Data Processing Agreement (DPA)

Effective Date: September 23, 2026.

Last Updated: October 12, 2026.

This Data Processing Agreement, hereinafter the “DPA,” forms part of the RobyContracts Terms of Service and governs the Processing of Personal Data that José Córdova, an individual with Ecuadorian Taxpayer Identification Number (RUC) 1707017693001, operating commercially under the RobyContracts brand, hereinafter “RobyContracts,” “Processor,” or “we,” performs on behalf of the individual, organization, or company that uses the Services and determines the purposes and means of the Processing of Personal Data incorporated into such Services, hereinafter the “Customer” or “Controller.”

This DPA applies only when the Customer acts as Controller and RobyContracts Processes Personal Data on behalf of the Customer as Processor.

The person accepting this DPA on behalf of an organization represents that they have sufficient authority to bind that organization.

Users subsequently invited to an Organization do not individually enter into a new DPA merely by accessing the Account. Where the Customer is an Organization, the DPA applies to the relationship between RobyContracts and that Organization.

Electronic acceptance of the DPA may be recorded together with the document version, its archived content or reference, hash, language, Organization where applicable, date and time of acceptance, and other evidence reasonably necessary to demonstrate acceptance.

Where RobyContracts independently determines the purposes and means of certain Processing activities, for example in connection with Account administration, security, fraud prevention, billing, legal compliance, dispute management, maintenance of contractual evidence, or administration of its own commercial relationship with the Customer, RobyContracts will act as Controller with respect to such Processing, which will be governed by the Privacy Policy and applicable law.

1. Definitions

For purposes of this DPA:

“Personal Data” means any information that identifies or makes it possible to identify, directly or indirectly, an individual, in accordance with applicable law.

“Customer Personal Data” means Personal Data contained in contracts, templates, files, documents, images, forms, private links, structured fields, information provided by landlords, tenants, guarantors, representatives, or other third parties, signed files, text, or other content that the Customer or its Authorized Users provide to RobyContracts and that RobyContracts Processes on behalf of the Customer.

“Customer Content” means documents, contracts, templates, files, text, images, structured data, derived results, generated files, and other information provided or generated in order to provide the Services to the Customer. Customer Content may contain Personal Data.

“Processing” means any operation performed on Personal Data, including receipt, storage, automated reading, extraction, structuring, classification, document generation, consultation, transmission to authorized Subprocessors, restoration of content from Archive or Trash, and deletion.

“Data Protection Laws” means the Organic Law on Personal Data Protection of Ecuador, its implementing regulations and applicable rules issued by the Superintendencia de Protección de Datos Personales, and, where applicable due to the Customer, Data Subjects, or Processing, other mandatory data protection laws, including the GDPR or UK GDPR.

Other terms relating to data protection will have the meaning established by the applicable Data Protection Laws.

2. Roles of the Parties

With respect to Customer Personal Data Processed to provide the Services:

• The Customer acts as Controller.

• RobyContracts acts as Processor.

• The Customer determines which contracts, templates, documents, data, and information it provides to RobyContracts, the purposes for which it uses the Services, and who is authorized to use them.

• RobyContracts Processes Customer Personal Data only to provide, maintain, protect, and correct the Services (corrective maintenance and verification of the contracted service) in accordance with the Customer’s documented instructions and this DPA, without using those data as material for development, analysis, or training.

• Where an Organization has multiple users, the Customer Organization remains the Controller with respect to Personal Data incorporated into the Organization’s workspace, regardless of which Authorized User actually performs a particular operation.

RobyContracts does not acquire ownership of Customer Personal Data merely by Processing it.

This DPA is the written contract between Controller and Processor required by data protection law. Its subject matter is the Processing described in Section 3; its nature and purpose are to provide the Services to the Customer; its duration is stated in Section 17 and in the retention and deletion cycle of Section 10; and the types of Personal Data and Data Subjects are those the Customer incorporates into the Services under Section 3 (for example, contract parties, contact persons, and their representatives).

3. Customer Instructions

The Customer instructs RobyContracts to Process Customer Personal Data to the extent necessary to:

• Receive and store contracts, DOCX templates, PDF documents, images, attachments, and other files provided by the Customer.

• Read, extract, structure, classify, and organize information contained in such documents.

