Data Processing Agreement

This DPA is between your organization ("Customer", the controller) and Apliteni OÜ ("Processor"), and forms part of the Terms of Service once accepted. "Customer Personal Data" means the account, organization, and compliance-profile data Customer's authorized users submit to Rilvo — Rilvo is not designed to ingest Customer's own end-customers' personal data.

Processor processes Customer Personal Data to provide the Rilvo service, for as long as the Customer has an active subscription, plus any retention period described in the Privacy Policy.

• Data subjects: Customer's authorized users (org admins and team members).
• Categories of data: name, email, hashed API key, organization name, onboarding/compliance-profile answers, and the gap items, evidence links, and generated documents Customer's users create in the product.
• Nature and purpose: storage and AI-assisted analysis to identify applicable compliance domains and track remediation, as described in the Terms of Service.

• Process Customer Personal Data only on Customer's documented instructions, including as set out in this DPA.
• Ensure personnel with access are bound by confidentiality.
• Implement appropriate technical and organizational security measures (Art. 32 GDPR).
• Assist Customer in responding to data subject rights requests and in meeting its own GDPR obligations (security, breach notification, DPIAs) where relevant to Rilvo.
• Notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data.
• Delete or return Customer Personal Data at the end of the relationship, on request, subject to legal retention requirements.
• Make available information reasonably necessary to demonstrate compliance with this DPA, and allow for audits on reasonable notice.

Customer authorizes Processor to engage the sub-processors listed on our Sub-processors page. Processor will give Customer at least 30 days' notice before adding or replacing a sub-processor for the product, and Customer may object on reasonable data-protection grounds. Processor imposes data-protection obligations on sub-processors that are no less protective than this DPA.

Where a sub-processor is located outside the EEA, transfers are made under the European Commission's Standard Contractual Clauses, or another lawful transfer mechanism, as applicable.

Liability under this DPA follows the limitation of liability in the Terms of Service. This DPA takes effect when Customer accepts it (or, once launched, when Customer subscribes to the product) and terminates automatically when the underlying subscription ends.

This DPA is governed by the laws of Estonia.

compliance@apliteni.com