Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the Terms and Conditions of Service or any other written agreement (together, the “Agreement”) between the customer that has accepted the Agreement (“Customer”) and the RecRam entity that is party to the Agreement (“RecRam”). It applies whenever RecRam processes Customer Personal Data on the Customer’s behalf. No separate signature is required: accepting the Agreement includes acceptance of this DPA. Customers who need a countersigned copy can request one at gdpr@recram.com.

How RecRam uses personal data for its own purposes (for example account, billing and website data) is described separately in our Privacy Policy, where RecRam acts as a controller.

1. Definitions

Capitalized terms not defined here have the meaning given in the Agreement. In this DPA:

• “Applicable Data Protection Law” means all data protection and privacy laws that apply to the processing of Customer Personal Data under the Agreement, including the GDPR, the UK GDPR and UK Data Protection Act 2018, the Swiss Federal Act on Data Protection (“FADP”), the Turkish Law on the Protection of Personal Data No. 6698 (“KVKK”), and Applicable US State Privacy Laws.
• “Applicable US State Privacy Laws” means the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”) and its regulations, and the comparable consumer privacy laws of other US states, such as those of Virginia, Colorado, Connecticut, Utah and Texas, in each case as amended.
• “GDPR” means Regulation (EU) 2016/679. “UK GDPR” means the GDPR as it forms part of the law of the United Kingdom.
• “Customer Content” means all data that the Customer, its users or its respondents submit to the Services, including form answers, recordings, files and messages, and all output generated from it by the Services (such as transcripts, summaries, translations, captions and tone labels).
• “Customer Personal Data” means any personal data contained in Customer Content or otherwise processed by RecRam on behalf of the Customer under the Agreement.
• “Controller”, “Processor”, “Data Subject”, “Personal Data”, “Processing”, “Personal Data Breach” and “Supervisory Authority” have the meanings given in the GDPR. Equivalent terms under other Applicable Data Protection Law (such as “data controller” and “data processor” under KVKK, or “business”, “service provider” and “contractor” under the CCPA) are read accordingly.
• “Sub-processor” means any processor engaged by RecRam (including a RecRam affiliate) that processes Customer Personal Data.
• “SCCs” means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914. “UK Addendum” means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner (version B1.0, in force 21 March 2022), as amended.
• “Services” means the RecRam services described in the Agreement, including video and AI Chat forms, Recorder, Magnet, Room, transcription and related AI features, integrations and the API.

2. Roles of the Parties

• Customer as controller. The Customer is the controller of Customer Personal Data. It decides which forms to publish, which questions to ask, whom to invite, which features (including AI features and integrations) to use and how long to keep responses. Where the Customer acts as a processor for its own client, the Customer is responsible for obtaining that client’s authorization, and RecRam acts as the Customer’s sub-processor.
• RecRam as processor. RecRam processes Customer Personal Data only as a processor on behalf of the Customer.
• The RecRam entities. “RecRam” means RECRAM YAZILIM A.Ş. (Turkey), which provides the Services, is the contracting party and acts as processor. Its affiliate RECRAM INC (Delaware, USA) acts as a Sub-processor that provides support and operations for the Services, and is listed in Annex III. Paddle.com Market Limited sells subscriptions to the Services as reseller and Merchant of Record and is not a Sub-processor (see Annex III).
• RecRam as controller for its own data. RecRam is a controller only for the personal data it processes for its own purposes (account administration, billing, security, support, product analytics on aggregated or de-identified data, legal compliance and marketing), as described in the Privacy Policy. This DPA does not apply to that data.

3. Scope, Nature and Purpose of Processing

RecRam processes Customer Personal Data to provide, secure, maintain and support the Services in accordance with the Agreement and this DPA. The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are described in Annex I.

4. Processing on Documented Instructions

• RecRam processes Customer Personal Data only on the Customer’s documented instructions, including with regard to transfers to a third country, unless required to do so by law to which RecRam is subject. In that case RecRam will inform the Customer of the legal requirement before processing, unless the law prohibits this on important grounds of public interest.
• The Agreement, this DPA, the Customer’s configuration and use of the Services (including enabling or disabling features and integrations) and any further written instructions agreed by the parties are the Customer’s complete documented instructions.
• RecRam will inform the Customer without undue delay if, in its opinion, an instruction infringes Applicable Data Protection Law, and may suspend the affected processing until the instruction is confirmed or modified.
• The Customer is responsible for the lawfulness of its instructions and of the processing it initiates, including having a lawful basis, providing the notices and obtaining any consents required by law (for example for recording, for special categories of data or for the processing of children’s data), and for the accuracy and quality of Customer Content.