• Identify and organize contractual fields, including, where applicable, names, identifiers, contact information, contractual parties, dates, amounts, guarantees, rent values, property information, tax information, and other information relevant to the contract.

• Use information extracted or directly provided by the Customer to prepare, renew, complete, or generate contracts and related documents.

• Create and retain DOCX, PDF, or other documents generated through the Services.

• Allow the Customer to review, correct, complete, and manage contractual information.

• Generate private links or other mechanisms that allow persons authorized by the Customer, such as landlords, tenants, guarantors, or representatives, to complete information necessary for a contract.

• Receive and store information provided through such private links.

• Receive and store final or signed copies of contracts uploaded back to the Service by the Customer.

• Perform calculations, transformations, structural validations, and automated operations necessary for the functionalities offered by RobyContracts, including calculations related to official information or indices where such functionality is available.

• Process information through authorized artificial intelligence providers where necessary for extraction, understanding, structuring, or generation of contractual content.

• Generate metadata, document history, and derived results necessary to provide the Services.

• Provide search, visualization, download, export, Archive, restoration, and deletion features.

• Perform integrity, security, and Service availability checks.

• Provide support requested by the Customer.

• Delete information in accordance with the Customer’s instructions, this DPA, and the lifecycle applicable to the Services.

RobyContracts will not use Customer Personal Data for purposes other than those stated in this DPA and the Terms of Service.

RobyContracts does not use Customer contracts, templates, files, or other Customer Content to train or fine-tune its own models.

Artificial intelligence requests containing Customer information are configured in accordance with the privacy architecture used by RobyContracts and the collection and retention restrictions applicable to the selected providers.

4. Customer Obligations

The Customer represents and warrants that:

• It has a valid legal basis to collect, use, and provide to RobyContracts the Personal Data it incorporates into the Services.

• It has provided Data Subjects with the notices and other information required by applicable law.

• Its instructions to RobyContracts are lawful.

• It has the right to permit Processing by RobyContracts and authorized Subprocessors under this DPA.

• It is responsible for determining whether Personal Data incorporated into the Service, including sensitive data or special categories of data, may lawfully be Processed through RobyContracts.

• It is responsible for determining which users may access the Organization and its contracts.

• It is responsible for instructions provided through the Services, including generation, modification, archiving, restoration, or deletion of Customer Content.

• It will not instruct RobyContracts to carry out Processing that violates Data Protection Laws.

RobyContracts will inform the Customer if it reasonably believes that an instruction violates applicable Data Protection Laws, unless a law prevents it from doing so.

5. RobyContracts Obligations

RobyContracts will:

• Process Customer Personal Data only in accordance with the Customer’s documented instructions, this DPA, and applicable Data Protection Laws.

• Not Process Customer Personal Data for purposes other than those stated in this DPA and the Terms of Service.

• Not disclose, assign, or transfer Customer Personal Data to other persons, not even for retention, except (i) to authorized Subprocessors under Section 8 and only to the extent necessary to provide the Services, (ii) on the Customer’s instruction, or (iii) where a competent authority requires it, in which case it will inform the Customer unless the law prevents it.

• Ensure that persons authorized to Process Personal Data are subject to appropriate confidentiality obligations.

• Apply technical and organizational measures appropriate to the risk.

• Limit human access to Customer Personal Data to authorized or necessary situations in accordance with Customer instructions, Service security, or an applicable legal obligation.

• Use Subprocessors only in accordance with this DPA.

• Reasonably assist the Customer, taking into account the nature of the Processing and the information available, in responding to requests relating to Data Subject rights, and cooperate with the Customer within two (2) days of the Customer’s request.

• Reasonably assist the Customer with obligations relating to security, security incidents, impact assessments, and regulatory consultations where applicable.

• Notify the Customer as soon as possible and at the latest within two (2) days from when it has knowledge of a Personal Data Breach affecting Personal Data Processed on behalf of the Customer.

• Maintain information reasonably necessary to demonstrate compliance with its obligations as Processor, including a record of the Processing activities it carries out on behalf of the Customer.

• Delete Customer Personal Data in accordance with Section 10 when the Processing ends, unless an applicable legal obligation requires retention.

6. Security

RobyContracts applies technical and organizational measures appropriate to the risk, including:

• Encryption of data in transit through HTTPS/TLS.

