Annex to the Rilvo Coworker Service Terms and Conditions
Last updated: 13 October 2026
1. Parties and scope
1.1. This Data Processing Agreement (the “Agreement”) is entered into between:
- the Customer that has subscribed to the Rilvo Coworker Service, as controller (the “Controller”); and
- S.C. Asperitas Solutions S.A., a company incorporated under Romanian law with its registered office at Aleea Cioplea nr. 14, parter, cam. 1, Brașov, Romania, Trade Register No. J8/985/2017, CUI/VAT No. RO37465749, privacy contact: privacy@rilvo.net, as processor (“Rilvo” or the “Processor”).
1.2. The Agreement is an annex to the Rilvo Coworker Service Terms and Conditions (the “Terms”) and forms an integral part of the Contract. Capitalised terms not defined herein have the meaning given to them in the Terms; the terms “personal data”, “processing”, “data subject”, “personal data breach” and similar terms have the meaning given to them in Regulation (EU) 2016/679 (“GDPR”).
1.3. The Agreement applies to the personal data that Rilvo processes on behalf of the Customer in providing the Service. It does not apply to data that Rilvo processes as controller (for example, data relating to the Customer’s contact persons, invoicing and payments), which is governed by Rilvo’s Privacy Policy.
1.4. With respect to personal data protection matters, in the event of conflict the Agreement prevails over the Terms.
2. Subject matter, duration, nature and purpose of the processing
2.1. Subject matter. The processing of personal data necessary to provide the Rilvo Coworker Service, as described in the Terms and in Annex A.
2.2. Nature and purpose. Operating the “digital colleague” on behalf of the Customer: reading and drafting messages, preparing drafts and quotes, follow-ups, triaging incoming requests, reminders and deadlines, and organising documents, within the Customer’s tools and via Telegram, Slack, Discord and the other tools that the Customer connects to the Service. The operations include collection, consultation, organisation, structuring, storage, processing (including by means of artificial intelligence systems), disclosure on the Customer’s instructions, and erasure.
2.3. Duration. The Agreement has the same duration as the Contract. After termination, it remains in force until the data has been returned or erased as provided for in Article 11 (within the period set out in Article 17.2 of the Terms).
2.4. The categories of data subjects and of personal data are set out in Annex A.
3. Controller’s instructions
3.1. Rilvo processes personal data only on documented instructions from the Customer, including with regard to transfers to third countries, unless required to do so by Union or Member State law to which Rilvo is subject; in such a case, Rilvo informs the Customer before the processing, unless that law prohibits it.
3.2. The following constitute documented instructions: the Terms, this Agreement, the configurations and approval rules agreed at activation, and the Customer’s subsequent requests sent in writing (including via the Service’s channels).
3.3. Rilvo informs the Customer without delay if it considers that an instruction infringes the GDPR or other data protection provisions, and may suspend its execution until it is confirmed or amended.
4. Controller’s obligations
4.1. The Customer warrants that it has a valid legal basis for the processing entrusted to Rilvo, that it has provided data subjects with the necessary information, and that it makes available to the Service only the data that is necessary.
4.2. The Customer shall not provide the Service with special categories of data (Art. 9 GDPR) or with data relating to criminal convictions and offences (Art. 10 GDPR), unless a separate prior written agreement with Rilvo defining appropriate measures is in place.
4.3. The Customer grants the Service only the access and permissions on its own tools that are necessary, and remains responsible for reviewing and approving the actions proposed by the Service, as provided for in the Terms.
5. Confidentiality of personnel
Rilvo ensures that the persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, have received appropriate instructions, and access the data only to the extent necessary to provide the Service or support.
6. Security of processing
6.1. Rilvo implements the appropriate technical and organisational measures required by Art. 32 GDPR, described in Annex B, taking into account the state of the art, the costs of implementation, the nature of the processing and the risks to data subjects.
6.2. Rilvo may update the measures over time, provided that the overall level of security is not reduced.
7. Sub-processors
7.1. The Customer grants Rilvo a general written authorisation to engage the sub-processors listed in Annex C and other sub-processors in accordance with this Article.
7.2. Rilvo informs the Customer by email of any addition or replacement of sub-processors at least 15 days in advance. The Customer may object on reasonable grounds relating to data protection within that period. If the Parties cannot find a solution, the Customer may terminate the Contract free of charge before the change takes effect; this is the sole remedy available in the event of an objection.
7.3. Rilvo imposes on sub-processors, by way of a written contract, data protection obligations substantially equivalent to those set out in this Agreement and remains liable to the Customer for their performance.
7.4. The channels and tools that the Customer connects to the Service (for example Telegram, Slack, Discord, or the Customer’s mailbox or management software) are providers chosen by the Customer, with which the Customer has its own relationship: they are not Rilvo’s sub-processors, unless Rilvo itself contracts with them to provide the Service.
