RINDOGATAN LLC · Version 1.0 · 20 October 2026 · PrivacyCloud edition of 5 November 2026
This US Privacy Addendum (the "Addendum") forms part of the data processing agreement (the "DPA") between you (the "Customer") and RINDOGATAN LLC ("Rindogatan" or "we"). It applies to the extent that our processing of personal information on your behalf, in the free pilot or in either subscription, is subject to US State Privacy Laws.
On matters governed by US State Privacy Laws, this Addendum prevails over the DPA. Everything else in the DPA, including its GDPR clauses, is unchanged. Terms used in this Addendum and not defined here have the meaning given in the DPA or, failing that, in the applicable US State Privacy Law.
"US State Privacy Laws" means the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (Cal. Civ. Code §1798.100 and following), and its regulations (the "CCPA"), and the comparable consumer privacy laws of other US states, each as amended and only to the extent it applies to you.
"Personal Information" means the personal information, personal data or equivalent term defined in the applicable US State Privacy Law, that we process on your behalf in providing the Services. "Business purpose", "commercial purpose", "consumer", "sell", "share", "service provider" and "contractor" have the meanings given in the CCPA.
For the CCPA, you are the business and we are your service provider. For the other US State Privacy Laws, you are the controller and we are your processor. Our role as controller of your account and billing data, described in the Subscription Terms, is not covered by this Addendum.
You disclose Personal Information to us only for these limited and specified business purposes: to provide the PrivacyCloud privacy program, AI governance program and vendor catalog to you as described in the Terms (hosting, storing, organizing and displaying the data to your users, backing it up, exporting and deleting it when you ask), to give you support when you ask for it, to keep the Services secure and detect and respond to security incidents, fraud and abuse, and, only if your administrator switches AI on, to send the details of the record being drafted to the AI provider listed in Annex III to produce the results your users ask for. If you add the rights-request module, its purposes are those in Annex IV. For now, the AI features are not available to organizations that declare California or another US state in the Services, and we will tell you by e-mail when that changes.
We will not:
We will comply with the obligations that US State Privacy Laws place on service providers and processors, and give the Personal Information the same level of privacy protection those laws require of you. This includes protecting it with the reasonable security procedures and practices in Annex II, appropriate to the nature of the information (Cal. Civ. Code §1798.81.5 and §1798.100(e)), and keeping everyone who processes it under a duty of confidentiality (clause 6 of the DPA), and, as far as the information available to us allows, helping you with the cybersecurity audits and risk assessments the CCPA requires of you.
The Services let you access, correct, export and delete the Personal Information yourself, which is how most consumer requests are answered. If you need us to act on a request (for example, to delete data you cannot reach), tell us in writing and give us what we need to identify it; we will act promptly, and in any case in time for you to meet your legal deadline if you tell us the request date. If we receive a request directly, we will not answer it ourselves: we forward it to you within two (2) business days and tell the person to contact you (clause 10 of the DPA).
The sub-processors in Annex III, and any we add under clause 8 of the DPA, are our service providers, contractors or processors for the purposes of US State Privacy Laws. Before we add or replace one, we give you the notice and the right to object in clause 8 of the DPA. Where a sub-processor engages another person to process Personal Information for this purpose (for example, the AI provider's own sub-processors), the sub-processor list names those providers or links to the list that sub-processor publishes, and that list is how we notify you of them. If you do not accept this, your administrator can leave AI switched off. We bind each of them by written contract to obligations no less protective than those in this Addendum, and we remain responsible to you for their performance.
You may take reasonable and appropriate steps to make sure that we use the Personal Information in a manner consistent with your obligations under US State Privacy Laws, through the information and audit rights in clause 14 of the DPA. If you reasonably believe that we are using it without authorization, you may, on written notice, require us to stop the processing concerned and to delete or return the data affected, and we will cooperate with you to remedy it.
We will tell you in writing within five (5) business days if we determine that we can no longer meet our obligations under US State Privacy Laws or this Addendum.
If we discover a breach of the security of Personal Information we process for you, we will notify you as clause 12 of the DPA provides, immediately following discovery and in any case within forty-eight (48) hours, so that you can give any notice that US state breach laws require of you. Giving those notices is for you as the business or controller; we will help you do it.
Where a US State Privacy Law other than the CCPA applies, the following DPA clauses also serve as the processor contract it requires: your instructions (clause 5), confidentiality (clause 6), security (clause 7 and Annex II), sub-processors (clause 8), assistance with consumer requests and data protection assessments (clauses 10 and 11), deletion or return at the end (clause 13) and information and audits (clause 14). Annex I describes the nature, purpose and duration of the processing and the types of data.
For organizations that declare California, or another US state, in the Services, the module shows the deadline of each law declared. Under the CCPA, a request to know, delete or correct must be answered within forty-five (45) calendar days of receipt, which may be extended once by a further forty-five (45) days when reasonably necessary, if the consumer is told within the first period; receipt must be confirmed within ten (10) business days. A request to opt out of sale or sharing, or to limit the use of sensitive personal information, must be acted on as soon as feasibly possible and no later than fifteen (15) business days after receipt. The module counts business days Monday to Friday and does not skip holidays, so the date it shows is never later than the legal one. Where the GDPR also applies, the module shows its shorter deadline. Answering on time remains your responsibility.
This clause adds to the "Deadline" paragraph of Annex IV of the DPA, which continues to apply to the GDPR.
We certify that we understand the restrictions in this Addendum and will comply with them.
This Addendum is accepted with the DPA, in the same way and without any further signature. Clause 17 of the DPA governs its changes and, for disputes, it follows the governing law and forum of the Subscription Terms you accepted (for the Pilot, clause 11 of the Terms of Service). It is published in English only, and the English version prevails.