• Encryption at rest provided by its infrastructure providers.

• Password storage through hashing mechanisms managed by its authentication provider.

• Authentication and authorization controls.

• Security and access-control policies applied at the database level.

• Mandatory multi-factor authentication in accordance with Service rules.

• Logical separation between Accounts and Organizations.

• Restrictions on privileged access.

• Operational and error logging.

• Periodic automated checks intended to verify isolation between Accounts.

• Operational checks of Service availability.

RobyContracts’ ordinary support and administration tools are not designed to display the contents of Customer contracts or documents.

However, persons with privileged infrastructure access could technically access stored information where necessary. RobyContracts does not use such access to read Customer contracts or documents as part of the ordinary human operation of the Service.

Where the Customer requests in writing a technical intervention requiring access to Content, such access may be performed only for the authorized purpose and for the time reasonably necessary.

Where a separate agreement with the Customer expressly authorizes additional human access for implementation, testing, support, or diagnosis, such access may be performed in accordance with that authorization.

RobyContracts may modify its technical and organizational measures to adapt to technological, operational, or regulatory changes, provided that it does not materially reduce the overall level of protection of Customer Personal Data.

7. Artificial Intelligence

Certain RobyContracts functions require automated Processing through artificial intelligence providers.

Depending on the function used, the following may be sent to authorized providers:

• Documents or portions of documents.

• Images where necessary to interpret document content.

• Text excerpts or blocks.

• Text necessary for structured extraction.

• Contractual field information.

• Instructions related to contract generation or renewal.

• User queries or instructions.

• Other excerpts strictly necessary to perform the requested operation.

RobyContracts configures requests containing Customer Content to apply collection and retention restrictions compatible with the privacy architecture implemented for such requests.

RobyContracts does not sell Customer Personal Data and does not use the content of Customer contracts, documents, or templates to train its own models.

8. Subprocessors

The Customer grants RobyContracts a general authorization to use Subprocessors where reasonably necessary to provide the Services.

RobyContracts will disclose Customer Personal Data to a Subprocessor only to the extent necessary for that Subprocessor to perform the function entrusted to it. The Subprocessors listed in Section 8.1 when this DPA is accepted are authorized in writing by the Customer.

RobyContracts contracts Subprocessors that offer privacy, confidentiality, and security obligations under their terms of service, and will remain responsible for its own obligations under this DPA to the extent required by applicable law.

RobyContracts may replace or add Subprocessors. Where a change is material with respect to the Processing of Customer Personal Data, RobyContracts will notify the Customer by email, in-Service notice, or another reasonable means.

The Customer may raise a reasoned objection specifically related to Personal Data protection. The parties will attempt to resolve it in good faith. If it is not reasonably possible to resolve the objection, the Customer may stop using the affected portion of the Services or terminate the Services in accordance with the Terms of Service.

8.1. Current Subprocessors

See the functions and locations of current subprocessors.

Processing locations depend on the infrastructure of each provider and may include the United States and other jurisdictions where those providers or their Subprocessors lawfully operate.

8.2. Providers That Do Not Necessarily Act as Subprocessors of Content

RobyContracts uses Polar Software, Inc. as Merchant of Record for certain commercial transactions.

Polar Processes billing, payment, tax, fraud, refund, dispute, and transaction information under its own terms and legal obligations.

Polar does not receive the content of Customer contracts, templates, or documents in order to provide RobyContracts’ document-related functions and is therefore not included in the list above as a Subprocessor of document content under this DPA.

Payment-related Processing is described additionally in the Privacy Policy and Terms of Service.

9. International Transfers

The Customer acknowledges that provision of the Services may involve Processing of Personal Data in the United States and other jurisdictions where RobyContracts or its authorized Subprocessors operate.

Where an international transfer of Personal Data is subject to specific requirements under applicable Data Protection Laws, RobyContracts will use the legal mechanisms required by such laws.

For transfers to the United States, RobyContracts relies on the data processing agreements of Supabase, OpenRouter, and Resend, which form part of their terms of service and incorporate the European Commission’s standard contractual clauses. For other providers, their own terms and privacy policies apply.

For Processing subject to Ecuadorian law, RobyContracts will perform international transfers or communications in accordance with the LOPDP, its implementing regulations, and the rules in force issued by the Superintendencia de Protección de Datos Personales.

