Data Processing Agreement

1. Roles

The Controller determines the purposes and means of processing the personal data contained in the contacts, messages, files and other content it processes through the Service ("Customer Data"). We process Customer Data on the Controller's behalf as its Processor.

We are an independent controller for the personal data of the Controller's account holders and team members that we process to manage the account, billing and support, as described in our Privacy Policy at https://app.rytheros.com/legal/privacy.

2. Subject matter, duration, nature and purpose

We process Customer Data for the duration of the Controller's subscription and the 30-day export window that follows it, solely to provide, maintain and support the Service as described in the Terms of Service. Processing includes collection, storage, retrieval, use, transmission to the messaging channels and AI providers needed to deliver the Service, combination and deletion.

3. Types of personal data and data subjects

Personal data may include names, phone numbers, email addresses, messaging identifiers, message content (text, images, audio, video, documents), conversation metadata, IP addresses and device identifiers, appointment details, and any other personal data the Controller or its end users submit through the Service.

Data subjects include the Controller's customers, prospects and contacts, message senders and recipients, appointment attendees, and any other individuals whose personal data is processed through the Service. The Service does not request special categories of data; any such data is submitted at the Controller's discretion and remains under its instruction.

4. Our obligations as Processor

We will:

• Process Customer Data only on the Controller's documented instructions, including with regard to transfers to a third country, unless required to do otherwise by EU or Member State law, in which case we will inform the Controller of that requirement before processing unless the law prohibits it. The Terms of Service, this DPA and the Controller's use of the Service's settings and features are the Controller's documented instructions.
• Ensure that the persons we authorise to process Customer Data are bound by confidentiality.
• Implement the technical and organisational measures described in Annex II and keep them appropriate to the risk.
• Engage sub-processors only under Section 5.
• Assist the Controller, by appropriate technical and organisational measures and insofar as possible, in responding to requests from data subjects exercising their rights under Chapter III of the GDPR.
• Assist the Controller in meeting its obligations under Articles 32 to 36 of the GDPR (security, breach notification, impact assessments and prior consultation), taking into account the nature of the processing and the information available to us.
• At the Controller's choice, delete or return all Customer Data at the end of the Service, subject to the export and deletion timelines in the Terms of Service, and delete remaining copies unless EU or Member State law requires storage.
• Make available the information necessary to demonstrate compliance with Article 28 and allow for and contribute to audits under Section 7.
• Inform the Controller immediately if, in our opinion, an instruction infringes the GDPR or other data protection law.

5. Sub-processors

The Controller gives general written authorisation for us to engage the categories of sub-processor listed in Annex III, including the platform provider whose software we operate and the sub-processors that provider engages to run it. A current list of sub-processors is available from support@rytheros.com.

We will inform the Controller of any intended addition or replacement of a sub-processor at least 14 days before the new sub-processor starts processing Customer Data, giving the Controller the opportunity to object. If the Controller objects on reasonable data-protection grounds and no solution is found within 30 days, the Controller may terminate the affected Service without penalty.

We impose data protection obligations on each sub-processor by written contract that provide at least the same level of protection as this DPA, and we remain liable to the Controller for each sub-processor's performance.

6. Personal data breach

We will notify the Controller without undue delay after becoming aware of a personal data breach affecting Customer Data, and in any event in time for the Controller to meet its own notification deadlines. The notification will describe the nature of the breach, the categories and approximate number of data subjects and records concerned where known, the likely consequences, the measures taken or proposed, and our point of contact. Information not available at first will be supplied in phases without undue delay. We will cooperate with the Controller in investigating, mitigating and remediating the breach.

7. Audits

The Controller may audit our compliance with this DPA once per calendar year, at its own expense, on at least 30 days' written notice, during business hours and in a manner that minimises disruption. Where we or the platform provider can demonstrate compliance through up-to-date documentation, third-party reports or written answers, we may provide those in place of an on-site inspection. Nothing in this section limits the rights of a supervisory authority.

8. International transfers

The Service is hosted in the European Union. Where Customer Data is transferred to sub-processors outside the European Economic Area, the transfer relies on the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), the UK International Data Transfer Addendum where UK GDPR applies, or an adequacy decision such as the EU-US Data Privacy Framework where the recipient is certified. Copies of the applicable safeguards are available from support@rytheros.com.

9. AI model training

Neither we nor our sub-processors use Customer Data to train AI models. AI providers process content under commercial API terms that exclude such use.

10. Term, liability and governing law

This DPA takes effect when the Controller accepts the Terms of Service or signs below, whichever is earlier, and remains in force for as long as we process Customer Data on the Controller's behalf. The limitations of liability in the Terms of Service apply to this DPA. This DPA is governed by the law that governs the Terms of Service.

Annex I: Description of the processing

• Controller: the entity identified in the signature block.
• Processor: Hrodebert Ryther LLC, with its registered address at 21902 Bahamas, Mission Viejo, CA 92692. Data protection contact: support@rytheros.com.
• Categories of data subjects and personal data: as set out in Section 3.
• Nature and purpose: provision of the multi-channel messaging and AI agent Service, as set out in Section 2.
• Duration: for the subscription term plus the 30-day export window, as set out in Section 2.
• Competent supervisory authority: determined by the place of establishment of each party.

Annex II: Technical and organisational measures

• Encryption of Customer Data in transit (TLS 1.2 or higher); encryption at rest of backups and of stored credentials and integration tokens.
• Hosting on dedicated servers in the European Union (Germany), with files and backups kept in the EU.
• Logical access controls and role-based permissions for personnel and for the Controller's own team members.
• Automated encrypted backups retained for up to 90 days; deleted data leaves backups within 90 days.
• Monitoring for errors and suspicious activity; regular vulnerability assessments and dependency updates.
• Incident response and business continuity procedures.
• Security assessment of sub-processors before onboarding and written data processing terms with each of them.
• Confidentiality obligations and data protection awareness for personnel.

A plain-language description of these measures is published at https://app.rytheros.com/legal/security.

Annex III: Sub-processors

We engage the following categories of sub-processor to deliver the Service. The current list, with the legal entity and location of each, is available from support@rytheros.com.

• The platform provider: the software company that builds and operates the platform we resell to you, established in the European Union, which hosts the service on dedicated servers in Germany and holds its own written data processing terms with us.
• Messaging channel providers that carry your messages, such as Meta Platforms (WhatsApp Business, Instagram, Messenger) and Twilio (WhatsApp Business API), and any telephony or email carrier behind a channel you connect.
• AI providers that generate replies, summaries, transcriptions and search indexes from message content, some of which are established in the United States. They process content under commercial API terms that do not permit using it to train their models.
• Payment processors that handle subscription and top-up payments.
• Email delivery, error monitoring and content delivery services used to run the platform.

Transfers to sub-processors outside the European Economic Area rely on the safeguards in Section 8.

Signatures

Controller

Processor

Hrodebert Ryther LLC, with its registered address at 21902 Bahamas, Mission Viejo, CA 92692