Data Processing Addendum

1. Scope and roles

This Data Processing Addendum (“DPA”) forms part of the Terms of Service (the “Agreement”) between Rabbitblaze and the Customer. It applies whenever Rabbitblaze processes Customer Personal Data in providing the Service. Customers who accept the Agreement accept this DPA; no separate signature is needed. If you need a countersigned copy for your records, write to [email protected].

For Customer Personal Data, the Customer is the controller (or a processor acting for its own controller) and Rabbitblaze is the processor (or subprocessor).

2. Definitions

Terms such as “controller”, “processor”, “data subject”, “personal data”, “processing” and “supervisory authority” have the meanings given in the GDPR. In addition:

• Data Protection Laws means the GDPR (Regulation (EU) 2016/679), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended, and other data protection laws that apply to the processing under the Agreement.
• Customer Personal Data means personal data in Customer Data that Rabbitblaze processes on the Customer’s behalf.
• Subprocessor means a third party engaged by Rabbitblaze to process Customer Personal Data.
• Security Incident means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.

3. Processing instructions

Rabbitblaze processes Customer Personal Data only on the Customer’s documented instructions. The Agreement, this DPA and the Customer’s configuration and use of the Service (for example, connecting a channel, enabling Blaze or setting a retention rule) are the Customer’s complete instructions. Rabbitblaze will tell the Customer if it believes an instruction infringes Data Protection Laws.

The Customer is responsible for the lawfulness of the instructions and of the personal data it provides, including giving any required notices and obtaining any required consents from data subjects.

Under the California Consumer Privacy Act, Rabbitblaze is a service provider: it won’t sell or share Customer Personal Data, or retain, use or disclose it outside the direct business relationship with the Customer or for any purpose other than providing the Service.

4. Confidentiality

Rabbitblaze ensures that everyone authorized to process Customer Personal Data is bound by confidentiality obligations and accesses it only as needed to provide, secure and support the Service.

5. Security

Rabbitblaze implements and maintains the technical and organizational measures described in Annex 2, appropriate to the risk of the processing. Rabbitblaze may update these measures over time, as long as the overall level of protection doesn’t decrease.

6. Subprocessors

The Customer gives general authorization for Rabbitblaze to engage subprocessors. The current subprocessors are listed in Annex 3.

Rabbitblaze will notify the Customer at least 30 days before engaging a new subprocessor, by email to the workspace owner or in the Service. The Customer may object on reasonable data protection grounds within that period. If we can’t resolve the objection, the Customer may end the affected part of the Service and receive a refund of any prepaid fees for the remaining period.

Rabbitblaze imposes data protection obligations on each subprocessor that are no less protective than this DPA, and remains responsible for its subprocessors’ performance of those obligations.

7. Data subject requests

The Service lets the Customer access, correct, export and delete contacts and their conversations. If Rabbitblaze receives a request from a data subject about Customer Personal Data, it will redirect the data subject to the Customer and won’t respond directly unless the Customer authorizes it. Taking into account the nature of the processing, Rabbitblaze will assist the Customer in fulfilling its obligations to respond to such requests.

8. Security incidents

Rabbitblaze will notify the Customer without undue delay, and in any case within 72 hours, after becoming aware of a Security Incident. The notice will describe, as far as the information is available, the nature of the incident, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Rabbitblaze will take reasonable steps to contain the incident and limit its effects, and will keep the Customer updated.

Notifying a Security Incident isn’t an acknowledgement of fault or liability.

9. Impact assessments

Taking into account the nature of the processing and the information available to it, Rabbitblaze will provide reasonable assistance with the Customer’s data protection impact assessments and prior consultations with supervisory authorities about the Service.

10. Return and deletion

The Customer can export Customer Data while its workspace is active. After the Agreement ends or the workspace is deleted, Rabbitblaze deletes Customer Personal Data from its live systems within 30 days and from backups within 90 days, unless the law requires it to keep the data. Any data kept for that reason stays protected by this DPA.

11. Audits

Rabbitblaze will make available to the Customer the information reasonably necessary to demonstrate compliance with this DPA, including answers to reasonable security questionnaires. If that information isn’t enough to meet the Customer’s obligations, or a supervisory authority requires it, the Customer may conduct an audit once a year with at least 30 days’ notice, during business hours, at its own cost, subject to confidentiality and without access to other customers’ data.

