<!-- source: openspec/changes/publish-legal-bundle/research/03-privacy-dpo.md -->

# Privacy / DPO Specialist Contribution to Rapoport Studio ToS

> **Status:** Research + draft. Not legal advice. All draft clauses tagged `[DRAFT — requires DPO/privacy counsel review]`.
> **Author role:** Cross-jurisdictional Data Protection & Privacy Specialist (GDPR-first; MD/RO/IL/EU awareness).
> **Date of analysis:** 2026-05-13. Privacy law moves quickly; every dated source below should be re-verified before reliance.
> **Companion sister-tracks:** Commercial Lawyer (services scope, IP, liability), AI Governance counsel (AI Act, output ownership, hallucination).

---

## 1. Executive summary

- **The studio's privacy surface is genuinely tri-document.** A single "Terms of Service" cannot carry this load. The studio MUST publish three artefacts: (a) a public **Terms of Service** at `/terms` (where data-protection clauses are short and reference-heavy), (b) a public **Privacy Policy** at `/privacy` (Articles 13/14 GDPR disclosures, cookies, retention, DSRs), and (c) a **Data Processing Agreement (DPA)** executed per client engagement (or as a signed schedule to the master engagement contract). The ToS does not stand alone for any data flow that touches personal data the *client* provides — that is exclusively a DPA matter.
- **Single biggest cross-border-transfer exposure: Anthropic + OpenAI.** Both are US-based, both receive client-supplied prompt context that can incidentally include personal data (Linear ticket bodies naming real users, code with email addresses in comments, customer-support transcripts shared for analysis). Anthropic and OpenAI both offer commercial DPAs with SCC incorporation and the EU-U.S. Data Privacy Framework as a primary transfer mechanism, but DPF is under live legal pressure (Latombe appealed to CJEU 31 October 2025; "Schrems III" considered plausible). The studio must (i) opt into both vendors' commercial DPAs explicitly, (ii) confirm zero-data-retention or commercial-terms no-training defaults, (iii) carry SCC fallback language in client DPAs in case DPF collapses.
- **Moldovan-law gotcha: a 24-month adequacy fog.** Moldova adopted **Law No. 195/2024** on 25 July 2024 to replace the 2011 Law No. 133/2011 and align with GDPR. Effective date: **23 August 2026**. Until then, Law 133/2011 is operative — which means the studio, as a Moldovan SRL, currently operates under a pre-GDPR-equivalent regime, but its EU and Israeli clients expect GDPR-grade processing. Moldova has **no EU adequacy decision** as of 2026 and is not on the active adequacy-negotiation list. Transfers EU → Moldova require SCCs. This is the single asymmetry that most warrants counsel review.
- **Israel: EU adequacy still in force, but contested.** Israel's adequacy decision was renewed by the Commission on 15 January 2024 (covered by GDPR Article 45 review). Civil-society organisations (EDRi, Access Now, 17+ NGOs) have filed two open letters since April 2024 calling for reassessment; the Commission has declined to act publicly. **Amendment 13 to the Israeli Privacy Protection Law 1981 came into force 14 August 2025**, materially upgrading the Israeli regime and adding new cross-border-transfer rules. Net effect for the studio: EU → Israel data can still flow on adequacy; IL → MD requires the studio to ensure adequate protection at the receiving end (Moldova), which under Amendment 13's stricter standard is a real obligation, not a checkbox.
- **The studio is a controller, processor, *and* sub-controller depending on the data flow.** This is the most-misunderstood point in agency ToS drafts. The marketing site visitor → studio (controller). Client engagement → studio is processor for client material, but controller for its own engagement records (invoicing, contact data, internal notes). Studio → Anthropic / OpenAI for processing client material → studio is the controller-of-record exposing the data, with Anthropic/OpenAI as sub-processors under the DPA cascade. Get this wrong in the ToS and the rest collapses.
- **No separate DPA exists today, and that is the most urgent gap.** The `_legal/vendors/anthropic.md` card flags "отсутствие формального DPA"; the `_legal/vendors/supabase.md` card flags "DPA не подписан". The studio is at the moment a Moldovan SRL operating commercial AI workflows on production data without an executed processor DPA with its primary AI vendor. Before any EU corporate client engagement closes, the studio must execute (i) Anthropic Commercial Terms + DPA, (ii) Supabase DPA, (iii) GitHub DPA, (iv) Cloudflare DPA, and have a template client-facing DPA ready to sign at engagement formation.
- **Sub-processor risk is concentrated, not diffuse.** Of the eleven vendors in scope, three carry ~90% of the personal-data risk: Anthropic (AI inference on client material), OpenAI (same, occasional fallback), and Supabase (database of record). Cloudflare and GitHub are infrastructure-tier with mature DPAs. Telegram and WhatsApp are messaging surfaces where the studio is effectively a *joint controller* with the client, not a processor — a separate consent framing applies.

