Auftragsverarbeitungsvertrag (AVV / DPA)
Art. 28 DSGVO
Because RAGSuite is self-hosted, customer content is processed on the customer’s own infrastructure — in most deployments NITSAN Technologies LLP is not a processor of that content. An Auftragsverarbeitungsvertrag (AVV / DPA) under Art. 28 DSGVO is provided for cases where we do process personal data on your behalf, for example during support access or a future managed-cloud option.
1. Subject & duration
Processing is limited to what is necessary to provide the agreed service, for its duration.
2. Nature & purpose
Support, troubleshooting and — where applicable — operation of a managed instance, strictly on documented instructions.
3. Categories of data & data subjects
As determined by the customer’s own content and users; the customer remains the controller.
4. Technical & organisational measures (Art. 32)
Encryption, access control, logging and the security programme described in our Trust Center.
5. Sub-processors
Self-hosted deployments add no RAGSuite sub-processor. Any sub-processors for optional services are disclosed and approved per Art. 28.
6. Request the signed AVV
A ready-to-sign AVV is available on request — contact privacy@ragsuite.de.