Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Rummlabs LLC(“Rummlabs”) and the Customer. It applies whenever Rummlabs processes personal data contained in Customer Data (“Customer Personal Data”). Terms defined in the Terms of Service have the same meaning here.

For Customer Personal Data, the Customer is the controller (or, where it acts for someone else, a processor) and Rummlabs is its processor. Under US state privacy laws such as the California Consumer Privacy Act, Rummlabs is the Customer’s service provider or processor.

“Data Protection Laws” means the privacy laws that apply to the processing, including the EU General Data Protection Regulation (“GDPR”), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and US state privacy laws.

Rummlabs processes Customer Personal Data only on the Customer’s documented instructions. Those instructions are the Terms and this DPA, the Customer’s use and settings of the Service, and any other reasonable written instructions the Customer gives that are consistent with them. The details of the processing are in Annex 1.

Rummlabs will tell the Customer if it believes an instruction breaks Data Protection Laws, and may then decline to follow it. Rummlabs may also process data where the law requires it, and will tell the Customer first unless the law forbids that.

The Customer is responsible for having a lawful basis for the processing and for giving its Clients the notices the law requires.

Rummlabs limits access to Customer Personal Data to the people who need it to run and support the Service, and makes sure they are bound by a duty of confidentiality.

Rummlabs maintains the technical and organizational measures in Annex 2, which are designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access. Rummlabs may update them as long as the overall level of protection does not go down.

The Customer gives Rummlabs general authorization to use the subprocessors listed in Annex 3. Rummlabs will tell the Customer by email to its account owner at least 14 days before adding or replacing a subprocessor. If the Customer has a reasonable objection based on data protection, it can tell Rummlabs within that time. The parties will then try to resolve it in good faith. If they cannot, the Customer may end the affected part of the Service and receive a refund of any prepaid fees for the unused period.

Rummlabs puts each subprocessor under written terms that protect Customer Personal Data at least as well as this DPA, as appropriate to the service it provides, and remains responsible to the Customer for its subprocessors as the law requires.

These are not subprocessors of Rummlabs, because the Customer or its Team Members choose and engage them directly:

• AI assistants that Team Members connect under their own accounts (for example Claude by Anthropic or Codex by OpenAI). The Customer is responsible for that relationship, for choosing plans that suit its data, and for any agreement it needs with that provider.
• Stripe, for payment data the Customer receives through its own Stripe account, which Stripe processes under its agreement with the Customer.
• Other services the Customer chooses to connect or import from.

The Service lets the Customer find, correct, export and delete Customer Personal Data, and lets Clients ask for their portal account to be deleted. If Rummlabs receives a request directly from an individual about Customer Personal Data, it will pass it to the Customer without undue delay and will not answer it itself unless the Customer authorizes it. Rummlabs will give the Customer reasonable help with requests it cannot handle through the Service.

Taking into account the nature of the processing and the information available to it, Rummlabs will give the Customer reasonable help with its obligations on security, data protection impact assessments and consultations with supervisory authorities. Help that goes beyond what the Service provides may be charged at a reasonable rate agreed in advance.

Rummlabs will tell the Customer without undue delay, and no later than 72 hours after confirming it, if it becomes aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data. The notice will describe, as far as Rummlabs then knows, what happened, the data and people likely affected, the likely consequences, and the steps taken or proposed. Rummlabs will add details as it learns them.

Rummlabs will take reasonable steps to contain the breach and reduce its effects. Notifying a breach is not an admission of fault.

When the Service ends for a Customer, Rummlabs will return Customer Personal Data on request made within 30 days, and will delete it within 90 days after the end. Rummlabs may keep data the law requires it to keep, and data in backups until they are overwritten on their normal schedule. Data it keeps stays protected by this DPA.

Rummlabs will make available the information reasonably needed to show that it meets this DPA, including answers to reasonable security questionnaires once a year. If that is not enough to meet the Customer’s legal obligations, or a supervisory authority requires it, the Customer may audit Rummlabs’ compliance once in any 12 months, with at least 30 days’ written notice, during normal business hours, at the Customer’s cost, and under confidentiality. The audit must not reach other customers’ data or subprocessors’ facilities. For subprocessors, Rummlabs may rely on their own certifications and reports.

