Data Processing Addendum

Scope and effective date

This Data Processing Addendum ("DPA") forms part of the Terms of Service between Recursiv Labs, Inc. ("Recursiv," "Processor") and the customer that has accepted those terms ("Customer," "Controller"). It governs Recursiv’s processing of personal data submitted to the Service by or on behalf of Customer. It is effective as of the date Customer accepts the Terms of Service or, if later, the date the Service first processes personal data on Customer’s behalf.

Definitions

Capitalized terms not defined here have the meaning given in the Terms of Service or the GDPR. "Personal Data," "Process," "Controller," "Processor," "Data Subject," and "Personal Data Breach" have the meanings given in Article 4 of the GDPR. "Customer Personal Data" means Personal Data contained in Customer Content that Recursiv processes on Customer’s behalf in providing the Service.

Roles of the parties

The parties acknowledge that Customer is the Controller of Customer Personal Data and Recursiv is the Processor acting on Customer’s documented instructions, except where Recursiv is required by applicable law to process otherwise (in which case Recursiv will inform Customer unless prohibited by law). For account, billing, and other data Recursiv processes about Customer for its own purposes, Recursiv acts as a Controller and the Privacy Policy applies.

Subject matter, duration, nature, and purpose

Subject matter: provision of the Service. Duration: the term of the Terms of Service, plus any post-termination period during which Recursiv retains Customer Content. Nature and purpose: hosting, storing, transmitting, processing, analyzing, and otherwise handling Customer Personal Data as needed to provide the Service. Categories of Data Subjects and Personal Data are determined by Customer in its use of the Service and may include Customer’s users, employees, contractors, customers, and other Data Subjects whose data is included in Customer Content.

Customer instructions

Customer’s acceptance of the Terms of Service and use of the Service constitutes Customer’s documented instructions to Recursiv to process Customer Personal Data as necessary to provide the Service, comply with law, and enforce the agreement. Additional instructions outside this scope require a written amendment, and Recursiv may charge for material new processing requirements.

Confidentiality of personnel

Recursiv ensures that personnel authorized to process Customer Personal Data are bound by confidentiality obligations and are trained on data protection requirements appropriate to their role.

Security measures

Recursiv implements and maintains appropriate technical and organizational measures to protect Customer Personal Data against unauthorized or unlawful processing and against accidental loss, destruction, damage, alteration, or disclosure. Measures include encryption in transit (TLS 1.2+) and at rest (AES-256 or equivalent), least-privilege access control, audit logging, secure software development practices, vulnerability management, vendor due diligence, and incident response procedures, as further described in our security policies (information security, access control, encryption, change management, logging, vendor management, risk assessment, data retention).

Subprocessors

Customer authorizes Recursiv to engage subprocessors to process Customer Personal Data. The current list of subprocessors is published at recursiv.io/subprocessors. Recursiv enters into written agreements with each subprocessor that impose data protection obligations no less protective than those in this DPA. Recursiv will provide notice of new subprocessors via the subprocessor page or email at least 30 days before authorizing them; Customer may object on reasonable grounds in writing, in which case the parties will work together in good faith to find an alternative or, if no resolution is possible, Customer may terminate the affected portion of the Service.

Data subject rights assistance

Recursiv will, taking into account the nature of the processing, provide Customer with reasonable assistance through appropriate technical and organizational measures, insofar as possible, to fulfil Customer’s obligation to respond to requests from Data Subjects exercising their rights under applicable data protection law (access, rectification, erasure, restriction, portability, objection, automated decision-making). Where Recursiv receives a Data Subject request directly, it will promptly forward it to Customer.

Personal data breach notification

Recursiv will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data. Notification will include, to the extent known, the nature of the breach, categories and approximate number of Data Subjects and records affected, likely consequences, measures taken or proposed, and the contact point for further information. Recursiv will reasonably cooperate with Customer in investigating, mitigating, and remediating the breach.

Data Protection Impact Assessments

Recursiv will provide Customer with reasonable assistance, taking into account the nature of the processing and information available to Recursiv, to enable Customer to carry out Data Protection Impact Assessments and consult with supervisory authorities where required by Articles 35 and 36 of the GDPR or comparable provisions.

International transfers

Where Recursiv transfers Customer Personal Data from the EEA, UK, or Switzerland to a country outside those regions that has not received an adequacy decision, the transfer is governed by the EU Standard Contractual Clauses approved under Commission Implementing Decision (EU) 2021/914 (Module 2: Controller to Processor; or Module 3 where Customer is itself a Processor), the UK International Data Transfer Addendum, and the Swiss FDPIC equivalent, as applicable. By accepting this DPA, the parties are deemed to have signed and incorporated those instruments. Recursiv applies additional safeguards (encryption, access controls, transparency reports) as required.

Audits and certifications

Recursiv makes available to Customer information necessary to demonstrate compliance with this DPA, including its security policies and (when available) third-party audit reports such as SOC 2. Customer may request additional audit information once per 12-month period, subject to confidentiality. Where audits are required by law, the parties will cooperate to scope them reasonably and to minimize disruption to the Service.

Deletion or return of personal data

On termination of the Terms of Service, and at Customer’s choice expressed within 30 days of termination, Recursiv will delete or return all Customer Personal Data, and will delete existing copies, unless retention is required by applicable law. Standard backup retention cycles will result in residual copies being deleted within Recursiv’s standard backup retention period.

Liability

Each party’s liability arising out of or related to this DPA is subject to the Limitation of Liability section of the Terms of Service. The combined cap covers liability under both the Terms and this DPA.

Order of precedence

In the event of conflict between this DPA, the Terms of Service, and the Standard Contractual Clauses, the order of precedence is: (1) the Standard Contractual Clauses, (2) this DPA, (3) the Terms of Service. Otherwise the agreements coexist.

Contact

Data protection inquiries can be sent to [email protected].