---

## 2. Document architecture recommendation

Rapoport Studio publishes (or executes) three privacy-bearing artefacts. Each has a distinct legal role; combining them is a category error.

### 2.1 Terms of Service (`/terms`) — public, EN controlling, RU/RO mirrors

**Privacy content in the ToS is intentionally minimal.** The ToS is read by site visitors who may never become clients. It contains:

| Clause | Length | Purpose |
|---|---|---|
| **Data-protection clause** | One paragraph | Names studio as controller for its own data, processor for client material; cross-references Privacy Policy and DPA. |
| **Sub-processor acknowledgement** | One paragraph | Names that studio uses sub-processors; points to the maintained list. |
| **International transfer clause** | One paragraph | Names the transfer-mechanism matrix exists; points to DPA for the actual mechanism. |
| **Breach-notification clause** | One paragraph | Mutual notification obligations at a principle level; full timing/format in the DPA. |
| **Security baseline (TOMs)** | Two sentences | High-level statement of encryption-in-transit/at-rest, access controls; full TOMs in the DPA schedule. |
| **Reference to Privacy Policy** | One sentence + link | Mandatory under GDPR Article 13. |
| **Reference to DPA** | One sentence + link | DPA "applies to and forms an integral part of any engagement involving processing of personal data the Client makes available." |

**Why this is short:** Article 13/14 disclosures are properly the Privacy Policy's job. Article 28 obligations are properly the DPA's job. The ToS is the contract layer; it sets out *that* these documents exist and bind, not what they say.

### 2.2 Privacy Policy (`/privacy`) — public, EN controlling, RU/RO mirrors

Article 13 GDPR is the spine. The Privacy Policy covers, for every category of data the studio processes as **controller**:

- Identity and contact details of the controller (Rapoport Studio SRL, IDNO, registered office, `hello@rapoport.studio`).
- DPO contact (if appointed — see § 7 EU; Moldovan threshold).
- Purposes and legal bases (Art. 6(1)(a)–(f)) per processing activity.
- Recipients / categories of recipients (sub-processors named or linked).
- Transfers to third countries + transfer mechanism (Art. 46).
- Retention periods per data category.
- Data subject rights (Art. 15–22) and how to exercise them.
- Right to lodge a complaint with a supervisory authority (Moldova: Centrul Național pentru Protecția Datelor cu Caracter Personal; Romania: ANSPDCP; Israel: Privacy Protection Authority; relevant EU member state DPA for EU residents).
- Cookie / tracking disclosures (ties to consent banner — see § 5 of this report).
- Children's data (the studio's services are B2B; not directed to children; state this).
- Automated decision-making disclosure (the studio uses AI but does not make Article 22 automated decisions about individuals).

### 2.3 Data Processing Agreement (DPA) — executed per engagement

Mandatory if and only if the studio processes personal data on behalf of a client (which is the default for code-engagement work). Under GDPR Article 28(3), a controller-to-processor data-processing contract must exist in writing or electronic form. The studio's DPA covers:

- Subject-matter, duration, nature and purpose of processing.
- Categories of personal data and categories of data subjects (engagement-specific; a schedule).
- Processor's Article 28(3)(a)–(h) obligations: documented instructions, confidentiality, security, sub-processor authorisation, assistance to the controller on DSR / DPIA / breach.
- Sub-processor cascade (Article 28(2) and (4)): list of currently engaged sub-processors as a schedule; notice-and-objection mechanism on change.
- International-transfer mechanism: SCCs incorporated by reference, with module selection (see § 6 of this report).
- Technical and Organisational Measures (TOMs): schedule with encryption, access controls, audit log retention, vulnerability management.
- Audit rights (Article 28(3)(h)): the studio commits to making available all information necessary; full audits are limited to documented suspicion of breach and subject to confidentiality (this is the standard processor counter-position).
- Return-or-deletion at end of engagement (Article 28(3)(g)).
- Liability allocation for data-protection breaches (typically uncapped for processor breaches in EU enterprise contracts; the commercial lawyer's domain to negotiate).

**Format:** The DPA should be a standalone executed document referenced by the master engagement contract, not buried in the ToS. The DPA is also the natural home for client-specific SCCs.

