Data Processing Addendum
This Data Processing Addendum (“DPA”) forms part of, and is subject to, the Master Subscription Agreement (“Agreement”) or other written or electronic terms of service or subscription agreement between Nexza, Inc., a Delaware corporation doing business as Ruddr (also referred to herein as “we”, “our”, or “us”), or any of its successors or assignees, and the legal entity accessing our Services (collectively, for purposes of this DPA, “Customer”, and together with us, the “Parties” and each a “Party”). All capitalized terms not defined in this DPA shall have the meanings set forth in the Agreement.
Section 1. Definitions.
“Account” means Customer’s account in the Service in which Customer stores and processes Customer Data.
“Affiliate” has the meaning set forth in the Agreement.
“Authorized Affiliate” shall mean a Customer Affiliate who has not signed an Order Form pursuant to the Agreement, but is either a Data Controller or Data Processor for the Customer Personal Data processed by us pursuant to the Agreement, for so long as such entity remains a Customer Affiliate.
“California Consumer Privacy Act” or “CCPA” means the California Consumer Privacy Act of 2018, as may be amended from time to time.
“Customer Data” means any data or data files of any type that are uploaded by or on behalf of Customer for storage or processing in the Service.
“Customer Personal Data” means any Customer Data that is Personal Data.
“Data Controller” means an entity that determines the purposes and means of the Processing of Personal Data.
“Data Processor” means an entity that Processes Personal Data on behalf of a Data Controller.
“Data Protection Laws” means all data protection and privacy laws applicable to the respective party in its role in the Processing of Personal Data under the Agreement, including, where applicable, EU & UK Data Protection Law and the CCPA.
“Data Subject” means the identified or identifiable natural person to whom Customer Personal Data relates.
“EU & UK Data Protection Law” means (i) Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such data (General Data Protection Regulation) (“GDPR”); and (ii) the GDPR as it forms part of United Kingdom law pursuant to Section 3 of the European Union (Withdrawal) Act 2018 (“UK GDPR”) and the Data Protection Act 2018.
“Personal Data” means any information, including opinions, relating to an identified or identifiable natural person and includes similarly defined terms in Data Protection Laws, including, but not limited to, the definition of “personal information” in the CCPA.
“Processing” shall mean any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, and “Process”, “Processes” and “Processed” will be interpreted accordingly.
“Purposes” shall mean (i) our provision of the Services as described in the Agreement, including Processing initiated by Users in their use of the Services; and (ii) further documented, reasonable instructions from Customer agreed upon by the Parties.
“Security Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access to Customer Personal Data.
“Service” has the meaning set forth in the Agreement.
“Sub-processor” means any other Data Processors engaged by us to Process Customer Personal Data
Section 2. Scope and Applicability of this DPA.
This DPA applies where and only to the extent that we Process Customer Personal Data on behalf of Customer as Data Processor in the course of providing the Services.
Section 3. Roles and Scope of Processing.
3.1 Role of the Parties. As between Ruddr and Customer, we shall Process Customer Personal Data only as a Data Processor (or sub-processor) acting on behalf of Customer and, with respect to CCPA, as a “service provider” as defined therein, in each case regardless of whether Customer acts as a Data Controller or as a Data Processor on behalf of a third-party Data Controller (such third-party, the “Third-Party Controller”) with respect to Customer Personal Data. To the extent any Usage Data (as defined in the Agreement) is considered Personal Data under applicable Data Protection Laws, we are the Data Controller of such data and shall Process such data in accordance with the Agreement and applicable Data Protection Laws.
3.2 Customer Instructions. We will Process Customer Personal Data only for the Purposes. Customer shall ensure its Processing instructions are lawful and that the Processing of Customer Personal Data in accordance with such instructions will not violate applicable Data Protection Laws. The Parties agree that the Agreement (including this DPA) sets out the exclusive and final instructions to us for all Processing of Customer Personal Data, and (if applicable) include and are consistent with all instructions from Third-Party Controllers. Any additional requested instructions require our prior written agreement. We shall promptly notify Customer if, in our opinion, such instruction violates EU & UK Data Protection Law. Where applicable, Customer shall be responsible for any communications, notifications, assistance and/or authorizations that may be required in connection with a Third-Party Controller.
