Data Processing Agreement

Last updated: 18 September 2026

Incorporated into the RYNR Terms & Conditions. Parties: the Customer (controller) and KKKonsulting, SHAMS, Sharjah, UAE (processor).

1. Subject matter, duration: Processing of Customer Personal Data (contacts, leads, communications the Customer stores in RYNR) for the duration of the subscription, solely to provide the Services.

2. Instructions: RYNR processes only on documented instructions of the Customer (the Services configuration constitutes the instruction), unless required by law.

3. Confidentiality: Persons authorised to process are bound to confidentiality.

4. Security: RYNR implements the technical and organisational measures in Annex 2 (encryption in transit, access control, logging, backups, vendor management).

5. Subprocessors: General authorisation for the subprocessors in Annex 3 (published at rynr.io/subprocessors). RYNR gives 30 days' notice of changes; the Customer may object on reasonable data protection grounds, in which case either party may terminate the affected Service.

6. International transfers: Transfers outside the EU/EEA rely on the EU-U.S. Data Privacy Framework and/or the EU Standard Contractual Clauses (Module 2 controller-to-processor and Module 3 processor-to-processor), which are incorporated by reference; the Annexes of this DPA complete the SCC annexes.

7. Assistance: RYNR assists the Customer with data subject requests, security-breach notification (without undue delay after becoming aware), DPIAs and consultations, considering the nature of processing.

8. Deletion and return: Upon termination, Customer Personal Data is exported on request and deleted within 60 days, save statutory retention.

9. Audit: RYNR provides information necessary to demonstrate compliance; audits via documentation and, where insufficient, on-site with 30 days' notice, at Customer's cost, max once per year.

Annex 1: Description of processing (categories of data subjects, data categories, purposes).

Annex 2: Technical and organisational measures.

Annex 3: Subprocessor list: platform infrastructure provider (USA, hosting/processing, DPF+SCC), Stripe (payments), Twilio (SMS/voice), Mailgun (e-mail), Meta Platforms/WhatsApp (messaging), OpenAI (AI processing). The current list is published at rynr.io/subprocessors.

A countersigned copy of this DPA is available on request via [email protected].

Privacy Policy · Terms & Conditions · Subprocessors · Legal Notice