Razviel Data Processing Addendum (DPA)

Version: v1.0 (2026-08-25)
Status: Annex A to the Razviel Services Agreement (SERVICES_AGREEMENT.md), incorporated by reference and accepted with it. No separate signature is required for self-serve customers; enterprise customers may execute it separately.
Entity: Razviel LLC, a Delaware limited liability company, 28 Geary St, Ste 650, PMB 671, San Francisco, California 94108, United States

1. Scope, Roles and Definitions

1.1 Scope. This DPA applies whenever Razviel Processes Personal Information on behalf of the Customer in providing the Services. It forms part of the Services Agreement and, on any matter of personal-data processing, security or data-subject rights, this DPA controls (Services Agreement §23).

1.2 Roles.

1.3 Definitions. "Personal Information" means information relating to an identified or identifiable natural person that Razviel Processes on the Customer's behalf, and includes "personal data" and "personal information" as defined in Applicable Privacy Law. "Process"/"Processing" has the meaning given in Applicable Privacy Law. "Applicable Privacy Law" means the CCPA/CPRA and its regulations (11 CCR §§7050–7053), the comprehensive privacy laws of Virginia, Colorado, Connecticut, Texas, Utah, Oregon, Montana and other U.S. states as they take effect, the EU General Data Protection Regulation (Regulation (EU) 2016/679, the "GDPR"), the UK GDPR and the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection, and the Brazilian Lei Geral de Proteção de Dados (Lei 13.709/2018, the "LGPD") — each to the extent it applies to the Personal Information Processed, regardless of where the Customer is established. Capitalized terms not defined here have the meaning given in the Services Agreement.

1.4 Categories of data. Personal Information Processed under this DPA is limited to what the Services require:

1.5 Data subjects. The Customer's end customers and prospective customers, and — as to the content they generate inside the Services (notes, instructions, configuration) — the Customer's authorized users of the dashboards. Account data of those authorized users (identity, role, credentials, billing contact, security and usage telemetry) is Processed by Razviel as an independent controller under its Privacy Policy, not under this DPA.

1.6 Duration. For the term of the Services Agreement, plus the retention windows in §10.

1.7 What Razviel does NOT Process under this DPA. Payment card data (handled by the Customer's own payment processor), and the data of Razviel's Human Nodes and of the participants in Razviel's affiliate program (each a separate relationship in which Razviel acts as its own controller — see §8.5).

1.8 Lawful basis and features. Razviel relies on no lawful basis of its own for the Processing under this DPA; the Customer determines and warrants the lawful basis for its end customers' Personal Information (Services Agreement §15.1(b)). Features that draw on an end customer's history across conversations — including customer memory and customer-value segmentation — are features the Customer enables in its configuration and may disable at any time, and are the Customer's documented instruction while enabled.

2. The Nine CCPA Service-Provider Commitments (11 CCR §7051)

These nine commitments are the substance of Razviel's Service Provider status. They apply to all Personal Information, regardless of the Customer's own CCPA thresholds.

2.1 Limited and specified business purposes. Razviel Processes Personal Information only for the specific business purposes set out in the Services Agreement and this DPA — namely: receiving, classifying, routing and resolving the Customer's customer-support requests; executing actions the Customer's Brand Policy Matrix authorizes; maintaining transcripts and ticket records; providing analytics and reporting to the Customer; securing and supporting the Services; and improving the Services subject to §6. Razviel Processes only on the Customer's documented instructions, of which the Services Agreement, this DPA, the Matrix and the Customer's in-product configuration are the complete record.

2.2 No selling, no sharing. Razviel will not sell Personal Information and will not share it for cross-context behavioral advertising, as those terms are defined in the CCPA. Razviel receives no monetary or other valuable consideration for Personal Information.

2.3 No retention, use or disclosure outside the contract. Razviel will not retain, use or disclose Personal Information for any purpose other than the business purposes in §2.1, including not for any commercial purpose other than providing the Services, and not outside the direct business relationship between Razviel and the Customer, except as permitted by the CCPA.