3.3 Customer Affiliates. Our obligations set forth in this DPA also extend to Authorized Affiliates, subject to the following conditions:
- Customer must exclusively communicate any additional Processing instructions requested pursuant to 3.2 directly to us, including instructions from its Authorized Affiliates;
- Customer shall be responsible for Authorized Affiliates’ compliance with this DPA and all acts and/or omissions by an Authorized Affiliate with respect to Customer’s obligations in this DPA shall be considered the acts and/or omissions of Customer; and
- Authorized Affiliates shall not bring a claim directly against us. If an Authorized Affiliate seeks to assert a legal demand, action, suit, claim, proceeding or other forms of complaints or proceedings against us (“Authorized Affiliate Claim”): (i) Customer must bring such Authorized Affiliate Claim directly against us on behalf of such Authorized Affiliate, unless Data Protection Laws require the Authorized Affiliate be a party to such claim; and (ii) all Authorized Affiliate Claims shall be considered claims made by Customer and shall be subject to any liability restrictions set forth in the Agreement, including, but not limited to, any aggregate limitation of liability.
3.4 Processing of Personal Data. Each Party will comply with its respective obligations under Data Protection Laws. Customer agrees (i) it will use the Service in a manner designed to ensure a level of security appropriate to the particular content of the Customer Personal Data, such as pseudonymizing and backing-up Customer Personal Data; and (ii) it has obtained all consents, permissions and/or rights necessary under Data Protection Laws for us to lawfully Process Customer Personal Data for the Purposes, including, without limitation, Customer’s sharing and/or receiving of Customer Personal Data with third-parties via the Service.
3.5 Details of Data Processing.
- Subject Matter: The subject matter of the Processing under this DPA is the Customer Personal Data.
- Frequency and duration: Notwithstanding expiration or termination of the Agreement, we will Process the Customer Personal Data continuously and until deletion of all Customer Personal Data as described in this DPA.
- Purpose: We will Process the Customer Personal Data only for the Purposes, as described in this DPA.
- Nature of the Processing: We will perform Processing as needed for the Purposes, and to comply with Customer’s Processing instructions as provided in accordance with the Agreement and this DPA.
- Retention Period. The period for which Customer Personal Data will be retained and the criteria used to determine that period is determined by Customer during the term of the Agreement via Customer’s use and configuration of the Service. Upon termination or expiration of the Agreement, Customer may retrieve or delete Customer Personal Data as described in the Agreement. Any Customer Personal Data not deleted by Customer shall be deleted by us promptly upon the later of (i) expiration or termination of the Agreement and (ii) expiration of any post-termination “retrieval period” described in the Agreement.
- Categories of Data Subjects: The categories of Data Subjects to which Customer Personal Data relate are determined and controlled by Customer in its sole discretion, and may include, but are not limited to (i) Prospects, customers, business partners and vendors of Customer (who are natural persons); (ii) Employees or contact persons of Customer’s prospects, customers, business partners and vendors; and/or (iii) Employees, agents, advisors, and freelancers of Customer (who are natural persons).
- Categories of Personal Data: The types of Customer Personal Data are determined and controlled by Customer in its sole discretion, and may include, but are not limited to (i) Identification and contact data (name, address, title, contact details); (ii) Financial information (credit card details, account details, payment information); (iii) Employment details (employer, job title, geographic location, area of responsibility); and/or (iv) IT information (IP addresses, cookies data, location data).
- Special Categories of Personal Data (if applicable): Subject to any applicable restrictions and/or conditions in the Agreement or Documentation, Customer may also include ‘special categories of personal data’ or similarly sensitive Personal Data (as described or defined in Data Protection Laws) in Customer Personal Data, the extent of which is determined and controlled by Customer in its discretion, and which may include, but is not limited to Customer Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data Processed for the purposes of uniquely identifying a natural person, data concerning health and/or data concerning a natural person’s sex life or sexual orientation.
- Project and Professional Services Information: project assignments, project roles, time entries, expenses, resource allocations, skills, utilization information, billing information, rates, invoices, project communications, and other professional services information.
- CRM and Business Relationship Information: information relating to prospects, clients, contacts, opportunities, and business relationships, including information imported or synchronized through Customer's integrations.
Section 4. Sub-Processing.
4.1. Authorized Sub-Processors. Customer provides us with a general authorization to engage Sub-processors, subject to Section 4.3 (Changes to Sub-processors). Our current list of Sub-processors is available at https://trust.ruddr.com/subprocessors and is incorporated into this DPA by reference.
4.2 Sub-processor Obligations. We shall: (i) enter into a written agreement with each Sub-processor imposing data protection obligations no less protective of Customer Personal Data as our obligations under this DPA to the extent applicable to the services provided by the Sub-processor; and (ii) remain liable for each Sub-processor’s compliance with the obligations under this DPA. Upon written request, and subject to any confidentiality restrictions, we shall provide Customer all relevant information it reasonably can in connection with its applicable Sub-processor agreements where required to satisfy Customer’s obligations under Data Protection Laws.
