Legal
Data Processing Agreement
How RuleRun processes personal data on your behalf when you use the product.
Last updated: September 15, 2026
This DPA supplements the Terms of Service and applies whenever RuleRun processes personal data on the Customer’s behalf in the course of providing the Service.
1. Scope and definitions
This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Yurii, a private entrepreneur (PE), Vinnytsia, 21027, Ukraine (“RuleRun”, “Processor”) and the Customer (“Controller”), and applies where RuleRun processes personal data contained in Customer Content on the Customer’s behalf.
Terms such as “controller”, “processor”, “personal data”, “processing”, “data subject”, and “personal data breach” have the meanings given in the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”).
2. Roles of the parties
For personal data contained in Customer Content, the Customer is the controller and RuleRun is the processor. Each party will comply with its obligations under applicable data protection law.
The Customer is responsible for the accuracy and legality of Customer Content and for having a lawful basis for the processing it instructs.
3. Processing on documented instructions
RuleRun will process personal data only on the Customer’s documented instructions, which are given by the Terms of Service, this DPA, the configuration of the Service by the Customer, and the Customer’s use of the Service, unless required otherwise by law (in which case RuleRun will inform the Customer where legally permitted).
RuleRun will not sell personal data and will not use Customer Content to train AI models.
4. Confidentiality
RuleRun ensures that persons authorised to process the personal data are bound by an appropriate obligation of confidentiality.
5. Security
RuleRun implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as described in Annex 2.
6. Sub-processors
The Customer gives general authorisation for RuleRun to engage sub-processors, listed in Annex 3. RuleRun imposes data-protection obligations on each sub-processor no less protective than those in this DPA and remains responsible for their performance.
RuleRun will give at least 30 days’ notice of the addition or replacement of a sub-processor. The Customer may object on reasonable data-protection grounds; if the parties cannot resolve the objection, the Customer may terminate the affected part of the Service.
7. Data subject requests
Taking into account the nature of the processing, RuleRun will assist the Customer by appropriate technical and organisational measures, insofar as possible, to respond to requests from data subjects exercising their rights. If RuleRun receives such a request directly, it will forward it to the Customer and not respond except on the Customer’s instructions or as required by law.
8. Personal data breach
RuleRun will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer personal data, and will provide information reasonably available to help the Customer meet its own notification obligations, including under Article 33 GDPR.
9. Assistance with DPIAs and consultation
Taking into account the nature of processing and information available to it, RuleRun will provide reasonable assistance to the Customer with data protection impact assessments and prior consultations with supervisory authorities.
10. International transfers
Where RuleRun or a sub-processor processes personal data outside the European Economic Area, the transfer is made subject to appropriate safeguards. The parties agree that the European Commission’s Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (controller to processor), are incorporated into this DPA by reference and completed by the information in Annexes 1–3, with the Customer as data exporter and RuleRun as data importer.
For transfers subject to the UK GDPR, the UK International Data Transfer Addendum to the SCCs applies on the same basis.
11. Return or deletion of data
On termination or expiry of the Service, and at the Customer’s choice, RuleRun will delete or return the personal data and delete existing copies, unless retention is required by law. Reports and evidence are otherwise deleted at the end of the applicable retention period.
12. Audit and demonstration of compliance
RuleRun will make available to the Customer information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, conducted by the Customer or an auditor it mandates, subject to reasonable notice, confidentiality, and frequency limits, and where available by providing relevant third-party reports.
13. Liability and precedence
Each party’s liability under this DPA is subject to the limitations and exclusions of liability in the Terms of Service. In the event of a conflict, this DPA prevails over the Terms of Service with respect to the processing of personal data, and the Standard Contractual Clauses prevail over this DPA with respect to transfers they govern.
14. Contact
For DPA requests, including a signed copy, contact Yurii, a private entrepreneur (PE) at support@rulerun.io.
Annex 1. Details of the processing
This Annex describes the processing carried out by RuleRun (processor) on behalf of the Customer (controller).
| Item | Details |
|---|---|
| Subject matter | Provision of the RuleRun email-compliance checking service. |
| Duration | For the term of the Agreement, plus the applicable report-retention period. |
| Nature and purpose | Rendering emails, running automated compliance checks against Customer-configured policies, generating and storing Reports, retaining submitted content so Reports can be reproduced or re-processed during the retention period, and providing support. |
| Categories of data subjects | Individuals whose personal data appears in Customer Content (e.g., the Customer’s marketing recipients) and the Customer’s authorised users. |
| Categories of personal data | Contact details and any personal data contained in the email content submitted (e.g., names, email addresses, personalised message content), and account/user data such as user email addresses. |
| Special category data | Not intended or required. The Customer must not submit special-category data unless separately agreed in writing. |
| Frequency | Continuous, for the duration of the Customer’s use of the Service. |
Annex 2. Technical and organisational security measures
RuleRun maintains at least the following measures, reviewed and updated as appropriate:
- Encryption of personal data in transit (TLS) and at rest.
- Tenant isolation enforced at the database layer via row-level security, so each customer can access only their own data.
- Access controls: scoped, rotatable, revocable API keys; authentication via industry-standard tokens; least-privilege access for personnel.
- Network and application security, including bot protection on public forms and separation of privileged and application database roles.
- Logging and monitoring of service activity, with alerting for errors and anomalies.
- Confidentiality obligations binding on personnel with access to personal data.
- Backups and the ability to restore availability of data in a timely manner after an incident.
- A documented process for evaluating and improving the effectiveness of these measures.
Need a signed DPA?
Enterprise and regulated customers can request a countersigned Data Processing Agreement — get in touch.