Data Processing (DPA)

Why this page exists

When we automate a process — orders, invoices, reports — personal data of your customers passes through the systems: names, addresses, phone numbers. Under the GDPR you are the controller of that data and Rabotivo.bg (based in Sofia, Bulgaria; contact hello@rabotivo.bg) is the processor. That's an allocation of responsibility, not a formality, and we prefer to state it publicly before you ever call us.

Our rule is simple: no data is touched without a signed Data Processing Agreement. Here is what it contains — no last-minute surprises.

1. When we process personal data at all

Less often than you'd think. A shipping label is made with an ordinary integration — data passes machine-to-machine between your shop and the courier without being stored with us. We process personal data only to the extent the specific process requires, only on your documented instructions, and never for our own purposes.

2. What our standard DPA guarantees

• Subject-matter, duration, nature and purpose — described specifically for your project, not in boilerplate.
• Your instructions only. Your customers' data is used for nothing else — including model training.
• Confidentiality obligations on everyone with access.
• Security (Art. 32 GDPR): encryption in transit; access control and minimisation; operation logs; idempotency (the same operation cannot run twice — hence no duplicate invoices); a five-day observe-only period before go-live; a documented manual fallback.
• Sub-processors: the list (hosting, language models, document reading) is part of the DPA; additions require prior notice and a right to object.
• AI and language models: business-tier terms only, under which your data is never used for training; the minimum fields needed pass through the model; EU processing where available. When the system isn't sure, it asks a human — it doesn't guess.
• Assistance with data-subject requests and regulator notifications.
• Breach notification without undue delay, so you can meet your own 72-hour deadline under Art. 33.
• End of contract: data returned or deleted at your choice; your process logic is yours and held in escrow.
• Audit rights with reasonable notice.
• Transfers outside the EEA: only under a lawful mechanism (SCCs / EU-U.S. Data Privacy Framework), named in the DPA.

3. Who is liable

Our liability as processor is set in the main contract, including a contractual cap. We don't shift our responsibility to you — and we don't assume yours as controller: what data is processed and why is your decision; how it moves safely through the systems is ours.

4. Want the full text?

Email hello@rabotivo.bg and we'll send the full signable DPA in advance — before any commitment. Reading before signing is exactly the habit we want our clients to have.