4.3 Changes to Sub-processors. Upon request, we shall subscribe Customer to notifications of new Sub-processors. We shall provide such notification to subscribers at least twenty-eight (28) days in advance of allowing the new Sub-processor to Process Customer Personal Data (the “Objection Period”). During the Objection Period, objections (if any) to our appointment of the new Sub-processor must be provided to us in writing and based on reasonable grounds. In such event, the Parties will discuss those objections in good faith with a view to achieving resolution. If it can be reasonably demonstrated to us that the new Sub-processor is unable to Process Customer Personal Data in compliance with the terms of this DPA and we cannot provide an alternative Sub-processor, or the Parties are not otherwise able to achieve resolution as provided in the preceding sentence, Customer, as its sole and exclusive remedy, may terminate the Agreement by providing written notice to us of such termination. We will refund Customer any prepaid unused fees associated with the Agreement following the effective date of such termination.
Section 5. Security.
5.1. Security Measures. We shall implement and maintain appropriate technical and organizational security measures designed to protect Customer Personal Data from Security Incidents and to preserve the security, confidentiality, integrity, and availability of Customer Personal Data, including the measures described in Annex II to Exhibit A of this DPA.
5.2. Confidentiality of Processing. We shall ensure that any person who is authorized by us to Process Customer Personal Data (including its staff, agents and subcontractors) shall be under an appropriate obligation of confidentiality (whether a contractual or statutory duty).
5.3. No Assessment of Customer Personal Data by Us. We shall have no obligation to assess the contents or accuracy of Customer Personal Data, including to identify information subject to any specific legal, regulatory, or other requirement. Customer is responsible for making an independent determination as to whether its use of the Service will meet Customer’s requirements and legal obligations under Data Protection Laws.
Section 6. Customer Audit Rights.
6.1. Upon written request and at no additional cost to Customer, we shall provide Customer, and/or its appropriately qualified third-party representative (collectively, the “Auditor”), access to reasonably requested documentation evidencing our compliance with its obligations under this DPA.
6.2. Customer may also send a written request for an audit of our applicable controls, including inspection of our facilities. Following receipt of such request, the Parties shall mutually agree in advance on the details of the audit, including the reasonable start date, scope and duration of, and security and confidentiality controls applicable to, any such audit. We may charge a fee (rates shall be reasonable, taking into account the resources expended by us) for any such audit. The Reports, audit, and any information arising therefrom shall be considered our Confidential Information and may only be shared with a third-party (including a Third-Party Controller) with our prior written agreement.
6.3. Where the Auditor is a third-party, the Auditor may be required to execute a separate confidentiality agreement with us prior to any review of Reports or an audit of us, and we may object in writing to such Auditor, if in our reasonable opinion, the Auditor is not suitably qualified or is a direct competitor. Any such objection by us will require Customer to either appoint another Auditor or conduct the audit itself. Any expenses incurred by an Auditor in connection with any review of Reports or an audit shall be borne exclusively by the Auditor. For clarity, the exercise of audit rights under a Transfer Mechanism shall be as described in this Section 6 (Customer Audit Rights) to the extent consistent with, and without limiting, any audit rights expressly provided under the applicable Transfer Mechanism. Customer agrees those rights are carried out on behalf of Customer and all relevant Third-Party Controllers, subject to the confidentiality and non-use restrictions of the Agreement to the extent permitted by the applicable Transfer Mechanism.
Section 7. Data Transfers.
7.1. Hosting and Processing Locations. We will only host Customer Personal Data in the region(s) offered by us. Customer is solely responsible for the regions from which its Users access Customer Personal Data and for any transfer or sharing of Customer Personal Data by Customer or its Users.
7.2. International Data Transfers. To the extent that the Processing of Customer Personal Data under the Agreement involves a transfer of Personal Data from the European Economic Area ("EEA"), Switzerland, or the United Kingdom to a country that has not been recognized as providing an adequate level of protection under applicable Data Protection Laws, the Parties shall rely upon an applicable lawful transfer mechanism as provided in this Section 7.
7.3 EU Standard Contractual Clauses. Where Customer Personal Data subject to the GDPR is transferred to Ruddr in a country that does not ensure an adequate level of data protection within the meaning of the GDPR, the Standard Contractual Clauses approved by the European Commission pursuant to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 ("EU SCCs"), as further specified in Exhibit A to this DPA, are incorporated into and form part of this DPA.
