# Ricochet Cloud Data Processing Agreement _Last updated: 8 November 2026_ This data processing agreement (“DPA”) forms part of the [terms and conditions](https://ricochet.rs/legal/terms) between RICOCHET, LLC (“Ricochet”, “we”, “us”) and each customer of Ricochet Cloud (“you”). It applies to personal data in the content you deploy to Ricochet Cloud, and to personal data of the people who use that content, that we process on your behalf (“Customer Personal Data”). Terms defined in the EU General Data Protection Regulation (GDPR) have the same meaning in this DPA. ## 1\. Roles You are the controller of Customer Personal Data, or a processor acting for your own customer, and we are your processor or subprocessor. Annex I describes the processing. You are responsible for having a lawful basis for it. ## 2\. Instructions We process Customer Personal Data only on your documented instructions, including with regard to transfers to a third country. The terms, this DPA, and your use of Ricochet Cloud constitute your complete instructions. We will inform you if we believe an instruction infringes data protection law. If law requires us to process Customer Personal Data without your instruction, we will inform you before processing, unless that law prohibits it. ## 3\. Confidentiality and security We give access to Customer Personal Data only to personnel who need it and who are bound to confidentiality. We implement the measures in Annex II and may update them, provided that the overall level of protection does not decrease. ## 4\. Subprocessors You give us general authorization to engage subprocessors. Our [subprocessors page](https://ricochet.rs/legal/subprocessors) lists our current subprocessors. We will notify your organization’s owners by email at least 14 days before we engage a new or replacement subprocessor. If you object on reasonable data protection grounds within that period and we cannot resolve your objection, you may terminate the affected service before the change takes effect. We bind each subprocessor to obligations equivalent to those in this DPA and remain liable to you for its performance. ## 5\. Assistance We will notify you without undue delay of any request we receive from a data subject concerning Customer Personal Data, and we will not respond to it unless you instruct us to. We will notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and we will provide the information you need to meet your own obligations. Taking into account the nature of the processing and the information available to us, we will assist you with data subject requests, security, breach notification, data protection impact assessments, and prior consultation. We may charge a reasonable fee for assistance that Ricochet Cloud does not already provide, unless our breach of this DPA made the assistance necessary. ## 6\. Return and deletion You may export your content at any time before your service ends. We delete Customer Personal Data from our live systems 14 days after cancellation, or 35 days after a payment becomes overdue and remains unpaid, and from our backups within a further 35 days, unless law requires us to retain it. ## 7\. Audits We will make available the information necessary to demonstrate compliance with Article 28 GDPR and allow for audits by you or by an independent auditor you appoint. You may audit no more than once a year, unless a supervisory authority or a personal data breach requires an audit, on at least 30 days’ notice and at your cost. We may satisfy an audit request with written answers and existing documentation where they are sufficient. ## 8\. International transfers To the extent that processing involves a transfer of personal data from the European Economic Area to a country without an adequacy decision, this DPA incorporates the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914 (“SCCs”), with you as data exporter and us as data importer, as follows: - Module 2 applies where you are a controller, and Module 3 applies where you are a processor. - Clause 7 and the optional wording in Clause 11(a) do not apply. - Under Clause 9(a), Option 2 applies, with the notice period in section 4. - Under Clauses 17 and 18, the law and courts of Ireland apply. - Annexes I and II of this DPA complete Annexes I and II of the SCCs. For transfers from the United Kingdom, the International Data Transfer Addendum issued by the UK Information Commissioner also applies. For transfers from Switzerland, references in the SCCs to the GDPR mean the Swiss Federal Act on Data Protection, the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority, and data subjects in Switzerland may bring claims in their place of habitual residence. If the SCCs conflict with this DPA or the terms, the SCCs prevail. ## 9\. General Each party’s liability under this DPA is subject to the limitations in the terms, except where the SCCs or applicable law do not permit a limitation. This DPA applies for as long as we process Customer Personal Data, and it prevails over the terms concerning that processing. ## Annex I: Description of the processing - **Data exporter:** the customer named in the Ricochet Cloud account, acting as controller or processor, through its organization’s owners. - **Data importer:** RICOCHET, LLC, 522 W Riverside Ave, Ste N, Spokane, WA 99201, United States, acting as processor, at [contact@ricochet.rs](mailto:contact@ricochet.rs). - **Data subjects:** people who use the content you deploy, members of your organization, and anyone whose personal data you include in your content. - **Personal data:** identifiers and profile data from your identity provider, technical data such as IP addresses and request details, and any personal data you include in your content, including any special categories of data. - **Nature and purpose:** hosting, storage, computation, backup, and deletion of your content to provide Ricochet Cloud. - **Frequency and duration:** continuous, for the term of your subscription, followed by deletion under section 6. - **Subprocessors:** those on our subprocessors page, for the same purpose and duration. - **Competent supervisory authority:** the authority determined under Clause 13 of the SCCs. ## Annex II: Technical and organizational measures - **Encryption:** We encrypt data in transit with TLS and encrypt backups with AES-256. - **Isolation:** We isolate each customer instance in its own namespace, network policy, and database, and run containers without root privileges. - **Access control:** We limit access to production systems to personnel who need it, through single sign-on on a private network. - **Availability and backups:** We run redundant infrastructure across three hosts, take daily backups, can restore databases to any point in the last 7 days, and delete backups within 35 days. - **Monitoring:** We monitor our infrastructure continuously and keep an audit log of administrative actions for 12 months. - **Change management:** We review production changes before deploying them and scan container images for known vulnerabilities. - **Personnel:** We bind all personnel with access to confidentiality. --- Source: https://ricochet.rs/legal/dpa