12. International transfers

Rabbitblaze and its subprocessors may process Customer Personal Data outside the European Economic Area, the UK and Switzerland. Where such a transfer requires a transfer mechanism, the parties agree to the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914, which are incorporated by reference:

• Module Two (controller to processor) applies where the Customer is a controller, and Module Three (processor to processor) where the Customer is a processor;
• Clause 7 (docking clause) applies, Clause 9 option 2 (general authorization, with notice as described in section 6) applies, and the optional language in Clause 11 doesn’t apply;
• Clauses 17 and 18 are governed by, and disputes resolved in, the law and courts of Ireland;
• Annexes I and II of the Clauses are completed by Annexes 1 and 2 of this DPA.

For transfers from the UK, the UK International Data Transfer Addendum issued by the Information Commissioner applies together with the Clauses. For transfers from Switzerland, references to the GDPR are read as references to the Swiss Federal Act on Data Protection, and the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner.

13. Liability and precedence

Each party’s liability under this DPA is subject to the limitations in the Agreement, except where Data Protection Laws or the Standard Contractual Clauses don’t allow it. If this DPA conflicts with the Agreement, this DPA controls. If it conflicts with the Standard Contractual Clauses, the Clauses control.

Annex 1: Details of processing

• Subject matter and duration. Providing the Service under the Agreement, for as long as the Agreement is in effect and until deletion as described in section 10.
• Nature and purpose. Hosting, storing, indexing, searching, transmitting and displaying Customer Data; delivering messages by chat and email; generating AI answers and drafts with Blaze and Copilot; producing reports; providing support; and keeping the Service secure.
• Categories of data subjects. The Customer’s contacts (customers, website visitors and leads), the Customer’s teammates, and other people whose information the Customer submits.
• Categories of personal data. Names and contact details; identifiers such as user IDs, visitor IDs and email addresses; conversation content and attachments; contact and company attributes; events and page views the Customer tracks; device, browser, IP address and approximate location derived from it; satisfaction ratings and survey answers.
• Special categories. None are intended. The Customer must not submit special categories of personal data unless the law allows it and it’s necessary for the conversation.
• Frequency. Continuous, for the duration of the Agreement.

Annex 2: Technical and organizational measures

Encryption. All connections use TLS 1.2 or newer. Files are encrypted at rest with AES-256. Secrets such as two-factor authentication seeds, identity verification keys and webhook signing secrets are encrypted with AES-256-GCM. API keys are stored only as SHA-256 hashes.

Access control. Role-based permissions in the Service (owner, admin, agent, viewer); two-factor authentication for teammates; passwords hashed with Argon2; HttpOnly, Secure session cookies; strict origin checks on dashboard requests; access to production systems limited to the people who need it.

Isolation. Every request is authorized against the workspace it belongs to, and data from one workspace is never served to another.

Application security. Input validation on every endpoint; sanitization of all user-supplied HTML; rate limiting on sign-in, messaging and API endpoints; protection against server-side request forgery when fetching external content; signed, expiring URLs for files; HMAC-SHA256 signatures on outgoing webhooks; identity verification for signed-in Messenger users.

AI safeguards. Blaze answers only from the content the Customer connects. Prompts are built to resist injected instructions. Before Copilot learns from past conversations, contact details, payment numbers and secrets are redacted. AI providers don’t use Customer Data to train their models.

Logging and monitoring. Security-relevant actions are recorded in the workspace audit log. Infrastructure and application errors are logged and monitored.

Resilience. Daily database backups, each verified after it is taken and stored encrypted at rest with a separate provider, and infrastructure that can be rebuilt from code.

Vendor management. Subprocessors are selected for their security practices and bound by written data protection terms.

Incident response. A documented process for assessing, containing and notifying Security Incidents, as described in section 8.

Annex 3: Subprocessors

Subprocessor	Purpose	Location
Hetzner Online GmbH	Application hosting and databases	Germany (EU)
Cloudflare, Inc.	DNS, content delivery, network security and backup storage	Global network
Backblaze, Inc.	File storage	United States
Resend, Inc.	Email sending and receiving	United States
Google LLC	AI processing	United States
Stripe, Inc.	Payment processing (billing data only)	United States
PayPal, Inc.	Payment processing (billing data only)	United States