5. Confidentiality of Personnel

RecRam ensures that every person it authorizes to process Customer Personal Data is bound by an appropriate obligation of confidentiality, has been instructed on data protection, and accesses Customer Personal Data only to the extent necessary to provide the Services, to provide support the Customer has requested, to keep the Services secure, or to comply with law.

6. Security of Processing

Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risks to data subjects, RecRam implements and maintains appropriate technical and organizational measures to ensure a level of security appropriate to the risk, as required by Article 32 GDPR. These measures are described in Annex II. RecRam may update them over time, provided that the overall level of protection is not reduced.

The Customer is responsible for the security measures within its own control, including protecting account credentials, enabling two-factor authentication, managing team members’ permissions and the sharing settings of its forms and results, and the security of any third-party service it connects to the Services.

7. Sub-processors

• General authorization. The Customer gives RecRam general written authorization to engage Sub-processors. The current Sub-processors are listed in Annex III and are authorized.
• Notice of changes. RecRam will inform the Customer of any intended addition or replacement of a Sub-processor at least 30 days before it begins processing Customer Personal Data, by email to the account owner and by updating Annex III. Customers can also subscribe to updates by writing to gdpr@recram.com.
• Right to object. The Customer may object to a new Sub-processor on reasonable data protection grounds by writing to gdpr@recram.com within that 30-day period. The parties will discuss the objection in good faith. If RecRam cannot offer a reasonable alternative, the Customer may terminate the affected Services before the change takes effect and will receive a refund of any prepaid fees for the unused part of the subscription term.
• Flow-down. RecRam imposes on each Sub-processor, by written contract, data protection obligations that offer at least the same level of protection as this DPA, in particular sufficient guarantees to implement appropriate technical and organizational measures.
• Liability. RecRam remains liable to the Customer for the performance of each Sub-processor’s obligations as for its own, subject to Section 18.
• Customer-enabled integrations are not Sub-processors. Third-party services that the Customer chooses to connect (for example Zapier, Make, n8n, Google Sheets, Google Calendar, Slack, HubSpot, Salesforce, Zendesk, Calendly, Cal.com, webhooks, or tracking tags the Customer adds to its own forms) receive data on the Customer’s instruction and under the Customer’s own agreement with that provider.

8. Data Subject Requests

• Taking into account the nature of the processing, RecRam assists the Customer by appropriate technical and organizational measures, insofar as possible, in responding to requests from data subjects to exercise their rights under Chapter III GDPR (Articles 12 to 23) and equivalent rights under other Applicable Data Protection Law. The Services let the Customer view, export (for example as CSV) and delete responses and recordings itself while its subscription or trial is active. On the Customer’s written instruction, RecRam can also find, export or erase the data of an individual respondent across the Customer’s forms, recorders and AI Chat forms.
• If RecRam receives a request directly from a data subject that relates to Customer Personal Data, RecRam will forward it to the Customer without undue delay where the Customer can be identified, and will not respond to it except to direct the data subject to the Customer, unless the Customer instructs otherwise or the law requires it.

9. Data Protection Impact Assessments and Prior Consultation

Taking into account the nature of the processing and the information available to it, RecRam provides reasonable assistance to the Customer with data protection impact assessments and prior consultations with Supervisory Authorities under Articles 35 and 36 GDPR, in particular by providing the information in this DPA, on the How RecRam uses AI page and in its security documentation.

10. Personal Data Breach Notification

• RecRam will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data.
• The notification will describe, to the extent then known: the nature of the breach, including where possible the categories and approximate number of data subjects and records concerned; the name and contact details of RecRam’s contact point; the likely consequences of the breach; and the measures taken or proposed to address the breach and mitigate its possible adverse effects. Where information is not available at the same time, RecRam will provide it in phases without undue further delay.
• RecRam will take reasonable steps to contain, investigate and mitigate the breach, keep a record of it, and cooperate with the Customer so that it can meet its obligations under Articles 33 and 34 GDPR and equivalent laws (including the KVKK requirement to notify the Personal Data Protection Board within 72 hours).
• Notification of a breach is not an acknowledgment of fault or liability. Unsuccessful attempts that do not compromise the security of Customer Personal Data (such as pings, port scans or blocked log-in attempts) are not Personal Data Breaches.