2.4 No retention, use or disclosure outside the direct business relationship. Razviel will not retain, use or disclose Personal Information outside the direct business relationship with the Customer. In particular, Razviel does not use one customer's Personal Information for the benefit of, or in the provision of services to, another customer. De-identified and aggregated data used under §6 is not Personal Information and is outside this restriction.

2.5 No combining with other sources. Razviel will not combine Personal Information received from or on behalf of the Customer with Personal Information received from or on behalf of any other person, or collected from its own interactions with a consumer, except as expressly permitted by the CCPA for a service provider (including to detect security incidents or protect against fraudulent or illegal activity).

2.5A Sensitive Personal Information. "Sensitive Personal Information" ("SPI") has the meaning given in the CCPA/CPRA, and includes the equivalent "sensitive data" categories of the other U.S. state privacy laws. The Services are not designed to collect SPI, and the Customer is instructed not to route SPI to them; the categories in §1.4 do not include SPI. Where SPI nonetheless reaches Razviel — because an end customer volunteers it in a support conversation, or because the Customer's own configuration sends it — Razviel will not use, retain or disclose that SPI for any purpose other than the business purposes permitted by 11 CCR §7027(m) and by §2.1 of this DPA, will not use it to infer characteristics about any consumer, and will not sell or share it (§2.2). Razviel supports the Customer's obligation to honor a consumer's right to limit the use and disclosure of SPI (§3.2).

2.6 Certification of understanding and compliance. Razviel certifies that it understands the restrictions in §§2.1–2.5, §2.5A and §§2.7–2.10 and will comply with them, and will comply with the applicable obligations of the CCPA in providing the Services.

2.7 Notification of inability to comply. Razviel will notify the Customer without undue delay (and in any event within five business days of determination) if it determines that it can no longer meet its obligations under Applicable Privacy Law or this DPA. On such notice, the Customer may direct Razviel to stop the affected Processing.

2.8 The Customer's right to take action. The Customer has the right, on notice, to take reasonable and appropriate steps to stop and remediate unauthorized use of Personal Information by Razviel, including directing Razviel to cease a specific Processing activity, requiring remediation, and, where the issue is not remediated, terminating the Services Agreement.

2.9 Right to monitor. The Customer has the right to take reasonable and appropriate steps to ensure that Razviel uses Personal Information in a manner consistent with the Customer's obligations under Applicable Privacy Law. Razviel will support this through §11 (Audit and Attestation).

2.10 Platform consent signals. Where the Customer's commerce platform records a consumer's consent or opt-out decision — including marketing and analytics preferences and any "do not sell or share" signal the platform exposes — and exposes that decision to Razviel through the integration, Razviel honors it in the Processing, as the Customer's Service Provider and Processor. Collecting, recording and maintaining those decisions on its own platform is the Customer's responsibility; Razviel does not collect or determine them. Razviel does not infer consent from a consumer's conduct, does not use support interactions for marketing or analytics purposes, and does not override a decision recorded on the platform.

2.11 Infringing instructions. Razviel will immediately inform the Customer if, in Razviel's opinion, an instruction infringes Applicable Privacy Law, and may suspend the affected Processing until the Customer confirms or withdraws the instruction. This §2.11 does not oblige Razviel to obtain legal advice on the Customer's behalf.

3. Additional Processing Obligations (U.S. state superset)

3.1 Confidentiality of personnel. Razviel ensures that every individual authorized to Process Personal Information — including every Human Node and every internal or contracted service provider — is bound by a written duty of confidentiality. See §9.

3.2 Assistance with consumer rights requests. Razviel will assist the Customer, taking into account the nature of the Processing, in responding to verified consumer requests to know, access, correct, delete, port, limit use of sensitive information, or opt out. Razviel will implement the Customer's instruction (including deletion) across the Services and pass it to subprocessors within ten (10) business days of a documented request, or sooner where the statutory deadline applicable to the Customer requires. Where an end customer contacts Razviel directly, Razviel will not respond substantively and will direct the individual to the Customer and notify the Customer.