7.5. The same applies, in the “Rilvo Coworker with your own AI account” plan provided for in the Terms, to the artificial intelligence model provider with which the Customer has a direct contract (for example, OpenAI or Anthropic). In that plan, Rilvo sends requests to the models through the Customer’s account and API key, on the Customer’s instructions; the provider processes the data under the contract between the Customer and the provider and is not a sub-processor of Rilvo. The Customer is responsible for that provider’s terms, including the data processing agreement, the safeguards for any transfers outside the EEA and the data-use settings, and for the related costs.
8. Transfers outside the European Economic Area
8.1. Rilvo transfers personal data to countries outside the EEA only where a safeguard provided for in Chapter V GDPR is in place, in particular: an adequacy decision (including the EU-U.S. Data Privacy Framework for certified recipients) or standard contractual clauses adopted by the European Commission (Art. 46 GDPR), together with any supplementary measures.
8.2. The envisaged transfers are set out in Annex C. Transfers made by the AI provider chosen by the Customer in the “Rilvo Coworker with your own AI account” plan are governed by the contract between the Customer and that provider (Article 7.5).
8.3. Only at the Customer’s request, Rilvo may configure the Service to use exclusively artificial intelligence models processed in the European Union, under a direct contract with a European provider (for example Mistral AI, France). In that case, the OpenAI and Anthropic models listed in Annex C are not used. This option may entail differences in functionality or price, agreed before activation.
9. Assistance to the Controller
9.1. Taking into account the nature of the processing, Rilvo assists the Customer by appropriate technical and organisational measures in responding to requests from data subjects exercising their rights under Arts. 15-22 GDPR. If Rilvo receives a request directly, it forwards it to the Customer without delay and does not respond on the merits without instructions.
9.2. Rilvo assists the Customer, taking into account the information available to it, in complying with the obligations under Arts. 32-36 GDPR (security, notification and communication of breaches, data protection impact assessment and prior consultation).
9.3. The assistance provided for in this Article is provided at no additional cost within reasonable limits. Burdensome or repeated assistance may be charged separately, on terms agreed in advance, unless it is required due to a breach by Rilvo.
10. Personal data breaches
10.1. Rilvo notifies the Customer of any breach of personal data processed on its behalf without undue delay and in any event within 48 hours of becoming aware of it.
10.2. The notification contains, to the extent available: the nature of the breach, the categories and approximate number of data subjects and records concerned, the contact point at Rilvo, the likely consequences, and the measures taken or proposed. Information not immediately available is provided subsequently, without further undue delay.
10.3. Rilvo takes reasonable measures without delay to contain the breach and mitigate its effects, and cooperates with the Customer. The notification does not constitute an admission of liability.
11. Return and erasure of data
11.1. Upon termination of the Contract, Rilvo ceases processing the Customer’s data, except as necessary for its return or erasure.
11.2. At the Customer’s request submitted within 30 days of termination (Article 17.2 of the Terms), Rilvo returns the data in a commonly used and machine-readable format. After that period, Rilvo erases the Customer’s personal data, including copies, unless Union or Member State law requires its storage. Backup copies are erased in accordance with the normal rotation cycle, within 30 days.
11.3. Upon request, Rilvo confirms the erasure in writing.
12. Information and audits
12.1. Rilvo makes available to the Customer the information necessary to demonstrate compliance with Art. 28 GDPR, for example an up-to-date description of the security measures and the list of sub-processors.
12.2. The Customer, directly or through an independent auditor bound by confidentiality, may conduct audits, including inspections, upon reasonable written notice of at least 30 days, during business hours and without compromising the security or confidentiality of other customers’ data. Audits take place no more than once a year, except in the event of a personal data breach or a request from a supervisory authority, and the related costs are borne by the Customer.
12.3. Audits of sub-processors are, as a rule, based on the certifications and reports that they make available.
13. Prohibition on use of data for training
Rilvo does not use the Customer’s personal data, or the content processed on its behalf, to train or improve its own or third-party artificial intelligence models. Rilvo uses the OpenAI and Anthropic models directly via API, with its own API keys and business accounts, whose terms exclude the use of customer data for training (Annex C). Rilvo does not enable data-sharing options for training, does not send feedback to model providers, and does not use experimental or preview models whose terms provide for training on data. In the “Rilvo Coworker with your own AI account” plan, the provider’s use of the data is governed by the Customer’s contract and account settings (Article 7.5); in any case, Rilvo does not send feedback to the provider through the Customer’s account.
14. Liability
The Parties’ liability arising from this Agreement is governed by Article 18 of the Terms, without prejudice to Art. 82 GDPR vis-à-vis data subjects and to applicable mandatory rules.
15. Governing law and jurisdiction
The Agreement is governed by Romanian law. The competent courts of Brașov, Romania, have exclusive jurisdiction over any dispute, in accordance with Article 24 of the Terms.