7.4 Other Transfer Mechanisms. To the extent another valid transfer mechanism under applicable Data Protection Laws applies to a transfer of Customer Personal Data, including an applicable adequacy decision or data privacy framework, the Parties may rely upon that mechanism where legally permitted. If a transfer mechanism relied upon by the Parties ceases to provide a lawful basis for the applicable transfer, the Parties shall cooperate in good faith to implement another valid transfer mechanism.
7.5 Conflict. In the event of a conflict between the EU SCCs and this DPA or the Agreement, the EU SCCs shall prevail with respect to the subject matter of the EU SCCs.
Section 8. Security Incident Response.
8.1. Security Incident Reporting. If we become aware of a Security Incident, we shall notify Customer without undue delay, and in any case, where feasible, notify Customer within seventy-two (72) hours after becoming aware. Our notification shall be sent to the workspace administrator email addresses. We shall promptly take reasonable steps to contain, investigate, and mitigate any Security Incident.
8.2. Security Incident Communications. We shall provide Customer timely information about the Security Incident, including, but not limited to, the nature and consequences of the Security Incident, the measures taken and/or proposed by us to mitigate or contain the Security Incident, the status of our investigation, a contact point from which additional information may be obtained, and the categories and approximate number of data records concerned. Notwithstanding the foregoing, Customer acknowledges that because our personnel may not have visibility to the content of Customer Personal Data, it is unlikely we can provide information as to the particular nature of the Customer Personal Data, or where applicable, the identities, number or categories of affected Data Subjects. Communications by or on behalf of us with Customer in connection with a Security Incident shall not be construed as an acknowledgment by us of any fault or liability with respect to the Security Incident.
Section 9. Cooperation.
9.1. Data Subject Requests. We shall promptly notify Customer if we receive a request from a Data Subject that identifies Customer Personal Data or otherwise identifies Customer, including where the Data Subject seeks to exercise any of its rights under applicable Data Protection Laws (collectively, “Data Subject Request”). The Service provides Customer with a number of controls that Customer may use to assist it in responding to Data Subject Requests and, subject to the next sentence, Customer will be responsible for responding to any such Data Subject Requests. To the extent Customer is unable to access the relevant Customer Personal Data within the Service using such controls or otherwise, we shall (upon Customer’s written request and taking into account the nature of our Processing) provide commercially reasonable cooperation to assist Customer in responding to Data Subject Requests.
9.2. Data Protection Impact Assessments. We shall provide reasonably requested information regarding the Service to enable Customer to carry out data protection impact assessments or prior consultations with data protection authorities as required by Data Protection Laws, so long as Customer does not otherwise have access to the relevant information.
9.3 Ownership of Service Data. If we receive a demand to retain, disclose, or otherwise Process Customer Personal Data from law enforcement or any other government and/or public authority (“Third-Party Demand”), then we shall attempt to redirect the Third-Party Demand to Customer. Customer agrees that we can provide information to such third-party to the extent reasonably necessary to redirect the Third-Party Demand to Customer. If we cannot redirect the Third-Party Demand to Customer, then we shall, to the extent legally permitted to do so, provide Customer reasonable notice of the Third-Party Demand as promptly as feasible under the circumstances to allow Customer to seek a protective order or other appropriate remedy. This section does not diminish our obligations under any applicable Transfer Mechanisms with respect to access by public authorities.
Section 10. Relationship with the Agreement.
10.1. The Parties agree that this DPA shall replace and supersede any existing data processing addendum, attachment, or exhibit that the Parties may have previously entered into in connection with the Service, except to the extent the Parties have expressly agreed in writing that a separate data processing agreement or Transfer Mechanism will remain in effect. We may update this DPA from time to time, provided that no such update shall materially diminish the privacy or security of Customer Personal Data.
10.2. Except as provided by this DPA, the Agreement remains unchanged and in full force and effect. If there is any conflict between this DPA and the Agreement, this DPA shall prevail to the extent of that conflict in connection with the Processing of Customer Personal Data. Notwithstanding the foregoing, and solely to the extent applicable to any Customer Personal Data comprised of patient, medical or other protected health information regulated by HIPAA, if there is any conflict between this DPA and a business associate agreement between Customer and us, then the business associate agreement shall prevail solely with respect to such Customer Personal Data.
