Ravn Data Processing Agreement

Version 2026-11-04 · Last updated 4 November 2026

This Data Processing Agreement ("DPA") is part of the Ravn Terms of Service (the "Terms") between Rook Industries, Inc. ("Rook") and the customer ("Customer"). It applies automatically to every account; no signature is needed. A countersigned copy is available on request from privacy@askravn.com. Capitalized terms not defined here have the meaning given in the Terms.

1. Roles and scope

1.1 For Customer Data, Customer is the controller (or "business"), and Rook is the processor (or "service provider" or "contractor"). This DPA applies to the personal data contained in Customer Data ("Customer Personal Data").

1.2 Applicable data protection law includes:

• the California Consumer Privacy Act as amended (CCPA) and its regulations;
• other U.S. state privacy laws;
• the EU General Data Protection Regulation (GDPR);
• the UK GDPR and the UK Data Protection Act 2018;
• Canada's PIPEDA; together, "Data Protection Law".

1.3 The details of processing (subject matter, duration, nature, purpose, types of data, data subjects) are in Annex 1.

2. Rook's commitments

2.1 Instructions. Rook processes Customer Personal Data only:

• on Customer's documented instructions, which are the Terms, this DPA and Customer's use and configuration of the Service; and
• for the limited and specified business purpose of providing, securing and supporting the Service for Customer.

If Rook believes an instruction violates Data Protection Law, Rook will tell Customer.

2.2 CCPA service-provider terms. Rook will not:

• (a) sell or share Customer Personal Data;
• (b) retain, use or disclose it for any purpose other than the business purposes in this DPA, including any commercial purpose, or outside the direct business relationship with Customer;
• (c) combine it with personal information Rook receives from or for anyone else, or collects from its own interactions with consumers, except as the CCPA regulations allow;
• (d) use it to build or improve profiles for another business.

Rook will:

• comply with the CCPA;
• give Customer Personal Data the level of privacy protection the CCPA requires;
• tell Customer if it can no longer meet its CCPA obligations.

Customer may take reasonable and appropriate steps to stop and remedy unauthorized use, and to ensure Rook uses Customer Personal Data consistently with Customer's CCPA obligations. Rook certifies that it understands and will comply with these restrictions.

2.3 Aggregated data. Rook may create aggregated or de-identified data that can't reasonably identify any person or Customer, and use it to run and improve the Service. Rook will:

• take reasonable measures to make sure it stays de-identified;
• publicly commit not to re-identify it; and
• not attempt to re-identify it.

2.4 Confidentiality. Rook makes sure that anyone authorized to process Customer Personal Data is bound by confidentiality obligations.

2.5 Security. Rook keeps in place the technical and organizational measures in Annex 2.

2.6 Opt-outs. Customer instructs Rook to apply Opt-Outs as described in the Terms (Section 3.5), including removing matching entries from data saved in Customer's account.

3. Subprocessors

3.1 Customer gives Rook general authorization to use the subprocessors listed in Annex 3, which is also published at askravn.com/subprocessors.

3.2 Rook will:

• bind each subprocessor to data-protection obligations at least as protective as this DPA;
• stay responsible for each subprocessor's performance.

3.3 Rook will update the list at least 15 days before adding or replacing a subprocessor. Customer may object on reasonable data-protection grounds within that period. If the parties can't resolve the objection, Customer may close its account. In that case Rook will refund any prepaid fees for the period after closure.

3.4 Providers that Customer connects with its own key (for example, People Data Labs or Twilio) are Customer's vendors, not Rook's subprocessors. Customer's own agreement with them governs.

4. Assistance

4.1 Requests from individuals. Taking into account the nature of the processing, Rook will help Customer respond to individuals' requests to exercise their rights, through the Service's features (export and deletion) or otherwise on reasonable request. If Rook receives such a request about Customer Personal Data, Rook will pass it to Customer where Rook can identify Customer, and won't respond itself, except to apply an Opt-Out.