Where the GDPR or UK GDPR applies, the parties will use, where legally required, adequacy decisions, standard contractual clauses, addenda, or other mechanisms recognized under applicable law.

Nothing in this Section should be interpreted as stating that a specific mechanism applies to every transfer or every Customer regardless of jurisdiction.

10. Retention, Deletion, and Data Lifecycle

10.1. Active Content

While a contract, template, or document remains active and the Customer maintains a valid storage entitlement under the Service, RobyContracts will retain the Personal Data and other information reasonably necessary to provide the applicable functions.

RobyContracts may retain the original files provided by the Customer, including DOCX templates and original contracts, while the corresponding Content remains within its applicable lifecycle.

Generated DOCX or PDF files, final signed documents uploaded by the Customer, extracted fields, structured information, data provided through private links, metadata, and document history necessary to provide the Services may also be retained.

The Customer is responsible for retaining outside RobyContracts any copies it needs to keep permanently for commercial, legal, regulatory, accounting, or archival reasons.

RobyContracts should not be considered the sole permanent repository for the Customer’s legal documents.

10.2. Post-Subscription Period

When a paid Subscription is voluntarily terminated, the Post-Subscription Period begins when the already-paid period ends.

During the following six calendar months, the Customer may continue accessing Customer Content subject to that period and use the functions that remain available under the Terms of Service.

Where applicable, previously accumulated and still-valid Contract Uses may continue to be used during that period.

The existence of this period does not prevent specific Content from having an earlier deletion date because it was archived, moved to Trash, permanently deleted, or made subject to another valid instruction.

Upon reaching the exact deletion date and time applicable to the Post-Subscription Period, Customer Personal Data and other Customer Content subject to that period cease to be available and enter the permanent deletion process.

There is no additional retention period merely because an operation was initiated before the deadline.

10.3. Failed Renewal and Payment Recovery

When a renewal charge fails, new Contract Uses associated with that renewal are not granted while payment remains outstanding.

During the first seven days after the failed charge, RobyContracts may maintain normal access in accordance with the Terms of Service.

If payment remains outstanding at the end of that period, RobyContracts may begin the six-month Post-Subscription Period even if Polar temporarily continues its own payment-recovery process.

If payment for that renewal is subsequently completed successfully during Polar’s recovery process, the Subscription status and retention of Customer Content may return to the lifecycle applicable to an active Subscription under the Terms of Service.

10.4. Individual Purchases and Retention Extensions

A valid individual purchase of a Contract Use may establish or extend the retention period of active and non-archived Customer Content until at least six calendar months from the date of that purchase, in accordance with the Terms of Service.

A new purchase will not shorten a later retention date that already applies.

A later purchase does not automatically extend the retention period of contracts that were already archived.

10.5. Archive

The Customer may place certain contracts in an Archive area.

Archiving a contract begins a maximum retention period of six calendar months from the date and time at which the contract was archived.

During that period, the archived contract may remain visible and downloadable in accordance with the features offered by RobyContracts.

The Customer may restore it before deletion.

When an archived contract is restored, the Archive-specific deletion date ceases to apply and the contract becomes subject to the retention period applicable to Active Content.

Restoration does not, by itself, grant six new months of retention.

An earlier deletion date applicable to the Account, Organization, or Post-Subscription Period will take precedence over a later date calculated for Archive.

10.6. Trash

When the Customer individually deletes a contract, template, or other Content eligible for recovery, that Content may enter Trash for a maximum period of 30 days.

During that period, available features may allow Restore or Delete permanently now.

A restored item will, where technically possible, return to the state it had before entering Trash.

If it came from Archive, it will return to Archive and continue to be subject to the applicable retention lifecycle.

The Trash period does not pause or extend an earlier deletion date arising from Archive, the Post-Subscription Period, Account closure, or another deletion instruction.

The earliest applicable deletion date controls.

10.7. Permanent Deletion of Individual Content

When the Customer selects a function equivalent to Delete permanently now, the corresponding Content is no longer subject to the ordinary Trash recovery period and enters the permanent deletion process.

Once final deletion has been completed, the Content ceases to be available through ordinary RobyContracts functions.

RobyContracts does not create or maintain separate backups of Customer documents. Once final deletion has been completed, it cannot restore the Content from a RobyContracts backup.