3.3 Assistance with assessments. Razviel will provide reasonable assistance with the Customer's data-protection assessments, risk assessments, and consultations with regulators, to the extent the information is within Razviel's possession, within ten (10) business days of a documented request, or sooner where the statutory deadline applicable to the Customer requires.

3.4 Deletion on instruction. Razviel will delete or return Personal Information on the Customer's instruction, subject to §10.

3.5 State-specific extras. Razviel additionally: (a) provides the Customer advance notice of, and the ability to object to, new subprocessors (Colorado standard, §8.3); (b) cooperates actively with the Customer in fulfilling consumer-rights obligations (Connecticut/Texas standard, §3.2); and (c) makes available the information necessary to demonstrate compliance (§11).

4. Security

4.1 Measures. Razviel maintains technical and organizational measures appropriate to the risk, including:

(a) encryption in transit and at rest for Personal Information;
(b) row-level access control scoping each Human Node to only the tickets assigned to them and the queue of brands they are certified for — no visibility into another Node's tickets, another brand's tickets, or tickets resolved without human involvement;
(c) private media storage with opaque keys — uploaded media is stored in a private bucket, referenced only by opaque storage keys that do not embed filenames or personal information, and is never exposed through public URLs;
(d) backend-authoritative authorization — every privileged operation is re-derived from the authenticated identity on the server, never from client input;
(e) data minimization — only the fields the Services require are collected and retained;
(f) access logging and auditability — every ticket carries an end-to-end record (context → policy → decision → execution → outcome), which is also the compliance audit trail;
(g) secrets isolation — third-party credentials are held only where the service identity reaches and are never readable by Human Nodes or by the Customer's dashboard users;
(h) personnel controls — access only through the Razviel console; no bulk export; contractual prohibition on copying, exporting or photographing customer data (§9).

4.2 Evolution. Razviel may update its measures provided the overall level of protection is not reduced.

4.3 The Customer's own responsibilities. The Customer is responsible for its own account credentials and user access, the security posture of its Connected Accounts, and the accuracy of the data it makes available to the Services.

5. Security Incidents and Notification Clocks

5.1 Notice to the Customer — without undue delay, and within 72 hours. On becoming aware of a Security Incident affecting Personal Information Processed on the Customer's behalf, Razviel will notify the Customer without undue delay and in no event later than seventy-two (72) hours, with the information then available: nature and categories of data affected, approximate scope, likely consequences, and measures taken or proposed. Where the Customer is subject to GDPR Article 33(1), Razviel gives that notice as early within that period as the confirmed facts allow, so that the Customer can meet its own seventy-two-hour obligation, and supplements the notice in phases as facts are confirmed (GDPR Article 33(4)).

5.2 The separate 24-hour clock for Shopify Protected Customer Data. Where the incident affects data classified as Shopify Protected Customer Data, Razviel will additionally notify Shopify within twenty-four (24) hours, as required by the Shopify platform terms. These are two distinct clocks and both apply: 24 hours to Shopify, 72 hours to the Customer.

5.3 Who notifies the individuals. The Customer, as Business/Controller, is responsible for notifying its end customers and any regulator, and determines the content and timing of that notice. Razviel will provide reasonable cooperation and information.

5.4 Cooperation. Razviel will take reasonable steps to contain and remediate, preserve relevant logs, and keep the Customer informed as the investigation develops.

5.5 No admission. Notice under this §5 is not an acknowledgment of fault or liability.

6. Service Improvement — Within the Customer's Own Account

This section is what the Customer authorizes for improvement, and it stops at the Customer's own account. It is the counterpart of Services Agreement §12.3.

6.1 What is authorized. The Customer authorizes Razviel to use Personal Information Processed under this DPA to improve the Services for that Customer — retrieving and drawing on the Customer's own resolved cases when handling the Customer's later cases, so that the Services get better at the Customer's business. This is retrieval and curation at the time of answering: it does not train, fine-tune or otherwise modify any model. It is subject to §§6.2–6.6.

6.2 The mother-rule: nothing crosses between customers. No Customer Data, in any form, crosses from one customer's account to another. Not raw tickets, not transcripts, not attachments, not customer memory, not identifiers — and not de-identified, aggregated or derived material drawn from any of them. Each Customer's material stays with that Customer, permanently. Razviel operates no cross-customer improvement.

