This Data Processing Addendum (the "DPA") forms part of the Terms of Service (the "Terms") between Chen Doytshman ("RabbitSync", the "Processor") and the customer that accepted the Terms (the "Customer", the "Controller"). It applies whenever RabbitSync processes Personal Data on the Customer's behalf in providing the Service. It needs no separate signature: accepting the Terms accepts this DPA. A Customer that needs a countersigned copy can ask at [email protected].
1. Definitions
Terms not defined here have the meaning given in the Terms. "Data Protection Law" means every law on the processing of personal data that applies to the processing under this DPA, including the GDPR (Regulation (EU) 2016/679), the UK GDPR and the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection, Israel's Protection of Privacy Law 5741-1981 and its regulations, and US state privacy laws such as the California Consumer Privacy Act. "Personal Data", "processing", "controller", "processor", "data subject" and "supervisory authority" have the meanings given in the GDPR. "Customer Personal Data" means Personal Data in Customer Data (as defined in the Terms) that RabbitSync processes on the Customer's behalf. "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
2. Roles and instructions
2.1 The Customer is the controller, and RabbitSync is a processor, of Customer Personal Data. Personal data that RabbitSync processes as a controller (such as account and billing data) is covered by the Privacy Policy, not by this DPA.
2.2 RabbitSync processes Customer Personal Data only on the Customer's documented instructions. The Terms, this DPA, and the Customer's configuration and use of the Service (which apps are connected, which data is synced, how and when) are the Customer's complete instructions. RabbitSync will tell the Customer if it believes an instruction breaches Data Protection Law, and is not required to follow it.
2.3 The Customer is responsible for the lawfulness of the processing it instructs, including having a legal basis for it and giving any notices required, and for the accuracy of Customer Personal Data.
2.4 The details of the processing are set out in Annex 1.
3. Confidentiality
RabbitSync ensures that everyone it authorizes to process Customer Personal Data is bound by an obligation of confidentiality, and gives access only to those who need it to provide, support or secure the Service.
4. Security
4.1 RabbitSync implements and maintains the technical and organizational measures in Annex 2, which are designed to protect Customer Personal Data against Personal Data Breaches. RabbitSync may update these measures, provided that the overall level of security is not reduced.
4.2 The Customer is responsible for using the Service securely, including managing who has access to its account and the access it grants to its Connected Apps.
5. Sub-processors
5.1 The Customer gives RabbitSync general authorization to engage sub-processors. The current sub-processors are listed at rabbitsync.io/company/sub-processors.
5.2 RabbitSync will notify the Customer of a new sub-processor at least 30 days before it begins processing Customer Personal Data, by email to the Customer's admins and by updating the list. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may terminate the affected part of the Service and receive a refund of fees prepaid for the period after termination.
5.3 RabbitSync imposes on each sub-processor data protection obligations no less protective than this DPA, and remains liable for its sub-processors' performance of them.
5.4 The applications the Customer connects to the Service (its Connected Apps) are not sub-processors of RabbitSync. The Customer chooses them, and transmissions to and from them are made on the Customer's instructions.
6. Data subject requests
Taking into account the nature of the processing, RabbitSync will assist the Customer, by appropriate technical and organizational measures, in responding to requests from data subjects to exercise their rights. Because the Service passes Customer Data through rather than storing it, most requests are best answered in the Customer's Connected Apps. If RabbitSync receives a request directly, it will refer the data subject to the Customer, unless the law requires otherwise.
7. Personal Data Breaches
7.1 RabbitSync will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach. The notice will describe, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences, and the measures taken or proposed. RabbitSync will provide further information as it becomes available.
7.2 RabbitSync will take reasonable steps to contain and remedy the breach, and will assist the Customer with any notifications to supervisory authorities and data subjects that the Customer must make.
7.3 Notifying a breach is not an acknowledgement of fault or liability.
8. Assistance
RabbitSync will give the Customer reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities about the Service, to the extent the Customer cannot do so with the information available to it.
9. Deletion
9.1 When the Customer's account is deleted, RabbitSync stops processing Customer Personal Data, revokes its access to the Customer's Connected Apps, and permanently deletes the Customer's sync configurations and sync state 7 days later. Backups that contain them are overwritten within 35 days after that.
9.2 Customer Data remains in the Customer's Connected Apps throughout, so no return of data is needed.
9.3 RabbitSync may keep Customer Personal Data where the law requires it, protected under this DPA for as long as it is kept.
10. Audits
10.1 RabbitSync will make available the information reasonably necessary to demonstrate its compliance with this DPA, including by answering security questionnaires.