11. Deletion and Return of Customer Personal Data

• During the subscription. The Customer can delete individual responses, recordings and files, or whole forms, at any time. Deleted items are removed from the Customer’s workspace immediately and are permanently deleted from RecRam’s active systems within 30 days.
• Export. The Customer can export its responses (for example as CSV) and download its recordings and files while its subscription or trial is active. When a trial ends, or a paid subscription is cancelled or expires, access to the Services is locked, so the Customer should export what it needs before then. After that, RecRam will provide a copy of the Customer’s responses, recordings and files on request at any time before they are deleted under this Section 11. A copy of the account data (account, team, organizations and form details) is available to the account owner on request at any time.
• After the end of the Services. When the Customer deletes its account, or when its account is closed under the Agreement, RecRam deletes Customer Personal Data from its active systems within 90 days, unless the Customer has asked in that time for its return. Database backups are kept by RecRam’s database provider and are overwritten on that provider’s rolling backup schedule; until then they remain encrypted and access-restricted, and deleted data is not restored to the active systems.
• Legal retention. RecRam may keep Customer Personal Data longer only where Union, Member State or other applicable law requires it. In that case RecRam keeps it confidential and processes it only for that purpose.
• On written request, RecRam will confirm deletion in writing.

12. Information and Audits

• RecRam makes available to the Customer the information reasonably necessary to demonstrate compliance with Article 28 GDPR and this DPA.
• RecRam will first meet audit requests by answering the Customer’s reasonable written security and privacy questionnaires and by providing relevant documentation, policies and any third-party audit reports or certifications RecRam or its Sub-processors hold, subject to confidentiality.
• Where that information is not sufficient to demonstrate compliance, or where a Supervisory Authority requires it, the Customer (or an independent auditor bound by confidentiality and not a competitor of RecRam) may carry out an audit, including an on-site inspection, with at least 30 days’ written notice, during normal business hours, without unreasonable disruption to RecRam’s operations and without access to other customers’ data.
• Audits are limited to once in any 12-month period, except following a Personal Data Breach affecting the Customer or where a Supervisory Authority requires it. Each party bears its own costs, unless the audit reveals a material breach of this DPA by RecRam.

13. International Transfers

Customer Personal Data may be processed in the countries listed in Annex III, including the European Union, the United States and Turkey. RecRam will transfer Customer Personal Data only in compliance with Applicable Data Protection Law.

13.1 Transfers from the EEA (EU SCCs)

To the extent that the Customer’s use of the Services involves a transfer of Customer Personal Data subject to the GDPR to RecRam in a country that is not subject to an adequacy decision, the SCCs are incorporated into this DPA by reference and apply as follows:

• Module Two (controller to processor) applies where the Customer is a controller, and Module Three (processor to processor) applies where the Customer is a processor.
• The Customer is the data exporter. RECRAM YAZILIM A.Ş. (Turkey) is the data importer.
• Clause 7 (docking clause) applies.
• Clause 9(a): Option 2 (general written authorization) applies, with the 30-day notice period set out in Section 7.
• Clause 11(a): the optional language permitting an independent dispute resolution body does not apply.
• Clause 13: the competent Supervisory Authority is determined in accordance with Clause 13(a) and Annex I.C.
• Clause 17: the SCCs are governed by the law of Ireland (Option 1).
• Clause 18(b): disputes are resolved by the courts of Ireland.
• Annexes I, II and III of the SCCs are completed by Annexes I, II and III of this DPA.

Where RecRam transfers Customer Personal Data to a Sub-processor in a third country without an adequacy decision, RecRam enters into the SCCs (Module Three) or relies on another valid transfer mechanism with that Sub-processor. Where a Sub-processor in the United States is certified under the EU-U.S. Data Privacy Framework (and, where relevant, its UK Extension and the Swiss-U.S. framework), RecRam may rely on that certification.

13.2 Transfers from the United Kingdom

For transfers subject to the UK GDPR, the SCCs apply as amended by the UK Addendum, which is incorporated by reference. Table 1 is completed with the parties’ details in Annex I; Table 2 with the modules and options selected in Section 13.1; Table 3 with Annexes I to III of this DPA; and in Table 4 both the importer and the exporter may end the UK Addendum as permitted by its Section 19.