10.3. Notwithstanding anything to the contrary in the Agreement or this DPA, each Party’s and all of its Affiliates’ liability, taken together in the aggregate, arising out of or relating to this DPA, the Transfer Mechanisms, and any other data protection agreements in connection with the Agreement (if any), shall be subject to any aggregate limitations on liability set out in the Agreement. Without limiting the Parties’ obligations under the Agreement, each Party agrees that any regulatory penalties incurred by one Party (the “Incurring Party”) in relation to the Customer Personal Data that arise as a result of, or in connection with, the other Party’s failure to comply with its obligations under this DPA or any applicable Data Protection Laws shall count toward and reduce the Incurring Party’s liability under the Agreement as if it were liability to the other Party under the Agreement. Notwithstanding the foregoing, nothing in this Section 10.3 shall limit any rights of Data Subjects or liability that may not lawfully be limited under an applicable Transfer Mechanism.
10.4. In no event shall this DPA benefit or create any right or cause of action on behalf of a third party (including a Third-Party Controller), but without prejudice to the rights or remedies available to Data Subjects under Data Protection Laws or this DPA (including the Transfer Mechanisms).
10.5. This DPA will be governed by and construed in accordance with governing law and jurisdiction provisions in the Agreement.
Exhibit A — European Union Standard Contractual Clauses
Section 1. Incorporation of SCCs.
The Standard Contractual Clauses set forth in the Annex to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 ("SCCs") are hereby incorporated by reference into this DPA and shall apply to any transfer of Customer Personal Data to Ruddr that requires appropriate safeguards pursuant to Article 46 of the GDPR.
The SCCs shall be deemed completed as set forth below.
The SCCs shall be deemed completed as set forth below.
Section 2. Applicable Module.
2.1 Module Two (Controller to Processor). Module Two shall apply where Customer is a Data Controller of the Customer Personal Data and Ruddr is a Data Processor.
2.2 Module Three (Processor to Processor). Module Three shall apply where Customer is a Data Processor acting on behalf of a Third-Party Controller and Ruddr is a Sub-processor of the Customer Personal Data.
Section 3. SCC Elections.
For purposes of Modules Two and Three:
(a) Clause 7 — Docking Clause. The optional docking clause shall apply.
(b) Clause 9 — Use of Sub-processors. Option 2 (General Written Authorization) shall apply. The time period for prior notice of intended changes to Sub-processors shall be the period specified in Section 4.3 of this DPA.
(c) Clause 11 — Redress. The optional language in Clause 11(a) shall not apply.
(d) Clause 17 — Governing Law. Option 1 shall apply. The SCCs shall be governed by the law of Ireland.
(e) Clause 18 — Choice of Forum and Jurisdiction. The courts of Ireland shall have jurisdiction.
(a) Clause 7 — Docking Clause. The optional docking clause shall apply.
(b) Clause 9 — Use of Sub-processors. Option 2 (General Written Authorization) shall apply. The time period for prior notice of intended changes to Sub-processors shall be the period specified in Section 4.3 of this DPA.
(c) Clause 11 — Redress. The optional language in Clause 11(a) shall not apply.
(d) Clause 17 — Governing Law. Option 1 shall apply. The SCCs shall be governed by the law of Ireland.
(e) Clause 18 — Choice of Forum and Jurisdiction. The courts of Ireland shall have jurisdiction.
4. Annexes.
Annexes I, II and III to the SCCs shall be completed as set forth below.
5. Precedence.
Nothing in the Agreement or DPA shall be interpreted or applied in a manner that conflicts with the SCCs. In the event of any conflict between the SCCs and the Agreement or DPA, the SCCs shall prevail with respect to the subject matter of the SCCs.
ANNEX I
A. List of Parties.
Data Exporter
Name: Customer and, where applicable, its Authorized Affiliates.
Address: As specified in the Agreement or applicable Order Form.
Contact person's name, position and contact details: As specified in the Agreement, applicable Order Form, or Customer's Ruddr account.
Activities relevant to the data transferred under these Clauses: Customer's use of the Ruddr Service pursuant to the Agreement.
Role: Controller for purposes of Module Two; Processor for purposes of Module Three.
Signature and date: The Parties agree that execution of the Agreement or acceptance of this DPA constitutes execution of these SCCs as of the effective date of the Agreement.
Name: Customer and, where applicable, its Authorized Affiliates.
Address: As specified in the Agreement or applicable Order Form.
Contact person's name, position and contact details: As specified in the Agreement, applicable Order Form, or Customer's Ruddr account.
Activities relevant to the data transferred under these Clauses: Customer's use of the Ruddr Service pursuant to the Agreement.