6.3 De-identification commitment. Where Razviel uses de-identified data at all, it (a) takes reasonable measures to ensure the data cannot be associated with an individual or household, (b) publicly commits to maintain and use the data in de-identified form and not to attempt re-identification, and (c) contractually obliges any recipient to the same.

6.4 The platform obligation, met by not doing it. Razviel does not train AI or machine-learning models on merchant or customer data obtained through a third-party commerce platform — with or without consent. The improvement described in §6.1 modifies no model. This is stricter than the obligation the Shopify platform terms impose, and it is stated as an absolute precisely so that nothing turns on a consent that is not asked for.

6.5 If this ever changes. Two things would each require the Customer's separate, prior, written consent — asked for on its own, optional, and recorded on its own: (a) any use of the Customer's data to improve Razviel's models beyond the Customer's own account; and (b) any training or fine-tuning of a model on the Customer's data at all, including a model that would serve only that Customer. Neither consent is asked for nor held today, and neither use occurs. Until one is asked for and given, §6.2 and §6.4 govern without exception.

6.6 Ownership of the result. Models, weights, statistics, benchmarks and aggregated de-identified datasets produced under this §6 are Service-Generated Data owned exclusively by Razviel (Services Agreement §12.4). They contain no Personal Information. Razviel makes no claim of ownership over raw Customer Data.

7. International Transfers — Always On

7.1 When this §7 applies. This §7 applies whenever Personal Information relating to an individual in the EEA, the United Kingdom or Switzerland is Processed under this DPA — regardless of where the Customer is established and regardless of whether the Customer considers itself subject to the GDPR. Razviel applies it as a contractual standard, not only where the law compels it.

7.2 The transfer mechanism. For such Personal Information:

(a) the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (Controller to Processor), are incorporated into this DPA by reference and form part of it, with: Clause 7 (docking) included; Clause 9 Option 2 (general written authorization for subprocessors, with the notice period in §8.3); Clause 11 optional independent-dispute-resolution language not included; Clause 17 Option 1, governed by the law of Ireland; Clause 18(b) forum Ireland; Annex I.A = the Parties as identified in the Services Agreement, with the acceptance record of Services Agreement §24.3 (accepting user, IP address, timestamp, document version and hash) standing as the signature and date of each Party; Annex I.B = §§1.4–1.6 of this DPA; Annex I.C = the Irish Data Protection Commission; Annex II = §4 of this DPA; Annex III = §8 of this DPA, at the list version published under §8.2B;
(b) the UK International Data Transfer Addendum (version B1.0) applies to UK transfers, with the Clauses in (a) as its Approved Addendum and its Tables completed by reference to the same annexes; for Switzerland, the Clauses apply with the adaptations required by the Swiss Federal Data Protection and Information Commissioner;
(c) §§2, 3, 4, 5, 8, 9, 10 and 11 of this DPA are the GDPR Article 28(3) terms: documented instructions (§2.1, §2.11), confidentiality of personnel (§3.1, §9), security (§4), subprocessor conditions (§8), assistance with data-subject rights (§3.2) and with Articles 32–36 (§3.3, §5), deletion or return at the Customer's choice (§10), and information and audit (§11);
(d) the Parties acknowledge that the European Commission has indicated that the Clauses in (a) are not designed for a data importer that is itself directly subject to the GDPR under Article 3(2), and that a dedicated set may be adopted; until then the Parties apply the Clauses in (a) as the appropriate safeguard, and Razviel will propose the dedicated set by notice under §12.3 once adopted;
(e) where the Customer's workspace is provisioned in a European region, Personal Information at rest does not leave that region; the transfers that remain are those in §7.4 and §8.2.

