Snapshot 43570
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Rippit_DPA_Online_DRAFT.pdf
DownloadCtrl+D
DetailsD
PrintCtrl+P
Show
Comments
Zoom
FindCtrl+F
Send feedback to Google
Report abuse
Keyboard shortcutsCtrl+/
Page
/13
Approve
Reject
View Details
Request a review
Learn more
Signature pending
Sign
Reject
View details
Review
Not Spam
Remove forever
Not Spam
{"id": "1Y9Lei4IHVp8QPDRE6SqDOfHaM2yTvwdX", "title": "Rippit_DPA_Online_DRAFT.pdf", "mimeType": "application\/pdf"}
Page 1 of 13
MaestroQA INC. - DATA PROCESSING ADDENDUM (ONLINE)
Last Updated: August 26, 2026 · Version 1.0
This Data Processing Addendum ("DPA") forms part of the agreement between the entity or
person placing an order for, registering for, or accessing any Services ("Subscriber") and
MaestroQA Inc, d/b/a Rippit located at 33 W 17th Street, [Floor 10 / Suite 402], New York, NY 10011,
USA ("MaestroQA"). The agreement of which this DPA forms part is the Rippit Online Terms of
Service, or where Subscriber has entered into the MaestroQA Subscription Agreement together
with an Order Form, that agreement (in each case, the "Agreement"). Except where the context
requires otherwise, references in this DPA to the Agreement are to the Agreement as amended by,
and including, this DPA.
No signature is required. By accepting the Agreement, or by registering for or using the Services,
Subscriber enters into this DPA on behalf of itself and in the name and on behalf of its Controller
Affiliates (as defined below), and this DPA becomes legally binding and effective as of the effective
date of the Agreement. Wherever this DPA, the Standard Contractual Clauses, or the UK
Addendum refers to signature or execution by the parties, acceptance of the Agreement
constitutes that signature and execution by both parties. If Subscriber requires a countersigned
copy of this DPA for its records, Subscriber may request one at privacy@rippit.com.
All capitalized terms not otherwise defined in this DPA shall have the meanings given to them in the
Agreement.
1. DEFINITIONS
"Controller", "Data Subject", "Personal Data", "Personal Data Breach", "Processing", and
"Processor" shall have the meanings ascribed to them in Data Protection Law;
"Controller Affiliates" means any of the Subscriber's Affiliate(s) (a) permitted to use the Services
pursuant to the Agreement between Subscriber and MaestroQA, but who have not signed,
accepted or otherwise agreed to the Agreement and are not a "Subscriber" as defined under the
Agreement; and (b) if and to the extent MaestroQA Processes Personal Data for which such
Affiliate(s) qualify as the Controller;
"Data Protection Law" means a) to the extent the UK GDPR applies, the law of the United Kingdom
or of a part of the United Kingdom which relates to the protection of personal data including
without limitation (i) the UK GDPR, (ii) the Data Protection Act 2018 and (iii) any binding code of
practice or guidance issued by a regulator, authority or body responsible for administering
compliance with the Data Protection Laws (a "Data Protection Authority"), and/or b) to the extent
the EU GDPR applies, the law of the European Union or any member state of the European Union to
which MaestroQA or the Subscriber is subject, which relates to the protection of personal data
including without limitation (i) the General Data Protection Regulation (EU) 2016/679 ("EU GDPR")
and any amendment or replacement to it (including any national law or regulation which
implements it), and (ii) any binding code of practice or guidance issued by a Data Protection
Authority, and/or c) to the extent the Swiss Federal Act on Data Protection ("FADP") applies, the
FADP and any implementing ordinances, and/or d) to the extent they apply, US State Privacy Laws,
in each case as amended or replaced from time to time;
"GDPR" means, as applicable, (i) the EU GDPR and/or (ii) the UK GDPR;
Page 1 of 13
Page 2 of 13
"Standard Contractual Clauses" means (i) where the EU GDPR applies the European
Commission's Standard Contractual Clauses for the transfer of Personal Data from the European
Union to third countries, as set out in the Annex to Commission Decision (EU) 2021/914, available
at: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj, or such alternative clauses as may be
approved by the European Commission from time to time ("EU SCCs"); and/or (ii) where the UK
GDPR applies the International Data Transfer Addendum to the EU Commission Standard
Contractual Clauses issued by the UK Information Commissioner's Office and laid before
Parliament in accordance with section 119A of the Data Protection Act 2018 on 2 February 2022, as
revised by the Information Commissioner's Office from time to time (the "UK Addendum");
"Sub-processor" means any Processor engaged by MaestroQA to Process Personal Data in
connection with the Services;
"Supervisory Authority" means a) in the United Kingdom, the Information Commissioner's Office,
or any other independent regulatory authority responsible for administering compliance with the
Data Protection Laws in the United Kingdom, and b) in the European Union, an independent
regulatory authority which is established by an EU Member State pursuant to the EU GDPR;
"UK GDPR" has the meaning given to it in section 3(10) (as supplemented by section 205(4)) of the
UK Data Protection Act 2018; and
"US State Privacy Laws" means the US state laws governing the Processing of Personal Data that
apply to the Processing under the Agreement, including the California Consumer Privacy Act of
2018 as amended by the California Privacy Rights Act and its implementing regulations ("CCPA"),
and the comprehensive consumer privacy statutes of Virginia, Colorado, Connecticut, Utah, Texas,
Oregon, Montana, and any other state enacting a comparable law. Where US State Privacy Laws
apply, "Business", "Service Provider", "Third Party", "Consumer", "Sell", "Share", and "Personal
Information" have the meanings given in those laws.