10.2 If that information is not sufficient to demonstrate compliance, or a supervisory authority requires it, the Customer may audit RabbitSync's compliance, at the Customer's expense, no more than once a year, on at least 30 days' notice, during business hours, without access to other customers' data, and subject to confidentiality. The Customer may use an independent auditor bound by confidentiality who is not a competitor of RabbitSync.
11. International transfers
11.1 RabbitSync hosts the Service in the European Union and operates it from Israel. The European Commission, the United Kingdom and Switzerland recognize Israel as providing an adequate level of protection, so transfers of Customer Personal Data from the European Economic Area, the United Kingdom and Switzerland to RabbitSync rely on those adequacy decisions.
11.2 Where a sub-processor processes Customer Personal Data in a country without an adequacy decision, RabbitSync ensures the transfer is protected by the European Commission's Standard Contractual Clauses (module 3, processor to processor), with the UK International Data Transfer Addendum and the Swiss amendments where they apply, or by the sub-processor's certification under the EU-US Data Privacy Framework and its UK and Swiss extensions.
11.3 If an adequacy decision on which this section relies ceases to apply, the Standard Contractual Clauses (module 2, controller to processor) are incorporated into this DPA between the Customer as data exporter and RabbitSync as data importer, with the details of Annexes 1 to 3, the law of Ireland as governing law and the courts of Ireland as the forum for those clauses.
12. US state privacy laws
Where Customer Personal Data is subject to the California Consumer Privacy Act or a similar US state law, RabbitSync is a service provider (or processor) and will not: sell or share it; retain, use or disclose it for any purpose other than providing the Service under the Terms, or outside the direct business relationship with the Customer; or combine it with personal information it receives from other sources, except as those laws permit. RabbitSync will tell the Customer if it can no longer meet these obligations.
13. Liability and precedence
Each party's liability under this DPA is subject to the limitations of liability in the Terms, except where Data Protection Law does not allow it. If this DPA conflicts with the Terms, this DPA prevails with regard to the processing of Customer Personal Data. This DPA lasts for as long as RabbitSync processes Customer Personal Data.
Annex 1: Details of the processing
| Subject matter | Synchronizing data between applications the Customer connects to the Service. |
|---|---|
| Duration | For the term of the Terms, then until deletion under section 9. |
| Nature of processing | Reading records from the Customer's Connected Apps; comparing them across apps in memory; writing the resulting creates, updates and deletes; computing one-way fingerprints of record content and storing them with record identifiers to detect changes; recording the history of each run. Record content is not stored in RabbitSync's databases. During the first run of a sync or a full resync, it is held in the workflow engine's history, encrypted at rest, and deleted within 3 days after the run ends. |
| Purpose | Providing the Service under the Terms. |
| Categories of data subjects | Determined by the Customer: any individuals whose personal data is in the records it syncs, for example its employees, customers, prospects, suppliers or contacts. |
| Categories of personal data | Determined by the Customer: whatever fields its synced records contain, for example names, email addresses, phone numbers, company details or free text. |
| Special categories | None are needed for the Service. The Customer must not sync special categories of personal data, or data about criminal convictions, unless it has a lawful basis and has assessed that the Service's measures are appropriate for it. |
| Frequency | Continuous, on the schedules the Customer configures. |
| Retention | As set out in section 9 and the Privacy Policy's retention table. |
Annex 2: Technical and organizational measures
- Encryption. TLS for data in transit; encryption at rest for all databases and backups; separate envelope encryption, with keys managed outside the database, for access tokens to Connected Apps.
- Data minimization. The Service is designed to pass record content through rather than store it, and the code reviews of the Service check every new feature against that rule. AI features receive only the names and types of databases, sheets and fields.
- Tenant isolation. Each customer's data is isolated in the database by row-level security, enforced for the application's own database role.
- Access control. Least-privilege access for services and staff; production access only for those who operate the Service, with multi-factor authentication; no shared credentials.
- Network security. Databases and internal services are not reachable from the internet; public traffic passes through Cloudflare with managed firewall rules, bot protection and rate limiting.
- Authentication. User sign-in through Clerk; RabbitSync does not store passwords.
- Logging and monitoring. Security-relevant events are logged without record content, retained for 90 days, and monitored with alerts.
- Resilience. Automated backups with point-in-time recovery, and tested restores.
- Secure development. Code review for every change, dependency and container scanning, and secrets held in a secrets manager, never in code.
- Incident response. A documented process for detecting, containing, investigating and notifying Personal Data Breaches (section 7).
Annex 3: Sub-processors
The current list, with each sub-processor's purpose, the data it processes and its location, is at rabbitsync.io/company/sub-processors.