7.3 Conflict. Where the Clauses apply and conflict with this DPA, the Clauses prevail.

7.4 Human Node access from outside the United States. Human Nodes access Personal Information from the countries listed in §8.2, in the course of resolving the Customer's tickets, through the Razviel console and under §9. That access is an onward transfer under Clause 8.8 of the Clauses: each Human Node is bound, before any access, by a written contract that contains in substance the same obligations as those binding Razviel under the Clauses, including third-party beneficiary rights for data subjects, through the Standard Contractual Clauses Module Three incorporated in that contract (Node Master Agreement, Annex A §A.12). No Personal Information is stored, downloaded or copied in the Human Node's country; access is screen-only, logged, and revoked in the same transaction as the end of the engagement. Razviel maintains a transfer impact assessment for each such country and makes it available under §11.1. The Customer acknowledges and instructs this access.

8. Subprocessors

8.1 General authorization. The Customer gives Razviel a general written authorization to engage subprocessors, subject to this §8.

8.2 The list.

8.2A The Human Node category, explained. Human Nodes are independent service providers (individuals or their own entities) under contract with Razviel — never Razviel staff — engaged and authorized as a category of subprocessor, not as individually named entities:

(a) Individually bound. Every Human Node is individually bound by confidentiality and data-protection obligations before receiving any access — under §9 of this DPA and the Data Annex (Annex A) of the Provider agreement it accepts, which imposes obligations no less protective than those in this DPA (§8.6). The binding is the same whether the Provider contracts as an individual or through its own entity (Services Agreement §2).

(b) Engaged and replaced under §8.3, as a category. The category is engaged, changed and replaced under §8.3's notice-and-objection mechanics. The rotation, addition or replacement of an individual Human Node within the category is not the engagement of a new subprocessor and does not trigger a new §8.3 notice — the Customer's authorization runs to the category and to the controls that bind every member of it, not to any individual.

(c) Why it is drafted this way. Continuity of coverage requires that any certified provider be able to take over a module at any time, including by the substitution right the Provider agreement grants (Node Master Agreement §1.5, where approval is automatic upon certification). Authorizing the category is what makes that operationally possible while keeping the §7051 chain intact down to the individual (§9.1).

8.2B The published list — version, date and changes. The list in §8.2 is the list of subprocessors published to the Customer, and this DPA, at the address where it is served, is where it is published. List version 1, published with this version of the DPA. Every addition or replacement — of a named subprocessor, of the Human Node category, of a country within that category, or of an underlying model provider on the allowlist below — is made under §8.3: notice at least thirty (30) days before it takes effect, by in-product notice and by email to the Customer's account contact; the version number of this list incremented; the date of the change stated; and the change recorded in the change log of this §8.2B. The rotation of an individual Human Node within a listed country is not a change to the list (§8.2A(b)). Underlying model providers (the OpenRouter allowlist). The gateway may route a workspace's requests only to a provider named on this allowlist, each with its country of processing; no request is sent to a provider that is not on it, and the allowlist is completed under §8.3 before the first request is sent in production. Change log: none — this is the first published version of the list.

8.3 New subprocessors. Razviel will give the Customer at least thirty (30) days' notice before adding or replacing a subprocessor, by in-product notice or email. The Customer may object on reasonable data-protection grounds within that period; the Parties will work in good faith to find a solution, and if none is found the Customer may terminate the affected Services without penalty, with a pro-rata refund of prepaid unused Fees.

8.4 The Customer's own connected platforms are NOT Razviel subprocessors. The Customer's helpdesk, e-commerce and order-tracking platforms — for example Gorgias and Shopify — are the Customer's own systems, contracted by the Customer, holding the Customer's data under the Customer's own agreements. Razviel accesses them as the Customer's authorized agent (Services Agreement §§4.1–4.2). They are listed here for transparency only and are not Razviel subprocessors; Razviel is not responsible for their processing, security or availability.

8.5 Expressly out of scope. GitHub (source-code hosting — no Customer Data) and Razviel's payout providers for its independent service providers and for the participants in its affiliate program (which process Human Node and Affiliate data under separate relationships, not Customer Data) are not subprocessors under this DPA and do not process Personal Information Processed on the Customer's behalf. Razviel's payment processor for the Customer's own billing operates under the commercial relationship, not this DPA.