Customer Personal Data is stored and processed in the United States. Where a transfer of Customer Personal Data from the European Economic Area, the United Kingdom or Switzerland to Rummlabs needs a transfer mechanism, the parties agree to the following, which are incorporated into this DPA by reference:

• EU transfers: the Standard Contractual Clauses adopted by the European Commission in Decision 2021/914, Module Two (controller to processor), or Module Three (processor to processor) where the Customer is a processor. Clause 7 does not apply. Under Clause 9(a), Option 2 applies, with the notice period in section 5 of this DPA. The option in Clause 11 does not apply. Under Clauses 17 and 18, the law and courts of Ireland apply. Annexes 1, 2 and 3 of this DPA complete the Annexes to the Clauses.
• UK transfers: the International Data Transfer Addendum issued by the UK Information Commissioner, with the information above completing its tables, and either party may end it as its Section 19 allows.
• Swiss transfers: the EU clauses above, read so that references to the GDPR mean the Swiss Federal Act on Data Protection and the competent authority is the Swiss Federal Data Protection and Information Commissioner.

The Customer is the data exporter and Rummlabs the data importer. If these clauses conflict with the rest of this DPA or the Terms, the clauses prevail.

Rummlabs will not sell or share Customer Personal Data, as those terms are defined in US state privacy laws. It will not keep, use or disclose it for any purpose other than providing the Service to the Customer or as those laws permit, or outside its direct business relationship with the Customer, and will not combine it with personal information it receives from other sources, except as those laws allow. Rummlabs will tell the Customer if it can no longer meet these obligations, and the Customer may then take reasonable steps to stop and remedy any unauthorized use. Rummlabs certifies that it understands and will comply with these restrictions.

Each party’s liability under this DPA is subject to the limits in the Terms of Service, except where Data Protection Laws or the transfer clauses in section 11 do not allow it. If this DPA conflicts with the Terms, this DPA prevails for the processing of Customer Personal Data. This DPA lasts for as long as Rummlabs processes Customer Personal Data. Questions about it go to support@rummdesk.com.

Parties

Data exporter: the Customer, as identified in its account. Data importer: Rummlabs LLC, New York, United States, support@rummdesk.com.

Subject matter and duration

Providing the Service to the Customer, for as long as it uses the Service and the deletion period after that.

Nature and purpose

Hosting, storing, organizing, displaying, sending and deleting Customer Data so the Customer can manage its client relationships: client portals, documents and files, electronic signatures, forms, invoices and payment status, project boards, notes and messages.

People the data is about

The Customer’s Clients and their contacts, people who send inquiries, the Customer’s Team Members, and anyone else whose details the Customer puts into the Service.

Types of personal data

Names, email addresses, phone numbers, company and project details; documents and files; signatures, with the time, IP address and browser recorded with each; form answers; invoice and payment status (not card numbers); credentials the Customer shares with a Client; messages and activity records.

Sensitive data

The Service is not designed for special categories of personal data or health information, and the Customer should not put them in it except where its work requires it and the law allows.

Frequency

Continuous, while the Customer uses the Service.

Competent supervisory authority

The authority that has jurisdiction over the Customer under the GDPR, or the UK Information Commissioner for UK transfers.

• Encryption: all traffic uses TLS. The database and file storage are encrypted at rest by the hosting provider.
• Separation: every database table is protected by row-level security, so each request can reach only the records of the business, and the client, it belongs to. Access is checked in the application and again in the database.
• Roles: owners, admins and employees have different permissions, and an employee sees only the clients assigned to them.
• Files: documents are kept in private storage and served through signed links that expire within minutes, never through public URLs.
• Shared credentials: encrypted with AES-256-GCM using a separate key for each credential, which is itself encrypted with a master key kept outside the database.
• Signatures: each document sent for signature is fingerprinted with SHA-256 so later changes can be detected, and the signed copy has a certificate recording who signed, when and from which IP address.
• Accounts: passwords are stored only in hashed form by the authentication provider. AI connections use OAuth, are limited to what the person who connected them can do, and can be revoked at any time.
• Records: sign-ins, password resets and administrative actions are logged with the time, IP address, browser and approximate location.
• Operations: access to production systems is limited to Rummlabs personnel who need it. Changes are reviewed and tested before release, and the database provider keeps regular backups.