13.3 Transfers from Switzerland

For transfers subject to the FADP, the SCCs apply with the following changes: references to the GDPR are read as references to the FADP where the transfer is subject to it; the Swiss Federal Data Protection and Information Commissioner is the competent Supervisory Authority for such transfers; the term “Member State” does not exclude data subjects in Switzerland from bringing claims in their place of habitual residence; and the governing law and courts in Section 13.1 continue to apply.

13.4 Transfer impact assessments

RecRam will provide the Customer with information reasonably necessary for a transfer impact assessment, including on the laws of the importing countries and the supplementary measures applied. If RecRam receives a legally binding request from a public authority for access to Customer Personal Data, it will, unless legally prohibited, notify the Customer, review the legality of the request, challenge it where there are reasonable grounds to do so, and disclose only the minimum information required.

13.5 Transfers under Turkish law (KVKK)

RecRam is established in Turkey. For a Customer established in Turkey, providing Customer Personal Data to RecRam is therefore not a transfer abroad. Where RecRam transfers Customer Personal Data to a Sub-processor outside Turkey (see Annex III), it does so under Article 9 KVKK as amended by Law No. 7499, in particular using the standard contracts published by the Personal Data Protection Board (“Board”), and, as data exporter, RecRam notifies the Board within five business days of signing each standard contract, as the law requires. See also Section 15.

14. US State Privacy Laws

To the extent Customer Personal Data is subject to Applicable US State Privacy Laws, RecRam acts as the Customer’s “service provider” or “contractor” under the CCPA and as its “processor” under the other Applicable US State Privacy Laws. The Customer discloses Customer Personal Data to RecRam only for the limited and specified business purpose of providing the Services under the Agreement. RecRam will:

• not sell or share Customer Personal Data (as “sell” and “share” are defined in the CCPA), and not use it for targeted advertising or cross-context behavioral advertising;
• not retain, use or disclose Customer Personal Data for any purpose (including any commercial purpose) other than the business purposes specified in the Agreement, or outside the direct business relationship between RecRam and the Customer, except as permitted by Applicable US State Privacy Laws;
• not combine Customer Personal Data with personal data it receives from or on behalf of another person, or collects from its own interactions with a consumer, except as permitted by Applicable US State Privacy Laws;
• comply with the obligations that apply to it under Applicable US State Privacy Laws and provide the same level of privacy protection they require;
• notify the Customer if it determines that it can no longer meet its obligations under Applicable US State Privacy Laws;
• allow the Customer, on notice, to take reasonable and appropriate steps to stop and remediate any unauthorized use of Customer Personal Data, and to take reasonable steps to ensure that RecRam uses Customer Personal Data consistently with the Customer’s obligations;
• assist the Customer with consumer requests and with data protection assessments as described in Section 8 and Section 9; and
• engage Sub-processors only under a written contract that imposes the same obligations, after giving notice as described in Section 7.

RecRam certifies that it understands and will comply with the restrictions in this Section 14.

15. Turkish Data Protection Law (KVKK)

• Where the KVKK applies, the Customer is the “data controller” (veri sorumlusu) and RecRam is a “data processor” (veri işleyen). RecRam takes the technical and administrative measures required by Article 12 KVKK, which are described in Annex II.
• The Customer is responsible for its own obligations as data controller, including informing data subjects under Article 10 KVKK, having a legal ground under Article 5 KVKK (or Article 6 for special categories of personal data), obtaining explicit consent where it relies on explicit consent, and, where applicable, registering with the Data Controllers’ Registry (VERBIS).
• RecRam will notify the Customer of any unauthorized acquisition of Customer Personal Data without undue delay and within the time set out in Section 10, so that the Customer can notify the Board and the persons concerned.
• Transfers abroad are made in accordance with Article 9 KVKK as described in Section 13.5.

16. AI Features

Some features of the Services use artificial intelligence. This Section describes what those features do with Customer Personal Data. A plain-language version is available on the How RecRam uses AI page.

16.1 What the AI features do

RecRam’s AI features work on the content of answers and recordings. They:

• transcribe spoken answers into text and create captions;
• summarize answers and extract topics and keywords;
• translate answers and questions;
• indicate the tone of the text of an answer (for example positive, neutral or negative);
• describe what is shown in images and in frames of video or screen recordings (for example a product, damage to it, a document or what is on a screen), without describing the people in them;
• extract the specific details the Customer asks for from the content of answers (for example an order number or a product name), in custom fields and automation steps the Customer sets up;
• draft titles, quotes and short texts for clips the Customer chooses to publish in a showcase;
• answer the Customer’s team members’ questions about their own forms and responses (the in-app assistant); and
• in AI Chat forms, write follow-up questions within the topics the Customer has defined, using any knowledge documents the Customer provides.