Certain infrastructure providers may retain residual copies for technical, regulatory, or recovery periods controlled by those providers. Such copies remain subject to applicable security, confidentiality, and deletion obligations.

10.8. Account or Organization Closure

Permanent closure of an Account or Organization is different from cancellation of a Subscription.

When a duly authorized person confirms closure, the Customer instructs RobyContracts to begin permanent deletion of the corresponding Customer Content.

Closure may immediately terminate retention periods that would otherwise have continued under the Post-Subscription Period, Archive, or Trash.

Invited users lose access to the Organization’s Content when the corresponding Organization is closed.

An invited user’s independent personal Account may continue to exist if it is not part of the closure.

10.9. End of Processing

Upon final termination of the Processing of Personal Data on behalf of the Customer, the Customer instructs RobyContracts to delete such Personal Data, unless:

• An applicable legal obligation requires its retention.

• Before termination, the parties expressly agree in writing to a different instruction permitted by applicable law.

RobyContracts will destroy all copies of Customer Personal Data existing under its control, except those that a legal obligation requires it to retain, and will carry out deletion within the period required by applicable Data Protection Laws and will retain reasonable evidence of its execution where appropriate.

Before reaching a final deletion date, the Customer is responsible for downloading through available features any information it wishes to retain.

Where applicable Data Protection Law mandatorily grants the Customer the right to choose between return and deletion, RobyContracts will comply with that obligation to the extent and in the manner required by such law.

10.10. Records Separate from Customer Content

Deletion of Customer Content does not necessarily require simultaneous deletion of all records for which RobyContracts acts as an independent Controller.

RobyContracts may retain minimum records relating to contractual acceptance, billing, transactions, refunds, disputes, security, fraud prevention, deletion instructions, legal compliance, and defense of claims for the periods described in its Privacy Policy or required by applicable law.

Such records do not authorize RobyContracts to retain indefinitely the full content of contracts, templates, signed files, or other Personal Data Processed on behalf of the Customer after the applicable retention lifecycle has ended.

11. Data Subject Requests

Taking into account the nature of the Processing, RobyContracts will provide reasonable assistance to the Customer in responding to requests relating to the exercise of Data Subject rights where the relevant Personal Data is Processed by RobyContracts on behalf of the Customer, and will do so within two (2) days of the Customer’s request.

If RobyContracts receives directly from a Data Subject a request clearly relating to Personal Data controlled by the Customer, RobyContracts may direct the Data Subject to the Customer or forward the request to the Customer, unless applicable law requires another action.

The Customer remains responsible for determining whether the request should be honored and for providing the corresponding instructions.

12. Incidents and Personal Data Breaches

RobyContracts will maintain reasonable procedures to identify, investigate, and respond to incidents that may affect the confidentiality, integrity, or availability of Customer Personal Data.

Where RobyContracts has knowledge of a Personal Data Breach affecting information Processed on behalf of the Customer, it will notify the Customer as soon as possible and at the latest within two (2) days from when it has knowledge of the breach.

To the extent information is available, RobyContracts will seek to provide details reasonably necessary for the Customer to evaluate and comply with its own notification obligations.

Notification of an incident does not, by itself, constitute an admission of liability by RobyContracts.

13. Audits and Evidence of Compliance

RobyContracts will make available to the Customer information reasonably necessary to demonstrate compliance with its obligations as Processor.

The Customer may, at any time, review RobyContracts’ records and Processing procedures relating to its Personal Data, itself or through an auditor, including an auditor accredited by the data protection authority, subject to the conditions of this Section.

Audit requests must:

• Be reasonably related to the Processing carried out by RobyContracts.

• Be made with reasonable advance notice, except in the case of serious incidents or legal obligations.

• Respect confidentiality, security, and the rights of other Customers.

• Avoid disproportionate interference with the operation of the Services.

Where available documentary information is sufficient to demonstrate compliance, RobyContracts may use such information as the first method of responding to the request.

On-site or technically intrusive audits will be limited to cases where they are reasonably necessary or required by a competent authority.

The Customer will bear the reasonable costs of extraordinary audits requested exclusively by the Customer, unless the audit reveals a material breach by RobyContracts or the law provides otherwise.