8.6 Flow-down and liability. Razviel imposes on each subprocessor, by written contract, data-protection obligations no less protective than those in this DPA, including the restrictions in §2 and the confidentiality obligation in §9. Razviel remains fully liable to the Customer for its subprocessors' performance, subject to the Services Agreement §6.3. Razviel's standard of care in selecting and contracting the third-party infrastructure the Services run on — an obligation of means at the standard of the industry — is stated in Services Agreement §11A, which expressly does not reduce this §8.6.

9. The Confidentiality Chain, Down to the Individual

9.1 The requirement. The service-provider chain requires that every individual who Processes Personal Information be under a duty of confidentiality. Razviel's chain is: Customer → Razviel → subprocessor / Human Node → individual.

9.2 Human Nodes. Each Human Node accepts a Confidentiality and Data Protection Annex to its Node Master Agreement before receiving any access. That annex obliges the Node to: never copy, export, download, photograph or screenshot customer data; use customer data only inside the Razviel console and only to resolve the assigned ticket; maintain device and environment security; report any actual or suspected incident to Razviel's published security contact, security@razviel.com, within twenty-four (24) hours of becoming aware of it (Node Master Agreement, Annex A §A.6); assign all work product; and comply with acceptable-use rules.

A Human Node is an independent service provider — an individual or its own entity — under contract with Razviel, never Razviel staff (Services Agreement §2). It Processes Personal Information under that written contract with Razviel and under Razviel's authority and instruction, within the service-provider chain of 11 CCR §7051 — as an individual member of the subprocessor category authorized in §8.2/§8.2A, never on its own account, never for its own purposes, and never as a party to whom the Customer has given any independent instruction. Its authorization is drawn from, and bounded by, Razviel's own; it determines no purpose or means of its own; and it is replaceable within the category without a new authorization (§8.2A(b)).

9.3 Internal and contracted personnel. Any Razviel personnel or contractor with access is bound by equivalent written obligations, and access is granted on a least-privilege basis.

10. Retention, Return and Deletion

10.1 During the term. Razviel retains Personal Information for as long as the Services require, applying data minimization.

10.2 On termination. Razviel makes Customer Data available for export for thirty (30) days after termination, then deletes or de-identifies it. A dormant account under Services Agreement §10.2(d) is not terminated until that paragraph so provides; the export window runs from termination. Retention during dormancy remains at the Customer's choice within the meaning of GDPR Article 28(3)(g): the Customer may instruct deletion or return at any point during dormancy (Services Agreement §10.2(d)(ii)), and Razviel executes that instruction under §10.5 without waiting for the dormant period to end. Dormancy is the Customer's standing instruction to retain, given by not terminating, and is never a retention Razviel decides for its own purposes.

10.3 The 30-day platform clock. Where Personal Information was obtained through a commerce-platform integration, Razviel deletes it within thirty (30) days of the Customer uninstalling that integration's application from its store, mirroring the platform obligation — except where retention is required by law or permitted by §10.4. Disconnecting an integration without uninstalling it does not start this clock: a disconnection revokes the credential and pauses the operation (Services Agreement §9.0(g), §9.7), and it leaves the Customer's data where it is, under §10.1 and §10.2. The Customer may instruct deletion at any time under §10.5.

10.4 Permitted retention. Razviel may retain: (a) de-identified and aggregated data and Service-Generated Data, permanently (§6.6); (b) records required by law, or necessary to establish, exercise or defend legal claims; (c) on the Customer's instruction, records of abusive, fraudulent or policy-violating conduct by end customers, for the Customer's fraud prevention; and, as an independent controller under its Privacy Policy, a minimal pseudonymized record (a keyed hash of the identifier, the category of conduct and the date — never content) that Razviel keeps for the integrity of the platform, on the basis of its legitimate interest, for no longer than twenty-four (24) months; and (d) routine backups, which expire on their ordinary cycle and are not restored for any other purpose.

10.5 Deletion on instruction. Razviel executes the Customer's deletion instructions across the Services and passes them to subprocessors, subject to §10.4.

