DATA PROCESSING ADDENDUM
GDPR processing terms for customer personal data handled by RYTHM.
Effective 14 August 2026. This Public Beta DPA is intended to apply where a customer acts as controller and Tayyebialashti Yaser E.V. / RYTHM Company OS acts as processor for personal data submitted to the service. A signed enterprise agreement or negotiated DPA controls where it expressly replaces these terms.
ROLES & INSTRUCTIONS
Customer determines the purpose; RYTHM processes on documented instructions.
- The customer is responsible for determining lawful purposes, legal bases, permitted users, and the categories of personal data submitted to RYTHM.
- RYTHM processes customer personal data only to provide, secure, support, and maintain the contracted service, to follow documented customer configuration and instructions, or where Union or Member State law requires otherwise.
- The Terms, applicable order, product configuration, support instructions, and this DPA together constitute documented processing instructions unless the parties agree otherwise in writing.
- RYTHM will inform the customer if, in its reasonable view, an instruction infringes applicable data-protection law, unless prohibited from doing so by law.
CONFIDENTIALITY & SECURITY
Access is limited to authorized processing.
- Persons authorized to process customer personal data must be subject to an appropriate duty of confidentiality.
- RYTHM applies technical and organizational measures appropriate to the current Public Beta risk profile, including authenticated access, tenant-aware authorization, database row-level security, protected server-side secrets, audit/event controls, and governed AI execution boundaries.
- Security controls are reviewed as the product, threat model, and customer use cases evolve.
- Customers remain responsible for account hygiene, user permissions, lawful data submission, and selecting an appropriate deployment for sensitive or regulated data.
SUBPROCESSORS
RYTHM may use vetted infrastructure providers.
- The current Public Beta subprocessor register is maintained at /subprocessors.
- RYTHM remains responsible for imposing data-protection obligations on subprocessors that are appropriate to the processing they perform on RYTHM's behalf.
- Where an executed order grants a customer advance-notice or objection rights for new subprocessors, those negotiated terms apply.
- Customer-authorized integrations outside the standard RYTHM stack may require a separate data-protection review.
INTERNATIONAL TRANSFERS
Restricted transfers require a lawful transfer mechanism.
- Where GDPR Chapter V applies to a transfer of customer personal data, RYTHM will rely on an applicable lawful mechanism made available by the relevant processing arrangement, such as an adequacy decision or Standard Contractual Clauses where appropriate.
- Deployment-specific transfer requirements should be reviewed before regulated or highly sensitive workflows are activated.
- RYTHM does not represent that all data remains exclusively within Hungary or the EEA unless an applicable written order expressly provides that commitment.
DATA-SUBJECT REQUESTS
RYTHM assists with applicable GDPR rights requests.
- Taking into account the nature of processing, RYTHM will provide reasonable assistance to enable the customer to respond to requests for access, correction, deletion, restriction, objection, or portability where the relevant data is processed by RYTHM.
- Requests directed to RYTHM can be submitted through Data Requests or by email to privacy@rythm-os.com.
- Identity, organization ownership, and scope may be verified before data is disclosed, exported, corrected, or deleted.
- RYTHM may preserve data where retention is required by applicable law or necessary to establish, exercise, or defend legal claims.
INCIDENTS
Personal-data incidents are escalated without undue delay.
- RYTHM will notify an affected customer without undue delay after becoming aware of a confirmed personal-data breach involving customer personal data processed by RYTHM, where notification is required to support the customer's GDPR obligations.
- Available information will include the nature of the incident, affected data or systems, likely consequences where known, containment/remediation actions, and a contact for follow-up.
- Notification does not constitute an admission of fault or liability.
- Customers remain responsible for controller-side regulatory and data-subject notifications applicable to their processing.
RETURN, DELETION & RETENTION
Customer data is not retained indefinitely by default.
- On valid customer instruction or termination, RYTHM will delete or return customer personal data where reasonably available, subject to legal retention duties, security evidence, backup lifecycle, and legitimate legal-claim requirements.
- Operational deletion and export requests are handled through the documented privacy-request workflow.
- Residual backup copies may remain until the applicable backup rotation expires and are not restored into active use except for legitimate recovery purposes.
- Retention periods are reviewed against the data category, service need, risk, and applicable legal obligations.
AUDIT & ASSISTANCE
RYTHM supports reasonable compliance verification.
- RYTHM will provide information reasonably necessary to demonstrate compliance with the processor obligations applicable to the contracted processing.
- Where proportionate, RYTHM may satisfy audit requests through current security documentation, architecture evidence, policies, logs, questionnaires, or third-party reports before agreeing to intrusive testing.
- On-site or custom audits require reasonable advance notice, confidentiality protections, scope controls, and must not compromise other customers, security, or service availability.
- RYTHM will provide reasonable assistance with DPIAs and supervisory-authority consultation when the processing performed by RYTHM makes such assistance relevant.
PROCESSING DETAILS
Annex A — current Public Beta processing description.
- Subject matter: governed AI company/workspace hosting, authentication, organization management, meetings, projects, agents, approvals, support, and enabled AI-assisted operations.
- Duration: for the customer relationship plus the limited retention and backup lifecycle applicable to the relevant data.
- Nature and purpose: storage, organization, retrieval, transmission, AI inference when invoked, security logging, support, and deletion/export operations needed to deliver the service.
- Data subjects: customer users, organization members, customer-authorized contacts, and other individuals whose data the customer lawfully submits.
- Personal-data categories: identity/contact data, account and membership data, workspace content, meeting/project/agent context, support records, technical/security metadata, and other customer-submitted data permitted by the service.
- Sensitive data: not approved by default for the Public Beta; customers must obtain an explicit deployment review before intentionally submitting special-category or similarly regulated data.
TOMS
Annex B — baseline technical and organizational measures.
- Authenticated account access and server-side session validation for protected routes.
- Tenant-aware authorization and database Row Level Security for production application records.
- Server-only handling of privileged service credentials and AI-provider credentials.
- Human-authority boundaries for consequential AI workflows and no default autonomous external action execution.
- Security/audit event infrastructure, operational incident records, and controlled production deployment through source control and CI.
- Ongoing hardening includes authentication abuse controls, API rate limiting, dependency scanning, security headers, backup/restore validation, and formal incident-response testing.
CONTRACTUAL PRIVACY
Need an executed or negotiated DPA?
For enterprise procurement, regulated processing, or customer-specific security terms, request a signed review before production activation.