Data Processing Addendum (DPA)

Last updated: October 11, 2026 (v2.1)

This Data Processing Addendum (“DPA”) forms part of the Terms of Servicebetween RaKaPrime consulting group s.r.o. (“Raka AI”, “Processor”) and the business that uses Raka AI, including merchants who install the Raka AI app on Shopify (“Customer”, “Controller”). It applies whenever Raka AI processes personal data on the Customer’s behalf and is accepted together with the Terms when the Customer signs up or installs the app. It implements Article 28 of the EU General Data Protection Regulation (GDPR).

1. Subject matter and duration

Raka AI processes personal data only to provide the Service: publishing content, answering customers in Raka Chat, the voice agent, bookings, and the Shopify integration. Processing lasts for as long as the Customer uses the Service and ends with deletion as described in section 8.

2. Data subjects and categories of data

• Data subjects: the Customer’s own customers and prospective customers, people who message or call the Customer, visitors of the Customer’s store, and the Customer’s staff users.
• Categories of data: name, email address, phone number, messages and call transcripts, booking details, and — for Shopify merchants — order status, fulfilment and tracking information read from Shopify at the time of a request.
• No special categories of data (Article 9 GDPR) are intentionally processed; the Customer should not ask the Service to collect them.

3. Processor obligations

• Process personal data only on the Customer’s documented instructions, including these Terms and the settings the Customer chooses in the Service.
• Use the data only for the purposes above — never sell it, never use it for our own marketing and never use it to train AI models.
• Ensure that everyone authorised to process the data is bound by confidentiality.
• Apply the security measures in section 4.
• Assist the Customer with data subject requests (access, correction, erasure, portability, objection) and with data protection impact assessments where needed.
• Make available the information needed to demonstrate compliance and allow reasonable audits, on 30 days’ written notice and at most once a year unless required by a supervisory authority.

4. Security measures

• Encryption in transit (TLS) for all traffic and encryption at rest (AES-256) for the database, file storage and backups.
• Row-level security: each Customer can access only its own records; server functions use least-privilege credentials kept in a secret store.
• Staff access to production data only for named, authorised persons with individual accounts, strong passwords and multi-factor authentication; access is logged.
• Separate test environments (development stores, simulated calls) that do not use production customer data.
• Continuous encrypted backups with point-in-time recovery, kept for 7 days by the hosting provider and then overwritten.
• Data minimisation: Shopify order and customer data is read at the moment it is needed and not stored; voice-call transcripts are deleted after 90 days by default.

5. Personal data breaches

Raka AI notifies the Customer without undue delay, and in any case within 48 hours after becoming aware of a personal data breach affecting the Customer’s data, with the information the Customer needs to meet its own obligations (Articles 33–34 GDPR): what happened, the data and people affected, likely consequences and the measures taken. Notices are sent to the Customer’s account email.

6. Sub-processors

The Customer gives general authorisation to use the following sub-processors. Each is bound by a data processing agreement with protection equivalent to this DPA. We will announce new sub-processors on this page at least 14 days in advance; the Customer may object on reasonable grounds and, if we cannot resolve the objection, terminate the affected service.

• Supabase Inc. — database, authentication, file storage, server functions (EU region, on AWS)
• Vercel Inc. — website hosting and edge network (EU/US)
• Google LLC — AI generation (Gemini), cloud video processing, YouTube API, sign-in (EU/US)
• OpenAI, L.L.C. — AI replies in Raka Chat and the voice agent (US)
• Anthropic PBC — AI assistance (US)
• ElevenLabs Inc. — voice processing for voice features: speech synthesis and speech recognition (US/EU)
• Soniox Inc. and Deepgram Inc. — speech recognition for calls (US)
• LiveKit Inc. — real-time call media (US/EU)
• Hetzner Online GmbH — voice-agent servers (Germany)
• Twilio Inc. and Telnyx LLC — phone numbers, calls and SMS (US/EU)
• BulkGate (TOPefekt s.r.o.) — SMS in the Czech Republic and Slovakia (EU)
• Resend Inc. — transactional email (US)
• Stripe Payments Europe Ltd. — payment processing (EU)
• Meta Platforms Ireland Ltd. — Facebook, Instagram and WhatsApp messaging and publishing (EU)
• Shopify International Ltd. — store integration and app billing (EU)
• Fal.ai and BytePlus — AI image and video rendering (US/Singapore); no customer contact data is sent to them

7. International transfers

Where personal data is transferred outside the EU/EEA, the transfer relies on an adequacy decision (including the EU–US Data Privacy Framework where the recipient is certified) or on the EU Standard Contractual Clauses.

8. Deletion and return

• The Customer can delete individual records (conversations, bookings, contacts) at any time in the Service.
• When the Customer deletes its account, all its data is deleted; access tokens are deleted immediately when a platform is disconnected.
• For Shopify merchants, customer and shop data-erasure requests sent by Shopify are carried out automatically (see the Privacy Policy, section 4e).
• Backups are overwritten within the provider’s rolling backup period. Before deletion the Customer may request an export of its data by writing to support@rakaai.com.

9. Contact

Privacy and data protection questions: support@rakaai.com. This DPA is governed by the law that governs the Terms of Service.