16.2 What the AI features do not do

RecRam’s AI features do not, and are not designed to:

• evaluate, score, rank, screen, shortlist or classify people, or make or recommend decisions about them;
• infer a person’s emotions, personality, honesty, intentions, suitability for a role, or demographic characteristics or special categories of personal data;
• perform emotion recognition, facial recognition, or biometric identification or categorization; or
• create or alter a person’s likeness, face or voice.

Any scoring of responses in the Services is done by the Customer’s own team members, by hand. RecRam does not carry out decision-making based solely on automated processing that produces legal effects or similarly significant effects on data subjects within the meaning of Article 22 GDPR.

16.3 No training

RecRam does not use Customer Content to train, fine-tune or improve any AI model, whether RecRam’s or a third party’s. RecRam’s AI provider (Google, listed in Annex III) processes Customer Content as RecRam’s Sub-processor under Google’s paid cloud and API terms, under which Google does not use that content to train its models.

16.4 Customer controls and responsibilities

• The Customer decides whether AI processing takes place. In video forms, the Customer can turn “AI transcripts and summaries” off for each form; when it is off, no transcription, summarization, tone indication, image description or automatic translation is carried out on that form’s responses, the recordings are still stored and delivered, and integrations receive empty AI fields. When it is on, these features run automatically while the Customer has AI credits available. In Recorder, the Customer can turn transcription and summaries off for each recorder; when both are off, images uploaded to that recorder are not described by AI either, and if the setting cannot be read, no AI processing takes place. AI actions that the Customer’s team members start by hand in the Services (for example translating an answer or creating captions for their own video) run when they start them, whatever the form’s setting. AI Chat forms use AI by design. Other AI features (such as custom fields and the in-app assistant) run when the Customer uses or sets them up.
• AI output (such as transcripts and summaries) is stored with the response it was generated from and is deleted with it.
• AI output can contain errors. The Customer is responsible for reviewing it before relying on it, and for any decisions it makes about people. Decisions about people must be made by a human with the authority and information to make them.
• The Customer is responsible for informing respondents, in its own privacy notice, that their answers are processed with AI and for which purposes. Template wording is available on the How RecRam uses AI page. To support this, the Services show respondents a notice about AI processing on form pages where it is turned on, and AI Chat forms tell respondents that they are chatting with AI and that decisions are made by people; these notices do not replace the Customer’s own privacy notice.
• The Customer must use the AI features in line with the Acceptable Use Policy, which prohibits using the Services or their output to make solely automated decisions with legal or similarly significant effects, or to evaluate, profile or categorize people.
• To the extent the EU Artificial Intelligence Act (Regulation (EU) 2024/1689) applies to the Customer’s use of the Services, RecRam will provide reasonable information about the AI features to help the Customer meet its own obligations, for example as a deployer under Article 26 and in relation to the transparency obligations in Article 50.

17. Special Categories of Data and Children

• RecRam does not require, and does not infer, special categories of personal data (Article 9 GDPR, Article 6 KVKK), such as data about health, racial or ethnic origin, religion, political opinions, sex life or sexual orientation, or biometric data used to identify a person, or data about criminal convictions. If the Customer chooses to collect such data (for example health information in a patient check-in form), the Customer must have a lawful basis and any explicit consent the law requires, must take the additional measures the law requires, and must have in place any sector-specific agreements its use requires. RecRam does not offer business associate agreements under the US Health Insurance Portability and Accountability Act (HIPAA).
• Video and audio recordings may incidentally reveal information about a person (for example their appearance or voice). RecRam does not process recordings to identify people or to infer special categories of data from them, and protects all recordings with the measures in Annex II.
• The Services are not directed to children under 16. The Customer must not use the Services to collect personal data from children under 16 (or the higher age required in the relevant country) without verifiable consent from a parent or guardian where the law requires it.

18. Liability

Each party’s liability arising out of or in connection with this DPA is subject to the limitations and exclusions of liability in the Agreement, except to the extent that Applicable Data Protection Law (including the SCCs) does not permit such limitation, in particular regarding a party’s liability to data subjects.