Role: Controller for purposes of Module Two; Processor for purposes of Module Three.
Signature and date: The Parties agree that execution of the Agreement or acceptance of this DPA constitutes execution of these SCCs as of the effective date of the Agreement.
Data Importer
Name: Nexza, Inc. d/b/a Ruddr
Address: 1050 Crown Pointe Pkwy, Suite 500, Atlanta, GA 30338
Contact person's name, position and contact details: Robert Patten, CEO, privacy@ruddr.io
Activities relevant to the data transferred under these Clauses: Provision of the Ruddr professional services automation platform and related services pursuant to the Agreement.
Role: Processor for purposes of Module Two; Sub-processor for purposes of Module Three.
Signature and date: The Parties agree that execution of the Agreement or acceptance of this DPA constitutes execution of these SCCs as of the effective date of the Agreement.
Name: Nexza, Inc. d/b/a Ruddr
Address: 1050 Crown Pointe Pkwy, Suite 500, Atlanta, GA 30338
Contact person's name, position and contact details: Robert Patten, CEO, privacy@ruddr.io
Activities relevant to the data transferred under these Clauses: Provision of the Ruddr professional services automation platform and related services pursuant to the Agreement.
Role: Processor for purposes of Module Two; Sub-processor for purposes of Module Three.
Signature and date: The Parties agree that execution of the Agreement or acceptance of this DPA constitutes execution of these SCCs as of the effective date of the Agreement.
B. Description of Transfer.
Categories of data subjects
Customer Personal Data may relate to:
- Customer's employees, agents, advisors, contractors and freelancers;
- Customer's prospects, customers, business partners and vendors who are natural persons;
- employees and contact persons of Customer's prospects, customers, business partners and vendors; and
- other individuals whose Personal Data Customer or its Users submit to the Service.
Categories of personal data transferred
Customer Personal Data may include:
- identification and contact information, including names, addresses, email addresses, telephone numbers and job titles;
- employment and professional information, including employer, role, geographic location and areas of responsibility;
- financial and transactional information;
- project, time, expense, resource, billing and related professional-services information;
- technical and device information, including IP addresses and other information associated with use of the Service; and
- other Personal Data submitted to the Service by or on behalf of Customer.
Sensitive data transferred
Customer may submit special categories of Personal Data to the Service to the extent permitted by the Agreement. The specific categories and frequency of such transfers are determined by Customer.
Where special categories of Personal Data are transferred, Ruddr applies the technical and organizational measures described in Annex II.
Frequency of transfer
Personal Data may be transferred on a continuous basis for the duration of Customer's use of the Service.
Nature of the processing
Collection, recording, organization, structuring, storage, retrieval, consultation, use, transmission, disclosure, deletion and other Processing necessary to provide the Service in accordance with the Agreement, DPA and Customer's documented instructions.
Purpose of processing
To provide, secure, maintain and support the Service and otherwise Process Customer Personal Data in accordance with the Agreement, DPA and Customer's documented instructions.
Retention period
Customer Personal Data will be retained for the period determined by Customer through its use and configuration of the Service and thereafter as provided in the Agreement and DPA.
For transfers to Sub-processors
The subject matter, nature and duration of Processing by Ruddr's Sub-processors shall be limited to the Processing necessary for the Sub-processor to provide its applicable services to Ruddr in connection with the Service.
Customer Personal Data may relate to:
- Customer's employees, agents, advisors, contractors and freelancers;
- Customer's prospects, customers, business partners and vendors who are natural persons;
- employees and contact persons of Customer's prospects, customers, business partners and vendors; and
- other individuals whose Personal Data Customer or its Users submit to the Service.
Categories of personal data transferred
Customer Personal Data may include:
- identification and contact information, including names, addresses, email addresses, telephone numbers and job titles;
- employment and professional information, including employer, role, geographic location and areas of responsibility;
- financial and transactional information;
- project, time, expense, resource, billing and related professional-services information;
- technical and device information, including IP addresses and other information associated with use of the Service; and
- other Personal Data submitted to the Service by or on behalf of Customer.
Sensitive data transferred
Customer may submit special categories of Personal Data to the Service to the extent permitted by the Agreement. The specific categories and frequency of such transfers are determined by Customer.
Where special categories of Personal Data are transferred, Ruddr applies the technical and organizational measures described in Annex II.
Frequency of transfer
Personal Data may be transferred on a continuous basis for the duration of Customer's use of the Service.
