DPA: data processing for RAGSuite

Do you need a DPA with us?

You get the signed DPA via privacy@ragsuite.de. The model text below shows the content; the signed version is binding.

Model text: data processing agreement under Art. 28 GDPR

between the customer (controller) and NITSAN GmbH, Bischofsweg 6, 01097 Dresden, Germany (processor).
§ 1 Subject and term. The processor supports the controller in operating and troubleshooting RAGSuite runs RAGSuite Engine for them where booked and, only if agreed, a dedicated instance. The agreement applies for as long as the processor processes personal data on the controller's behalf.
§ 2 Nature, purpose, data subjects. Nature: storage, indexing and processing by language models in the RAGSuite Engine; viewing, analysing and, where needed, storing as part of support or operation. Purpose: providing the RAGSuite Engine, troubleshooting and operation. Data: content from documents and histories, user accounts (name, email), log data. Data subjects: employees, customers and others whose data the controller processes in RAGSuite.
§ 3 Instructions. The processor processes data only on the controller's documented instructions (Art. 28(3)(a)) and informs the controller without delay if it considers an instruction unlawful.
§ 4 Confidentiality. People with access are bound to confidentiality (b).
§ 5 Security. The processor implements the Art. 32 measures in annex 1 (c).
§ 6 Sub-processors. Only with prior authorisation; authorised sub-processors are listed in annex 2. Planned changes are announced in advance and the controller may object. Sub-processors are bound by the same duties (d, para. 2 and 4).
§ 7 Assistance. The processor assists with data subject requests (e) and with Art. 32–36 duties, including notifying personal data breaches without undue delay (f).
§ 8 Deletion and return. At the end of the service the processor deletes or returns all data, at the controller's choice, unless law requires storage (g). Support access leaves no copies unless expressly agreed. In the RAGSuite Engine the controller can export its data before the contract ends; the processor then deletes it within [period to follow].
§ 9 Evidence and audits. The processor provides all information needed to demonstrate compliance and allows audits, including on-site inspections with reasonable notice (h).
§ 10 Third countries. Processing outside the EU/EEA only under Art. 44 et seq. GDPR, e.g. standard contractual clauses, and only with the controller's authorisation.
§ 11 Final provisions. German law applies. In case of conflict, this agreement prevails over other data protection arrangements.

Annex 1: Technical and organisational measures (summary)

Support access only on the customer's explicit approval, time-limited, preferably via accompanied screen sharing · personal accounts, two-factor sign-in, need-to-know rights · TLS in transit, encrypted storage media · RAGSuite Engine: data centre in Germany ([data centre to follow]), separation of customer data per instance, encryption in transit and at rest, backups [backup concept to follow], logging of administrative access, no training of language models on content · support access is logged · no copies of customer data from support cases unless agreed · staff trained in data protection and information security. The full TOMs are in the Trust Center.

Annex 2: Sub-processors

[list to follow]: self-hosted installations without support access have no RAGSuite sub-processors.

RAGSuite Engine: the data centre operator and the providers of the language models chosen in your projects, with seat, place of processing and purpose: [list to follow].