Data Processing Addendum
Effective: September 22, 2026 · Version 2.4
This document was written by our engineering team for structural reference and is not the authoritative legal text. It is not binding until reviewed and approved by our legal counsel. For a signed copy of the current version or to negotiate terms, please contact dpa@cpaas.io.
1. Roles
Customer is the Controller. Raftar API is the Processor for Customer Content Data. Both parties act as independent Controllers for account-level metadata.
2. Instructions
We process Customer Content Data only per your documented instructions (using the platform, its APIs, and your configuration).
3. Confidentiality
All personnel with access to Customer Content are bound by written confidentiality obligations and complete annual security training.
4. Sub-processors
Current list at cpaas.io/subprocessors. We give 30-day notice of new sub-processors and honour reasonable objections.
5. International transfers
Standard Contractual Clauses (2021 EU-approved) apply for transfers outside the EEA. UK IDTA for UK data. Data residency options in schedule A.
6. Data-subject requests
We provide APIs to help you honour access, rectification, erasure, restriction, and portability requests. Custom flows on Enterprise.
7. Security measures
See our security documentation and Annex II.
8. Personal-data breach
We will notify you without undue delay (and no later than 72 hours) after becoming aware of a breach affecting your Customer Content.
9. Return / deletion
Upon termination, we return or delete Customer Content per your Data Retention Policy or provide a 30-day export window.