Nature of the processing
Collection, recording, organization, structuring, storage, retrieval, consultation, use, transmission, disclosure, deletion and other Processing necessary to provide the Service in accordance with the Agreement, DPA and Customer's documented instructions.
Purpose of processing
To provide, secure, maintain and support the Service and otherwise Process Customer Personal Data in accordance with the Agreement, DPA and Customer's documented instructions.
Retention period
Customer Personal Data will be retained for the period determined by Customer through its use and configuration of the Service and thereafter as provided in the Agreement and DPA.
For transfers to Sub-processors
The subject matter, nature and duration of Processing by Ruddr's Sub-processors shall be limited to the Processing necessary for the Sub-processor to provide its applicable services to Ruddr in connection with the Service.
C. Competent Supervisory Authority
The competent supervisory authority shall be determined in accordance with Clause 13 of the SCCs.
ANNEX II
Technical and Organizational Measures
Ruddr maintains technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data. Such measures include the following, as applicable to the Service:
Information Security Management. Ruddr maintains an information security management system designed to identify, assess, and manage information security risks. Ruddr is certified to ISO/IEC 27001, with certification maintained through audits conducted by an independent third-party certification body.
Access Controls. Access to production systems and Customer Personal Data is restricted to authorized personnel based on job responsibilities and the principle of least privilege. Access rights are periodically reviewed and revoked when no longer required.
Authentication. Ruddr maintains authentication controls designed to prevent unauthorized access to systems used to Process Customer Personal Data. Multi-factor authentication is required for Ruddr personnel accessing production systems.
Encryption in Transit. Ruddr encrypts Customer Personal Data transmitted over potentially insecure networks using TLS 1.2 or higher and implements additional transport security controls, including HTTP Strict Transport Security (HSTS).
Encryption at Rest. Datastores containing Customer Personal Data, including Amazon S3 storage, are encrypted at rest. Ruddr applies additional row-level encryption to sensitive collections and database tables, as appropriate.
Network and Infrastructure Security. Ruddr maintains network and infrastructure security controls designed to protect its production environment against unauthorized access and to appropriately restrict access to systems Processing Customer Personal Data.
Application and Software Development Security. Ruddr maintains secure software development and change-management practices designed to reduce the introduction of security vulnerabilities into the Service, including appropriate code review, testing, and vulnerability-management procedures.
Vulnerability Management and Penetration Testing. Ruddr maintains processes to identify, assess, prioritize, and remediate security vulnerabilities. Ruddr engages an independent third party to conduct penetration testing at least annually and addresses identified findings based on their severity and associated risk.
Logging and Monitoring. Ruddr maintains logging and monitoring controls appropriate to its systems and services for purposes including detecting, investigating, and responding to security events and unauthorized activity.
Personnel Security. Ruddr conducts background checks for personnel, subject to applicable law and appropriate to their roles and responsibilities. Personnel with access to Customer Personal Data are subject to confidentiality obligations.
Security Awareness and Training. Ruddr provides information security training to personnel at least annually and maintains security awareness practices appropriate to personnel roles and responsibilities.
Incident Response. Ruddr maintains documented procedures for identifying, investigating, containing, remediating, and recovering from security incidents affecting Customer Personal Data. Ruddr periodically conducts security incident response exercises to evaluate and improve its incident response capabilities.
Backup and Recovery. Ruddr performs automated backups of its production database using AWS RDS automated backups, supporting point-in-time recovery within the configured retention period. RDS automated backups are retained for 30 days. Ruddr also generates nightly database backup files that are stored in Amazon S3 and replicated to Backblaze B2 to provide offsite resiliency. Lifecycle and retention controls are applied to backup data in both S3 and Backblaze B2 in accordance with Ruddr's backup retention policies.
Business Continuity and Disaster Recovery. Ruddr maintains business continuity and disaster recovery procedures designed to support the ongoing availability and resilience of the Service and the timely restoration of access to Customer Personal Data following an incident. Ruddr periodically tests its disaster recovery procedures and uses the results of such testing to evaluate and improve its recovery capabilities.
Sub-processor Management. Ruddr maintains procedures for evaluating Sub-processors that Process Customer Personal Data and requires such Sub-processors to enter into contractual obligations regarding data protection and security appropriate to the services they provide.
Security Assessments and Testing. Ruddr periodically evaluates the effectiveness of its information security controls, including through its ISO/IEC 27001 certification program, independent audits, vulnerability-management processes, annual third-party penetration testing, security incident exercises, and disaster recovery testing.