4.2 Assessments and regulators. Rook will give reasonable help with data-protection impact assessments and regulator consultations, to the extent the information is available to Rook.

5. Security incidents

Rook will notify Customer without undue delay, and in any case within 72 hours after becoming aware, of a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data. Rook will provide the information Customer reasonably needs to meet its own notification obligations, and will take reasonable steps to contain the breach and limit its effects. A notification isn't an admission of fault.

6. Deletion

Within 30 days after Customer's account closes, Rook will delete Customer Personal Data, unless the law requires Rook to keep it. Before closing, Customer may export its data through the Service. Backups are overwritten on their normal cycle and are never restored for any other purpose.

7. Audits

Rook will make available the information reasonably needed to demonstrate compliance with this DPA. That means written answers to a reasonable security questionnaire once a year, plus any audit report Rook has. If that isn't enough to meet a legal requirement, Customer may carry out an audit on 30 days' notice, no more than once a year, during business hours, at Customer's cost, by an independent auditor bound by confidentiality, and without access to other customers' data.

8. International transfers

Rook processes data in the United States.

• EU/EEA transfers: the parties incorporate the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module 2 (controller to processor), with:
• Clause 7 (docking) included;
• Clause 9 option 2 (general authorization, with the notice period in Section 3.3);
• Clause 11 optional language omitted;
• Clauses 17 and 18: the law and courts of Ireland;
• Annexes I–III completed by Annexes 1–3 of this DPA.
• UK transfers: the UK International Data Transfer Addendum to those clauses (version B1.0) applies. Table 1 is completed by this DPA, and either party may end it as Section 19 of the Addendum allows.
• Swiss transfers: the clauses apply with the FDPIC as the competent authority, and references to the GDPR are read to include the Swiss Federal Act on Data Protection.

9. Liability and precedence

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms, except where Data Protection Law or the Standard Contractual Clauses don't allow that. If this DPA conflicts with the Terms on the processing of personal data, this DPA wins. If it conflicts with the Standard Contractual Clauses, the Clauses win.

10. Customer's commitments

Customer confirms that:

• it has, and will keep, a lawful basis for all Customer Personal Data and for its instructions;
• it has given all required notices and obtained all required consents;
• its connected-provider agreements allow its use of the Service.

Annex 1: Details of processing

• Subject matter and duration: providing the Service under the Terms, for as long as the account is open, plus up to 30 days for deletion.
• Nature and purpose:
• checking email addresses and phone numbers;
• finding likely business email addresses;
• reading websites Customer names;
• running Customer's searches on Customer's connected providers;
• keeping Customer's lookup history in Customer's account, when history is turned on;
• security, support and billing.
• Types of personal data:
• names, job titles and employers;
• business and personal email addresses and phone numbers;
• professional profile URLs;
• work location;
• other information Customer submits or its connected providers return.

No special-category data is intended. Customer must not submit any.

• Data subjects: Customer's prospects, customers, contacts and other business contacts; Customer's own users.
• Retention: as set out in the Privacy Policy. Lookup history is kept for a fixed period of 12 months and Customer can delete it at any time; the email-check cache for up to 30 days.

Annex 2: Security measures

• TLS encryption in transit. Provider keys are encrypted at rest with AES-256-GCM. API keys, tokens and sign-in codes are stored only as hashes.
• Strict separation between accounts: every query is scoped to the account that asked.
• Personal identifiers in caches and opt-out lists are stored as keyed or one-way fingerprints. Logs are redacted of emails, phones and secrets.
• Servers operated by Rook in the United States, with no public inbound ports; access is through an authenticated tunnel. Administrative access is restricted to named personnel with key-based authentication.
• Encrypted backups, with restore tests.
• Strict input validation; outbound website reads blocked from reaching private networks; rate limits; automated tests and code review before every deployment.
• Dependency and vulnerability monitoring; a vulnerability-reporting address (security@askravn.com).
• An incident response procedure as in Section 5.

Annex 3: Subprocessors

Rook hosts the Service on servers it operates itself in the United States. No other subprocessor processes Customer Personal Data.