Data Processing Agreement

1. Definitions

• "Controller" means the entity that determines the purposes and means of the processing of Personal Data — i.e., you, the Customer.
• "Processor"means the entity that processes Personal Data on behalf of the Controller — i.e., Ricord AI ("Ricord," "we," "us").
• "Personal Data" means any information relating to an identified or identifiable natural person, as defined under GDPR Article 4(1).
• "Processing" means any operation performed on Personal Data, including collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, erasure, or destruction.
• "Sub-processor" means any third party engaged by the Processor to process Personal Data on behalf of the Controller.
• "Standard Contractual Clauses" (SCCs) means the contractual clauses approved by the European Commission for the transfer of Personal Data to processors established in third countries.

2. Scope and Applicability

This Data Processing Agreement ("DPA") supplements and forms part of the Terms of Service between Ricord AI and the Customer. It applies to the extent that Ricord processes Personal Data on behalf of the Customer in the course of providing the Ricord platform and related services.

Ricord processes conversation data and extracted knowledge on behalf of the Customer. This DPA governs such processing in compliance with GDPR Article 28 and other applicable data protection legislation.

3. Details of Processing

4. Controller Obligations

The Customer, as Controller, shall:

• Ensure a lawful basis exists for the processing of Personal Data under GDPR Article 6 (e.g., consent, legitimate interest, or contractual necessity).
• Apply the principle of data minimization and ensure that only Personal Data that is necessary for the stated purposes is submitted to the Ricord platform.
• Inform data subjects about the processing of their Personal Data in accordance with GDPR Articles 13 and 14, including disclosure that Ricord AI acts as a processor.
• Promptly notify Ricord of any data subject request that requires Ricord's assistance to fulfill.

5. Processor Obligations

Ricord AI, as Processor, shall:

• Process Personal Data only on documented instructions from the Controller, unless required to do so by applicable law (in which case Ricord shall inform the Controller of such legal requirement before processing, unless prohibited by law).
• Ensure that all personnel authorized to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
• Implement and maintain appropriate technical and organizational security measures as described in Section 7.
• Assist the Controller, by appropriate technical and organizational measures, in fulfilling the Controller's obligation to respond to data subject requests under GDPR Chapter III (access, rectification, erasure, restriction, portability, objection).
• Assist the Controller in ensuring compliance with obligations under GDPR Articles 32 to 36 (security, breach notification, data protection impact assessments, and prior consultation).
• At the choice of the Controller, delete or return all Personal Data to the Controller after the end of the provision of services, and delete existing copies unless applicable law requires storage.
• Make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in GDPR Article 28.

6. Sub-processors

The Customer provides general written authorization for Ricord AI to engage the following sub-processors. Ricord shall inform the Customer of any intended changes to the list of sub-processors, giving the Customer the opportunity to object within 30 days.

Each sub-processor is bound by data protection obligations no less protective than those set out in this DPA. Ricord remains fully liable for the acts and omissions of its sub-processors.

7. Technical and Organizational Security Measures

Ricord AI implements and maintains the following security measures:

• Encryption in transit: All data transmitted between the Customer and Ricord is encrypted using TLS 1.3.
• Encryption at rest: All stored Personal Data is encrypted using AES-256 encryption.
• Tenant isolation:Customer data is logically isolated using organization identifiers (org_id). Each Customer's data is accessible only to authenticated and authorized users within their organization.
• Access controls: Role-based access controls (RBAC) limit access to Personal Data to authorized personnel on a need-to-know basis.
• Logging and monitoring: Access to Personal Data is logged and monitored for unauthorized activity.
• Vulnerability management: Regular security assessments and dependency updates are performed to address known vulnerabilities.

8. Personal Data Breach Notification

Ricord AI shall notify the Customer without undue delay, and in any event within 72 hours of becoming aware of a Personal Data breach. The notification shall include:

• A description of the nature of the breach.
• The categories and approximate number of data subjects and records concerned.
• The likely consequences of the breach.
• The measures taken or proposed to address the breach, including measures to mitigate its possible adverse effects.

9. International Data Transfers

The Customer acknowledges that Ricord AI and its sub-processors process Personal Data in the United States. For transfers of Personal Data from the European Economic Area (EEA), United Kingdom, or Switzerland to the United States, Ricord relies on:

• Standard Contractual Clauses (SCCs): As approved by the European Commission (Module Two: Controller-to-Processor), incorporated by reference into this DPA.
• Supplementary measures: Including encryption in transit and at rest, access controls, and contractual commitments from sub-processors.

Ricord shall promptly inform the Controller if, in its opinion, an instruction from the Controller infringes applicable data protection law regarding international transfers.

10. Audit Rights

The Customer, or a qualified third-party auditor appointed by the Customer, may conduct an audit of Ricord AI's processing activities and security measures to verify compliance with this DPA, subject to the following conditions:

• Audits may be conducted no more than once per calendar year.
• The Customer shall provide at least 30 days' prior written notice.
• Audits shall be conducted during normal business hours and shall not unreasonably disrupt Ricord's operations.
• The Customer shall bear the costs of the audit, unless the audit reveals a material breach of this DPA by Ricord.
• All information obtained during an audit shall be treated as confidential.

11. Data Deletion and Return

Upon termination or expiration of the Customer's subscription, and at the Customer's election:

• Ricord shall return all Personal Data to the Customer in a commonly used, machine-readable format; or
• Ricord shall delete all Personal Data within 30 days of termination, including all copies held by sub-processors, unless applicable law requires continued storage.

Ricord shall certify in writing that deletion has been completed upon the Customer's request.

12. Liability

Each party's liability under this DPA is subject to the same exclusions and limitations of liability as set forth in the main Terms of Service between the parties. Nothing in this DPA limits either party's liability with respect to the rights of data subjects under applicable data protection law.

13. General Provisions

This DPA is governed by the same law that governs the Terms of Service. In the event of any conflict between this DPA and the Terms of Service, this DPA shall prevail with respect to data protection matters. This DPA shall automatically terminate upon termination of the Terms of Service, subject to the obligations in Section 11.