Nothing in this Section limits audits, inspections, or requests of the data protection authority or of an auditor accredited by it: RobyContracts will allow and cooperate with them without requiring advance notice or conditions that prevent them, and their cost will not be passed on to the Customer.

14. Confidentiality and Human Access

RobyContracts does not access the contents of Customer contracts and documents as part of the ordinary human operation of the Service.

RobyContracts’ automated systems necessarily Process such Content to provide the contracted functions.

Technically privileged human access will be limited to authorized persons and may be used where necessary to:

• Comply with express Customer instructions.

• Investigate security incidents.

• Resolve technical problems that cannot reasonably be addressed in another way.

• Perform implementation, testing, support, or diagnosis where valid Customer authorization exists.

• Comply with a valid legal obligation.

Where a separate agreement with a Customer expressly authorizes additional human access for testing, implementation, support, or diagnosis, that agreement will prevail with respect to that specific authorization.

Exceptionally, when a failure reported by a Customer cannot be diagnosed without the affected document, the person responsible for RobyContracts may enter the minimum necessary fragment into Claude Code, the programming assistance tool from Anthropic with which the platform is developed. For this purpose an account with training disabled is used; Anthropic retains that content for up to thirty (30) days, the local record is deleted within the same period, and the use is not routine. This tool is listed in the subprocessor directory.

15. Sensitive Data or Special Categories

RobyContracts does not require the Customer to provide special or sensitive categories of Personal Data in order to use the ordinary functions of the Service.

However, contracts or documents provided by the Customer may contain information that, depending on its content and applicable law, is sensitive or subject to special requirements.

If the Customer chooses to provide information of this nature, the Customer is responsible for determining in advance that it has a valid legal basis and that Processing through RobyContracts is appropriate and lawful.

RobyContracts will apply the general security measures described in this DPA, and unilateral uploading of particularly sensitive information by the Customer does not constitute acceptance of additional obligations that have not been expressly agreed.

16. Liability

The liability of the parties arising from this DPA is subject to the limitation-of-liability framework established in the RobyContracts Terms of Service.

For paid Services, the general contractual liability cap agreed in the Terms will be calculated by reference to amounts actually paid or payable by the Customer for the Services during the twelve months immediately preceding the event giving rise to the claim, including non-refunded amounts relating to Subscriptions, individual purchases, or other Services, and excluding taxes and refunded amounts.

Where the Services have been provided entirely free of charge, including a free trial or free feature, the general contractual liability cap will be USD 10, unless the Terms of Service validly establish another applicable rule.

Nothing in this DPA limits liability to the extent such liability cannot legally be limited or excluded.

Nothing in this Section limits rights granted directly to Data Subjects by Data Protection Laws or the powers of data protection authorities.

17. Term

This DPA enters into force when validly accepted by the Customer or by a person authorized to act on its behalf and remains in effect while RobyContracts Processes Personal Data on behalf of the Customer.

Obligations that by their nature are intended to survive termination, including confidentiality, deletion, protection of Personal Data, and liability, will remain in effect for the applicable period.

18. Relationship with Other Documents

This DPA forms part of the RobyContracts Terms of Service.

In the event of a conflict between this DPA and the Terms of Service regarding the Processing of Personal Data on behalf of the Customer, this DPA will prevail to the extent of the conflict.

The Privacy Policy governs Processing for which RobyContracts acts as Controller and provides additional information about the Service’s general privacy practices.

Where RobyContracts and a Customer have entered into a separate signed agreement establishing specific terms for that Customer, that agreement will prevail only with respect to the specific provisions it expressly modifies.

19. Governing Law and Jurisdiction

This DPA is governed by the laws of the Republic of Ecuador.

Unless mandatory law provides otherwise, the parties submit to the competent courts of the Metropolitan District of Quito, Province of Pichincha, Ecuador.

Nothing in this clause limits the application of mandatory data protection rules applicable to the Customer, Data Subjects, or the Processing.

20. Contact

For inquiries relating to this DPA, data protection, privacy, security, or legal matters relating to the Service:

José Córdova.

RUC: 1707017693001.

Operating commercially under the brand: RobyContracts.

Email: support@askroby.io.

Address: Quito, Pichincha, Ecuador.

Telephone: +593 99 061 2230.

RobyContracts has not currently appointed a Data Protection Officer. Questions relating to data protection may be directed to the email address indicated above.