Data Retention and Deletion. Ruddr maintains procedures for the retention and deletion of Customer Personal Data in accordance with the Agreement, DPA, Customer's instructions, and applicable legal requirements.
Information Security Management. Ruddr maintains an information security management system designed to identify, assess, and manage information security risks. Ruddr is certified to ISO/IEC 27001, with certification maintained through audits conducted by an independent third-party certification body.
Access Controls. Access to production systems and Customer Personal Data is restricted to authorized personnel based on job responsibilities and the principle of least privilege. Access rights are periodically reviewed and revoked when no longer required.
Authentication. Ruddr maintains authentication controls designed to prevent unauthorized access to systems used to Process Customer Personal Data. Multi-factor authentication is required for Ruddr personnel accessing production systems.
Encryption in Transit. Ruddr encrypts Customer Personal Data transmitted over potentially insecure networks using TLS 1.2 or higher and implements additional transport security controls, including HTTP Strict Transport Security (HSTS).
Encryption at Rest. Datastores containing Customer Personal Data, including Amazon S3 storage, are encrypted at rest. Ruddr applies additional row-level encryption to sensitive collections and database tables, as appropriate.
Network and Infrastructure Security. Ruddr maintains network and infrastructure security controls designed to protect its production environment against unauthorized access and to appropriately restrict access to systems Processing Customer Personal Data.
Application and Software Development Security. Ruddr maintains secure software development and change-management practices designed to reduce the introduction of security vulnerabilities into the Service, including appropriate code review, testing, and vulnerability-management procedures.
Vulnerability Management and Penetration Testing. Ruddr maintains processes to identify, assess, prioritize, and remediate security vulnerabilities. Ruddr engages an independent third party to conduct penetration testing at least annually and addresses identified findings based on their severity and associated risk.
Logging and Monitoring. Ruddr maintains logging and monitoring controls appropriate to its systems and services for purposes including detecting, investigating, and responding to security events and unauthorized activity.
Personnel Security. Ruddr conducts background checks for personnel, subject to applicable law and appropriate to their roles and responsibilities. Personnel with access to Customer Personal Data are subject to confidentiality obligations.
Security Awareness and Training. Ruddr provides information security training to personnel at least annually and maintains security awareness practices appropriate to personnel roles and responsibilities.
Incident Response. Ruddr maintains documented procedures for identifying, investigating, containing, remediating, and recovering from security incidents affecting Customer Personal Data. Ruddr periodically conducts security incident response exercises to evaluate and improve its incident response capabilities.
Backup and Recovery. Ruddr performs automated backups of its production database using AWS RDS automated backups, supporting point-in-time recovery within the configured retention period. RDS automated backups are retained for 30 days. Ruddr also generates nightly database backup files that are stored in Amazon S3 and replicated to Backblaze B2 to provide offsite resiliency. Lifecycle and retention controls are applied to backup data in both S3 and Backblaze B2 in accordance with Ruddr's backup retention policies.
Business Continuity and Disaster Recovery. Ruddr maintains business continuity and disaster recovery procedures designed to support the ongoing availability and resilience of the Service and the timely restoration of access to Customer Personal Data following an incident. Ruddr periodically tests its disaster recovery procedures and uses the results of such testing to evaluate and improve its recovery capabilities.
Sub-processor Management. Ruddr maintains procedures for evaluating Sub-processors that Process Customer Personal Data and requires such Sub-processors to enter into contractual obligations regarding data protection and security appropriate to the services they provide.
Security Assessments and Testing. Ruddr periodically evaluates the effectiveness of its information security controls, including through its ISO/IEC 27001 certification program, independent audits, vulnerability-management processes, annual third-party penetration testing, security incident exercises, and disaster recovery testing.
Data Retention and Deletion. Ruddr maintains procedures for the retention and deletion of Customer Personal Data in accordance with the Agreement, DPA, Customer's instructions, and applicable legal requirements.
ANNEX III
List of Sub-Processors
Customer provides general authorization for Ruddr's use of Sub-processors in accordance with Section 4 of the DPA and Clause 9, Option 2, of the SCCs.
Ruddr's current list of Sub-processors, including the identity, location and description of Processing performed by each Sub-processor, is available within our trust site at: https://trust.ruddr.com/subprocessors
The current Sub-processor list is incorporated into this Annex III by reference.
Ruddr's current list of Sub-processors, including the identity, location and description of Processing performed by each Sub-processor, is available within our trust site at: https://trust.ruddr.com/subprocessors
The current Sub-processor list is incorporated into this Annex III by reference.
Last updated: October 2, 2026