clause.
We make available the information needed to show that we comply with this DPA: this document, Annex II and the sub-processor list. The certifications we cite are those of our sub-processors, set out with each one in the sub-processor list; we make their reports or certificates available on request.
If that information is not enough, you, or an independent auditor bound by confidentiality who is not our competitor, may audit us once a year, on thirty (30) days' notice, during business hours, without affecting other customers or the security of the Services, and at your cost. Those limits do not apply where a supervisory authority requires it or after a breach affecting you. Sub-processors are audited through their own reports and certificates.
As Rindogatan is not established in the Union, it has designated RINDOGATAN SL, a Spanish company with tax identification code (CIF) B87868618 and registered office at C/ Ponzano 51, 28003 Madrid, Spain, as its representative in the Union for the purposes of Article 27 GDPR, by a written mandate signed by both companies on 9 October 2026. You, the supervisory authorities and data subjects may contact it, in addition to or instead of Rindogatan, on any data protection matter, at privacy@rindogatan.com.
Each party's liability under this DPA is governed by the exclusions and limits in the Terms: for the Subscription, the liability clause of the Subscription Terms you accepted (clause 12 of the EU Subscription Terms or clause 12 of the USD Subscription Terms) and clause 10 of the Terms of Service; for the Pilot, clause 10 of the Terms of Service. They apply jointly to this DPA and the Terms and are not cumulative. Nothing above limits either party's liability to data subjects under Article 82 GDPR, liability for wilful misconduct or gross negligence, or liability that cannot be limited by law.
In case of conflict on data protection matters the following prevail, in this order: the standard contractual clauses in clause 9, this DPA, and the Terms.
We may update this DPA to reflect changes in law or in the Services, on thirty (30) days' notice. If a change materially harms you, you may cancel before it takes effect and receive a refund of the unused part.
This DPA is governed by the same law, and disputes about it are resolved in the same way, as the Subscription Terms you accepted (clause 13 of the EU Subscription Terms or clause 13 of the USD Subscription Terms); for the Pilot, as clause 11 of the Terms of Service provides. This does not affect the standard contractual clauses in clause 9(a), which keep their own governing law and courts (Clauses 17 and 18).
The Spanish version prevails, except under the USD Subscription Terms, which are published in English only: for USD Subscription customers, the English version prevails.
A. Data subjects
B. Data
C. Operations: hosting, storage, organisation, consultation, display, export, backup, deletion and, only if the administrator switches AI on, sending the details of the record being drafted to the AI provider to produce results. D. Frequency: continuous while the Pilot is used or the Subscription is held. E. Retention: while the Subscription is held, or while the Pilot organisation is in use (within either, you decide when to delete); a Pilot organisation in which no member signs in for twelve (12) months is deleted after thirty (30) days' notice (clause 13); at the end, clause 13. Requests in the rights-request module: Annex IV, point 10. F. Location: the data is stored in European Union data centres (Annex III); it is processed in, or accessible from, the United States in the cases in clause 9.
| Role | Provider | Products | Data location | Safeguard if accessed from the US | Certifications |
|---|---|---|---|---|---|
| Hosting platform (application and server functions) | Vercel | privacy program, AI governance program, vendor catalog | Frankfurt, EU (fra1 region), all three | DPF and SCCs | SOC 2 Type II, ISO 27001 |
| Database provider | Neon, LLC (part of the Databricks group; the data processing addendum of Databricks, Inc. applies) | privacy program, AI governance program, vendor catalog | Frankfurt, EU (eu-central-1), all three | DPF and SCCs | SOC 2 Type II, ISO 27001, ISO 27701 |
| E-mail provider: sign-in links and notices and, with the rights-request module, rights-request notices to requesters (name, e-mail, reference, staff message text). It keeps copies of the e-mails and their delivery logs for up to thirty (30) days | Resend | all three | United States | DPF and SCCs | SOC 2 Type II |
| E-mail service of our support and privacy addresses: receives the messages you and your users send us (support requests, rights requests, notices under this agreement) and our replies | Google LLC (Google Workspace) | all three | United States and other countries | DPF and SCCs | SOC 2 Type II, ISO 27001, ISO 27701, ISO 42001 |
| Payment processor (Subscription billing) | Stripe (RINDOGATAN LLC's account) | billing | United States and other countries | DPF and SCCs | PCI DSS Level 1, SOC 2 Type II |
| AI provider: produces the drafts your users ask for from the details of the record being drafted, with an open-weight model it runs on its own infrastructure (only when AI features are switched on by the administrator and your organisation has not added its own API inference key). It does not keep the requests or the results by default; with the setting we use (zero data retention), it does not keep them for reliability or abuse monitoring either | Groq, Inc. (GroqCloud) | privacy program, AI governance program | United States | SCCs, as the provider's documents state | SOC 2 Type II |
DPF: EU-US Data Privacy Framework. SCCs: European Commission standard contractual clauses. Certifications: the main certifications each sub-processor holds, as it publishes them; they are the sub-processor's, not Rindogatan's (clause 14). The payment processor handles the Customer's billing data partly as an independent controller; it is listed for transparency.
AI provider: the AI provider runs an open-weight model on its own infrastructure; it does not pass requests to other model providers. Its own sub-processors are listed on its published sub-processor page (https://trust.groq.com/subprocessors); that page is how you can follow changes among them (clause 8 of the DPA and clause 8 of the US Privacy Addendum). If your administrator adds your organisation's own API inference key, the AI features use your provider instead, under your own agreement with it, and that provider is not our sub-processor. AI features running on the AI engine we provide must not be used on records that contain the data listed in clause 4 of the DPA (special categories, criminal data and other sensitive data).
Vendor catalog: to build and keep up to date the catalog of public information about vendors, our own catalogue work sends vendors' public documents (such as privacy policies and data processing agreements) to Anthropic and, when that feature is switched on, to an AI gateway (OpenRouter, Inc.). No data from your account or your vendor portfolio is sent with them, so they take part in our own catalogue work and not as sub-processors of your data; they are mentioned here for transparency.
Sign in with Google (all three Services, only if the user chooses it): for the sign-in data Google LLC acts as an independent controller under its Controller-Controller Data Protection Terms; for that data it is not a sub-processor, and it is mentioned here for transparency. Google Workspace, in the table above, is a separate service in which Google acts as our sub-processor.