10.6 Certification of deletion. On the Customer's written request, Razviel will provide a written certification that the Personal Information covered by the request has been deleted or de-identified, identifying what was deleted, the date of deletion, and — where §10.4 permits retention — what was retained and on which of those grounds. Razviel will provide the certification within thirty (30) days of completing the deletion, or sooner where an applicable statutory deadline requires. Backups retained under §10.4(d) are stated in the certification as expiring on their ordinary cycle, and are not restored for any other purpose.

11. Audit and Attestation

11.1 Information on request. Razviel will make available to the Customer, on reasonable written request and no more than once per twelve (12) months, the information reasonably necessary to demonstrate compliance with this DPA — including a written description of its technical and organizational measures, its subprocessor list, a written attestation of compliance with §2, and, where and when obtained, any third-party audit report or certification (for example, a SOC 2 report). Razviel does not hold such a report or certification as of the version date, and this §11.1 is not a commitment to obtain one by any date.

11.2 Audit. Where Applicable Privacy Law requires more, and where the information under §11.1 is not sufficient, the Customer may conduct or mandate an audit, on at least thirty (30) days' notice, during business hours, no more than once per twelve months (unless required by a regulator or following a Security Incident), subject to confidentiality, without access to other customers' data or to Razviel's multi-tenant infrastructure internals, and at the Customer's cost — except that, where the audit reveals a material non-compliance by Razviel with this DPA, Razviel bears the reasonable cost of that audit and of the remediation.

11.3 Regulator cooperation. Razviel will cooperate with a supervisory authority or regulator to the extent required by Applicable Privacy Law.

11.4 Records and assessments. Razviel maintains a record of processing activities under GDPR Article 30(2) and LGPD Article 37, a transfer impact assessment for each transfer in §7 and §8, and a data protection impact assessment template describing the Services, which it makes available to the Customer on request under §3.3 to support the Customer's own assessment under GDPR Article 35.

12. General

12.1 Liability. Liability under this DPA is subject to the limitations in the Services Agreement §6, except where Applicable Privacy Law provides otherwise. Liability for an event originating with a third-party provider is CHANNELED to the Services Agreement §6.3 under Services Agreement §11A.3 — it is not eliminated: §8.6 of this DPA continues to apply in full.

12.2 Governing law and forum. As in the Services Agreement §8, except for claims under the Standard Contractual Clauses incorporated by §7.2, to which the Clauses' own governing law and forum apply.

12.3 Changes. Razviel may update this DPA to reflect changes in law, subprocessors or the Services, subject to Services Agreement §24 (material changes require active re-acceptance).

12.4 Contact. legal@razviel.com · Razviel LLC, mailing address: 28 Geary St, Ste 650, PMB 671, San Francisco, California 94108, United States. Data protection contact: legal@razviel.com (this is also the channel of Razviel's data protection officer under LGPD Article 41). EU representative under GDPR Article 27 and UK representative under UK GDPR Article 27: none appointed; Razviel appoints one, and states the contact here by notice under §12.3, once its Processing brings it within Article 3(2) on a non-occasional basis.

12.5 Government and law-enforcement requests. If Razviel receives a request from a public authority, law-enforcement agency or court for Personal Information Processed on the Customer's behalf, Razviel will:

(a) notify the Customer promptly, and before disclosing anything where the timetable allows, unless legally prohibited from doing so — and, where prohibited, use reasonable efforts to obtain a waiver of the prohibition and to inform the Customer as soon as the prohibition lapses;
(b) redirect the requesting authority to the Customer wherever that is possible, since the Customer is the Business/Controller and is the party that determines the purposes of the Processing;
(c) challenge a request that is unlawful, overbroad or excessive, where there is a reasonable and lawful basis to do so, including by seeking to narrow it; and
(d) where disclosure is ultimately compelled, disclose only the minimum the request legally requires, and keep a record of what was disclosed, to whom, and on what basis, which it will make available to the Customer where lawful.

Razviel maintains a record of the government requests it receives for this purpose. This §12.5 does not create an obligation to breach a valid legal order.

12.6 Governing language. This DPA is drafted in English, and the English version controls; any translation is provided for convenience only.

Razviel LLC · Delaware · Formed August 18, 2026