Annex A — Details of Processing

A.1. Subject Matter

Provision of the RobyContracts Services, including receipt, storage, reading, extraction, structuring, organization, generation, modification, administration, visualization, download, archiving, recovery, and deletion of contracts, templates, and other Content provided or generated by the Customer, including, where applicable, Processing assisted by artificial intelligence.

A.2. Nature of the Processing

Processing may include:

• Receipt and storage of contracts, templates, and other files.

• Reading and conversion of documents into formats usable by the Service.

• Image Processing where necessary.

• Automated extraction of text and structured information.

• Identification and organization of contractual fields.

• Automated classification and structuring.

• Generation and renewal of contracts.

• Generation of DOCX, PDF, or other available document formats.

• Storage and recovery of documents and data.

• Generation of private links for collection of information authorized by the Customer.

• Receipt of information provided by third parties through such links.

• Receipt and storage of final or signed contracts uploaded by the Customer.

• Processing through artificial intelligence models.

• Generation of metadata and document history.

• Automated calculations and transformations necessary for contracted functionalities.

• Archiving and restoration.

• Deletion.

A.3. Purpose

To allow the Customer to prepare, renew, generate, complete, administer, store, review, download, and temporarily retain contracts and related documents, collect necessary information from parties or authorized third parties, Process contractual information through automated functions, and use the other features available in RobyContracts.

A.4. Duration

For the period during which the Customer uses the Services and thereafter during the retention periods applicable to each category of Customer Content under Section 10 of this DPA.

Depending on the state of the Content, these periods may include retention while Content remains active, up to six calendar months during the Post-Subscription Period, up to six calendar months from the archiving of a contract, or up to 30 days in Trash, always subject to any earlier applicable deletion deadline.

After the applicable deletion date, Processing will continue only for the period technically necessary to execute deletion and comply with applicable legal obligations.

A.5. Categories of Personal Data

Personal Data depends on the Content the Customer chooses to provide and may include:

• First and last names.

• National identification numbers, passport numbers, or other identifiers.

• Contact information.

• Addresses.

• Contractual information.

• Rental information.

• Property information.

• Landlord, tenant, and guarantor information.

• Information relating to representatives or attorneys-in-fact.

• Dates relevant to contractual relationships.

• Financial and commercial information.

• Rent amounts, deposits, guarantees, or other contractual amounts.

• Financial information contained in documents.

• Tax identifiers.

• Employment or professional information.

• Signatures contained in documents.

• Information contained in signed contracts.

• Information included in photographs, scanned documents, or digital files.

• Information provided through private links or forms associated with contracts.

• Metadata relating to documents and their Processing.

• Any other category of Personal Data incorporated by the Customer.

The Customer controls the Content it provides to RobyContracts.

A.6. Categories of Data Subjects

These may include:

• Customer Authorized Users.

• Owners or landlords.

• Tenants.

• Guarantors.

• Legal representatives.

• Attorneys-in-fact.

• Employees.

• Workers.

• Contractors.

• Customers.

• Suppliers.

• Property administrators or managers.

• Property owners.

• Partners or shareholders.

• Persons mentioned in contracts, annexes, communications, or documents.

• Other third parties whose Personal Data appears in Content provided by the Customer.

A.7. Frequency

Processing takes place continuously or in accordance with the Customer’s instructions and use of the Service.

Certain operations are performed only when the Customer initiates a specific action, such as uploading a contract, generating a document, providing a private link, archiving, restoring, deleting, or requesting another available feature.

A.8. Deletion Instruction

Unless a different written instruction has been validly agreed or an applicable legal obligation requires otherwise, the Customer instructs RobyContracts to delete Personal Data Processed on its behalf when the corresponding Processing lifecycle ends in accordance with Section 10 of this DPA.

Deletion may occur, as applicable, as a result of:

• A permanent-deletion instruction issued by the Customer.

• Expiration of the 30-day Trash period.

• Expiration of the up-to-six-month period applicable to an archived contract.

• Expiration of the Post-Subscription Period.

• Permanent closure of the Account or Organization.

• Any other deletion instruction or cause validly established in the Terms of Service and this DPA.

Where multiple deletion dates apply, the earliest valid date will prevail, unless a new payment relationship or restoration expressly produces a permitted extension under the Terms of Service before final deletion has been executed.