Annex A – Data subjects and categories of data
Categories of data subjects:
- the Customer’s personnel (employees, collaborators, owners);
- the Customer’s customers and prospective customers;
- the Customer’s suppliers and partners;
- other contacts appearing in the Customer’s communications and documents.
Categories of personal data:
- contact and identification data (name, role, company, email, telephone, address);
- content of communications (emails, messages, notes);
- commercial data (requests, quotes, orders, terms, deadlines, appointments);
- documents and their contents made available by the Customer;
- technical data relating to the use of the Service (action logs, approvals, identifiers of connected accounts).
Special categories of data: not envisaged. The Customer shall not provide them unless a separate written agreement is in place (Article 4.2).
Annex B – Technical and organisational measures
- Infrastructure: the Service runs on a virtual private server (VPS) dedicated to each Customer, provided by Hetzner Online GmbH in data centres located in Germany (EU). Each Customer’s data resides on its own VPS, isolated from those of other customers.
- Network isolation and administrative access: each VPS is connected to a Tailscale private network, based on the WireGuard protocol and end-to-end encrypted; administrative access to the VPSs takes place exclusively through that private network (Tailscale VPN); SSH access is not exposed on the public interface.
- Least privilege: the Service uses only the access and permissions on the Customer’s tools that are necessary, as agreed at activation.
- Human approval: the Service can be configured to request the Customer’s approval before sensitive or irreversible actions (for example, sending to third parties, deletions); the Customer decides which actions.
- Access control: administrative access limited to Rilvo’s authorised personnel, with personal credentials, SSH key authentication and multi-factor authentication.
- Encryption: encryption of data in transit (TLS; for administrative access, the WireGuard/Tailscale network) and encryption of the VPS disk.
- Backups: daily backups, retained for 30 days.
- Logging: logs of actions performed by the Service and of administrative access, retained for 30 days and available to the Customer on request.
- Updates and vulnerabilities: regular updating of the operating system and software components; critical security patches are applied as soon as possible.
- Separation: each Customer has a dedicated VPS; data of different customers does not reside on the same machine.
- Organisation: instructions and confidentiality obligations for personnel; personal data breach management procedure.
Annex C – Authorised sub-processors
| Sub-processor | Service | Country / place of processing | Transfer safeguards |
|---|---|---|---|
| Hetzner Online GmbH | Hosting of the dedicated VPS on which the Service runs | Germany (EU) | Not required (processing within the EU) |
| OpenAI Ireland Ltd (with processing by OpenAI OpCo, LLC and other affiliates) | Artificial intelligence models, used directly via API, with Rilvo’s API keys, account and API contract | Ireland / United States | Standard contractual clauses under OpenAI’s DPA |
| Anthropic Ireland, Limited (with processing by Anthropic, PBC) | Artificial intelligence models, used directly via API, with Rilvo’s API keys, account and API contract | Ireland / United States | Standard contractual clauses (Modules 2 and 3) under Anthropic’s DPA |
| Mistral AI SAS | Artificial intelligence models, only if the Customer requests processing exclusively within the EU (Article 8.3), under a direct contract, activated only on request | France / EU (EU endpoint); Mistral AI’s sub-processors also process the data only within the EU | Not required: processing takes place only within the EU |
| Google Cloud EMEA Limited (Velasco, Clanwilliam Place, Dublin 2, Ireland), with processing also by Google LLC (Google Workspace) | Rilvo’s business email, used for communications with the Customer, which may contain personal data processed on the Customer’s behalf | EU and United States / other countries in which Google operates | EU-U.S. Data Privacy Framework (Google LLC certified) and standard contractual clauses under Google’s Cloud Data Processing Addendum |
“Rilvo Coworker with your own AI account” plan. In this plan, the OpenAI and Anthropic models are not used through Rilvo’s account: the Customer uses them through its own account and its own direct contract with the provider, which is the Customer’s provider and not a sub-processor of Rilvo (Article 7.5). The provider’s terms, including those on data use and transfers, and the related costs are the Customer’s responsibility. The other sub-processors listed above remain unchanged.
Use of data by artificial intelligence model providers (according to the terms published by the providers, checked on 8 October 2026):
- OpenAI (API): data sent to the API is not used to train models unless the customer explicitly opts in. Abuse monitoring logs, which may contain inputs and outputs, are retained for up to 30 days, unless retention is required by law or necessary to prevent harm.
- Anthropic (API): the commercial terms prohibit Anthropic from training models on customer content. Inputs and outputs are deleted within 30 days, unless retained longer to enforce the Usage Policy (up to 2 years for content flagged by automated safety systems) or to comply with legal obligations.
- Mistral AI (paid API): customer data is not used for training, unless the customer opts in, submits feedback or uses Labs/Preview models.
Last updated: 13 October 2026