Data Processing Agreement (v2026-10-03)

1. Subject matter and duration

Rakolto processes that data to provide the service you subscribed to. The processing lasts for as long as your account exists and ends when you delete it (see section 9).

2. Nature and purpose of processing

Document collection and borrower reminders: storing the names and contact details you enter, sending document requests and reminders to your borrowers by email on your behalf, and recording which items have been received.

3. Categories of data and data subjects

4. Our obligations as processor

• Instructions. We process the data only on your documented instructions (the Terms, this DPA and your use of the service) and tell you if an instruction appears to infringe the law.
• Confidentiality. Everyone with access to the data is bound by confidentiality.
• Security. We apply the measures described on our Security page.
• Sub-processors. You authorise the sub-processors on our sub-processors page. We give at least 30 days' notice before adding or replacing one, and you may object during that period. We bind each sub-processor to data-protection terms no less protective than these, and remain responsible for them.
• Assisting you. We help you respond to requests from your borrowers to exercise their rights, and with your own security, breach-notification and impact-assessment duties, taking into account the nature of the processing.
• Breach notice. We notify you without undue delay after becoming aware of a personal-data breach affecting your data.
• Audits. We make available the information needed to show compliance, by answering a reasonable security questionnaire. Contact privacy@rakolto.com.

5. International transfers

Our database and application servers run in the European Union (Frankfurt). Where a sub-processor processes data outside the EU, or the law of the data subject's country requires it, the transfer relies on the EU Standard Contractual Clauses and, where required, any licence or permit from the competent authority (for example the Egyptian Personal Data Protection Center).

6. Financial-services customers (GLBA Safeguards Rule)

If you are a financial institution subject to the US Gramm-Leach-Bliley Act Safeguards Rule (16 CFR 314), we act as your service provider: we maintain safeguards appropriate to the data, as described on our Security page, we will answer your reasonable oversight requests, and we will notify you of a security event affecting your customer information without undue delay.

7. California (CCPA/CPRA) service-provider terms

For personal information subject to the CCPA, we are your service provider. We do not sell or share that information, we do not retain, use or disclose it outside the direct business relationship with you or for any purpose other than the business purposes in the Terms and this DPA, and we do not combine it with other data except as the law permits. We will tell you if we can no longer meet these obligations.

8. Your responsibilities

You are responsible for having a lawful basis, and any notices or consents required where you and your borrowers are, to collect the data and to have us contact your borrowers. You will enter only data you are entitled to use for this purpose.

9. Return and deletion

You can export your loan and document data from Reports at any time. When you delete your account we delete your workspace data immediately from our active systems; encrypted backups roll off as described in our Privacy Policy. Documents already saved in your own drive are never deleted by us.