2. PROCESSING OF PERSONAL DATA
2.1. Roles of the Parties. The parties acknowledge and agree that with regard to the Processing of
Personal Data under the Agreement, Subscriber is the Controller (and, where US State Privacy
Laws apply, the Business), MaestroQA is the Processor (and, where US State Privacy Laws apply,
the Service Provider or Processor as those laws define it), and that MaestroQA will engage
Sub-processors pursuant to the requirements set out in Section 3 "Sub-processing" below. Where
Subscriber is itself acting as a Processor on behalf of a third-party Controller, Subscriber
represents that it has that Controller's authorization to engage MaestroQA as a Sub-processor on
the terms of this DPA, and Section 10.1(b) applies.
2.2. Subscriber Processing of Personal Data. Subscriber shall, in its use of the Services and
provision of instructions, Process Personal Data in accordance with the requirements of applicable
Data Protection Law. Subscriber shall have sole responsibility for the accuracy, quality, and legality
of Personal Data and the means by which Subscriber acquired Personal Data. Subscriber is
responsible for establishing and maintaining a lawful basis for the Processing, and for providing all
notices to and obtaining all consents and authorizations from Data Subjects required by applicable
Data Protection Law in connection with the monitoring, recording, transcription, evaluation, and
analysis performed through the Services, including any notice, consent, or consultation required
under employee monitoring, call recording, wiretap, works council, or employment laws.
Page 2 of 13
Page 3 of 13
2.3. MaestroQA Processing of Personal Data. MaestroQA shall only Process Personal Data in
accordance with the documented instructions of Subscriber under the Agreement and any
applicable Order Form(s) and to comply with other reasonable instructions provided by Subscriber
that are consistent with the terms of the Agreement (individually and collectively, the "Purpose").
MaestroQA shall inform the Subscriber if, in its opinion, an instruction provided by Subscriber
infringes applicable Data Protection Law. If MaestroQA determines that it can no longer meet its
obligations under applicable Data Protection Law, it shall promptly notify Subscriber.
2.4. Details of the Processing. The subject-matter of Processing of Personal Data by MaestroQA
is as described in the Purpose set out in Section 2.3. The duration of the Processing, the nature
and purpose of the Processing, the types of Personal Data and categories of Data Subjects
Processed under this DPA are further specified in Schedule 1 (Description of Processing Activities)
to this DPA.
2.5. Optional AI Integrations. The Services may support optional integrations with third-party AI
platforms through supported interoperability protocols, including the Model Context Protocol
("MCP"). Where Subscriber elects to enable such an integration using Subscriber's own account,
credentials, or tenant with a third-party AI provider, MaestroQA shall Process Personal Data solely
as necessary to authenticate Subscriber requests, retrieve Subscriber-authorized information from
the Services, and return the requested results through the enabled integration. Any Processing
performed by such third-party AI provider is governed by Subscriber's relationship and agreement
with that provider. MaestroQA does not use Subscriber Personal Data to train, improve, or develop
any large language model or other AI foundation model. For clarity, a third-party AI provider with
which Subscriber maintains its own account, credentials, or tenant, and which Subscriber elects to
connect to the Services, is not a Sub-processor of MaestroQA.
2.6. Prohibited Data. Unless otherwise specifically agreed in the Agreement, Subscriber may not
use the Services to Process any Sensitive Personal Information (as defined in the Agreement), any
special category data within the meaning of Article 9 of the GDPR, or any criminal offence data
within the meaning of Article 10 of the GDPR. MaestroQA's obligations under this DPA do not
extend to data submitted in breach of this Section, and the Services are not designed for it.
3. SUB-PROCESSING
Use of Sub-processors. Subscriber consents to MaestroQA engaging the following
Sub-processors to Process Personal Data under the Agreement.
Sub-processor Use Case Location Duration
Amazon Web Services Data Processing and Storage
Enabling third-party foundation models as
LLM providers for in-product services at
the customer's discretion
United States Ongoing
MongoDB Data Processing and Storage United States Ongoing
Coralogix Application performance and availability
log monitoring
United States Ongoing
FullStory Product Analytics and Debugging United States Ongoing
Google Cloud Platform
(GCP)
Enabling third-party foundation models as
LLM providers for in-product services at
the customer's discretion
United States Ongoing
Page 3 of 13
Displaying Rippit_DPA_Online_DRAFT.pdf.