19. Order of Precedence

In the event of a conflict, the following order of precedence applies: (1) the SCCs (and the UK Addendum or Swiss adaptations, where applicable) and any KVKK standard contract; (2) this DPA; (3) the Terms and Conditions of Service and any other part of the Agreement. Nothing in this DPA reduces either party’s obligations under Applicable Data Protection Law.

20. Term and Changes

This DPA applies for as long as RecRam processes Customer Personal Data on the Customer’s behalf, including after the end of the Agreement until deletion under Section 11. RecRam may update this DPA to reflect changes in law, in the Services or in its Sub-processors. Changes that materially reduce the protection of Customer Personal Data will not take effect without at least 30 days’ notice, and the Customer may terminate the affected Services before they take effect.

21. Contact

Questions about this DPA, objections to Sub-processors, audit requests and breach notifications are handled at gdpr@recram.com.

Annex I: Description of Processing

A. List of parties

Data exporter: the Customer, as identified in its RecRam account and the Agreement. Contact: the account owner’s email address. Activities: use of the Services described in the Agreement. Role: controller (or processor on behalf of its own client). Signature and date: by accepting the Agreement.

Data importer: RECRAM YAZILIM A.Ş., Muallimköy Mh, Bilişim Vadisi, Deniz Cd. No:143/8-1, 41400 Gebze/Kocaeli, Turkey. Contact: gdpr@recram.com. Activities: provision of the Services. Role: processor. Signature and date: by accepting the Agreement.

B. Description of the transfer and processing

C. Competent Supervisory Authority

The Supervisory Authority of the EU Member State in which the data exporter is established. Where the data exporter is not established in the EU but falls within Article 3(2) GDPR and has appointed a representative, the authority of the Member State in which the representative is established; where it has not appointed one, the authority of the Member State in which the data subjects concerned are located. For the UK, the Information Commissioner’s Office; for Switzerland, the Federal Data Protection and Information Commissioner; for Turkey, the Personal Data Protection Board (KVKK Kurulu).

Annex II: Technical and Organizational Security Measures

RecRam maintains the following measures, reviewed and updated regularly:

• Encryption: personal data is encrypted in transit over public networks using current TLS, and encrypted at rest in the primary database, in file storage and in database backups. Access tokens for integrations the Customer connects are stored encrypted, and passwords and sign-in codes are stored only as one-way hashes. For apps the Customer connects to its account (for example automation tools or AI assistants), refresh tokens are stored only as one-way hashes and expire after 90 days without use.
• Access control: role-based access with least privilege and need-to-know; unique accounts for personnel; multi-factor authentication for RecRam’s internal administration panel; removal of access when a person’s role changes; operator access to a customer’s account is logged.
• Customer account security: optional two-factor authentication and sign-in with Google for customer users; role-based permissions for team members; logical separation of each customer’s data.
• Logging and monitoring: logging of security-relevant events and administrative access; personal data in application logs and operational alerts is masked or removed automatically (for example email addresses are shortened and IP addresses truncated, except for security events); monitoring and alerting for availability and security events.
• Availability and resilience: regular database backups by the database provider, with restricted access; monitored infrastructure.
• Vulnerability management: keeping software and dependencies up to date, applying security patches, and reviewing code and configuration for security issues.
• Secure development: separation of development and production environments; testing of changes before release; no use of production personal data for testing unless necessary for support and protected accordingly.
• Personnel: confidentiality obligations for all personnel, instruction on data protection and security, and access to personal data only as needed for their role.
• Incident response: procedures to detect, contain, investigate and notify Personal Data Breaches within the timelines in Section 10.
• Sub-processor management: review of the security and privacy practices of Sub-processors before engagement, and written data protection terms with each of them.
• Data minimization and deletion: collection limited to what the Customer configures and what is needed to run the Services; deletion controls for the Customer; items the Customer deletes are permanently erased, together with their AI output and stored files, 30 days after deletion; deletion at the end of the Services as described in Section 11.
• Physical security: production systems are hosted in data centers operated by Sub-processors that maintain recognized physical and environmental security controls.

Annex III: Sub-processors

RecRam uses the following Sub-processors to process Customer Personal Data. Customer-enabled integrations are not Sub-processors (see Section 7). Paddle.com Market Limited, which sells RecRam subscriptions as merchant of record, receives billing data as an independent controller and does not process Customer Content.

Last change to this list: November 7, 2026. RecRam does not use any other AI provider.