Roles and lawful basis
For customer documents processed in the platform, the customer is the controller and RAIVA is the processor under Art. 28 GDPR. A data processing agreement is part of every contract. For our own website, contact forms and recruiting, we act as controller on the basis of legitimate interest (Art. 6(1)(f)) or consent (Art. 6(1)(a)).
Data processing agreement (DPA) available before pilot start
Documented purpose limitation per workspace
No training of foundation models on customer content
Hosting and data location
Application, database, vector index and object storage run in EU data centres. Support access is role-based, time-boxed and logged. Backups remain in the EU.
EU-only processing regions
Encryption in transit (TLS 1.2+) and at rest (AES-256)
Access logs retained for audit purposes
Data subject rights
Requests for access, rectification, erasure, restriction, portability and objection are supported. If a request reaches us for data we process on a customer's behalf, we forward it to the controller without undue delay and assist with fulfilment.
Response target: within 30 days
Export of documents and audit trails on request
Deletion pipeline covers indices, embeddings and backups
Subprocessors and transfers
We keep a current subprocessor list in the Trust Center, including purpose and processing region. Where a transfer outside the EEA cannot be avoided, we rely on EU Standard Contractual Clauses plus supplementary technical measures.
Subprocessor changes announced before they take effect
SCCs and transfer impact assessment on file
Right to object to new subprocessors
Retention and incident handling
Retention periods follow the customer's configuration; defaults delete processing artefacts when a workspace is closed. Security incidents affecting personal data are reported to the controller without undue delay and, where required, within 72 hours.
Configurable retention per workspace
Documented incident response process
Post-incident report with root cause
Data protection contact
RAIVA Technologies GmbH, An der Dammheide 10, 60486 Frankfurt am Main, Germany. Write to privacy@raiva.io for DPAs, subprocessor lists or data subject requests.