### 2.4 Why not roll DPA into ToS?

Two reasons:

1. **Counter-party expectation.** Sophisticated EU clients (the studio's target market) expect a separately negotiated DPA. Refusing to produce one signals immaturity.
2. **Surface symmetry.** The ToS is a unilateral website document; the DPA is a bilateral signed contract. Mixing them creates ambiguity about what is binding by use vs. by signature.

### 2.5 Out-of-band: Sub-processor list

Recommendation: maintain a **dedicated `/sub-processors` page** (not buried in the Privacy Policy) listing every active sub-processor with vendor name, purpose, data categories, location, transfer mechanism, and link to the vendor's DPA. This page is the operational source of truth referenced by both Privacy Policy and DPA. Update on every vendor change. The `_legal/vendors/` directory tracked under change `establish-studio-legal-baseline` becomes the source from which this page is generated.

---

## 3. Controller / processor map

Every personal-data flow in the studio's operations, with role allocation. **"Controller" answers who decides purpose and means; "processor" answers who acts on documented instructions.**

| # | Data flow | Studio's role | Other party's role | Lawful basis (studio side) | Notes |
|---|---|---|---|---|---|
| 1 | Marketing site visitor → studio (analytics, IP, UA) | Controller | Visitor = data subject; analytics vendor (TBD) = processor | Legitimate interest (site operation, security) for essential; consent for non-essential | Ties to cookie consent banner. |
| 2 | Marketing site `/contact` form submission → studio (name, email, phone, brief) | Controller | Prospect = data subject | Pre-contractual measures (Art. 6(1)(b)) for follow-up; legitimate interest for retention of declined leads | Privacy notice must appear inline on the form. |
| 3 | Telegram / WhatsApp client comms → studio (handles, messages) | **Joint controller** with messaging platform; studio is controller vis-à-vis the client conversation | Client = data subject for own data; client's end-users = data subjects when client shares their data via chat | Performance of contract (Art. 6(1)(b)); legitimate interest for operational records | Telegram/WhatsApp themselves are independent controllers of metadata. Studio cannot DPA them. Handled in Privacy Policy + DPA disclosure. |
| 4 | Client engagement: client-provided materials (repos, user lists, support transcripts, screenshots) → studio | **Processor** (client is controller) | Client = controller | Documented instructions from controller (DPA Art. 28(3)(a)) | This is the dominant studio data flow. DPA is non-optional. |
| 5 | Studio internal: engagement record-keeping (invoices, time logs, internal Linear tickets about client) | Controller (for studio's own legal/financial records) | Client = data subject for contact data; client personnel = data subjects | Performance of contract; legal obligation (tax/AML retention) | Even though client material is processor-data, the engagement *metadata* about the client is controller-data. |
| 6 | Studio → **Anthropic** (prompt context: code, Linear bodies, spec excerpts) | Controller (when exposing studio-internal data); transmitting controller-on-behalf-of-client (when client material is in context) | Anthropic = sub-processor (under Commercial Terms + DPA) | Mirrors flow 4's basis; processor cascade | Sub-processor flow-down required. Anthropic Commercial Terms (no-training default) confirmed Sep 2025; Zero-Data-Retention available for Enterprise. |
| 7 | Studio → **OpenAI** (occasional prompt context) | Same as Anthropic | OpenAI = sub-processor (under API DPA) | Same | Note studio's stated "occasional" use — must still be disclosed; the rare-use defense does not exist under GDPR. |
| 8 | Studio → **Supabase** (database of record for `app.rapoport.studio`) | Controller for studio-own data; processor-transmitting for client data stored on behalf | Supabase = sub-processor (under Supabase DPA) | Performance of contract; legitimate interest | Region: AWS eu-central-2 (Frankfurt). Data does not leave EEA in normal operation. |
| 9 | Studio → **Cloudflare** (Workers, KV, edge compute) | Same shape as Supabase | Cloudflare = sub-processor (Customer DPA v6.3, June 2025) | Performance of contract | Edge runs globally; data-in-transit only; compute can be region-pinned. |
| 10 | Studio → **Linear** (project tracking; ticket bodies may name client personnel) | Controller for studio's own work-tracking; transmitting-processor for any client-identifying ticket content | Linear = sub-processor | Performance of contract; legitimate interest | Sensitive flow — Linear is a US-controlled SaaS. Tickets must be sanitised of client PII or DPA flow-down must cover. |
| 11 | Studio → **GitHub** (code hosting; commit author email is personal data) | Controller for studio org accounts; processor-transmitting for client-owned commits | GitHub = sub-processor (DPA Oct 2025) | Performance of contract | Commit author email is unambiguously personal data per GDPR. |
| 12 | Studio → **Vercel** (per platform.md, status TBD; appears retired in favour of Cloudflare) | Verify whether active; if not, remove from inventory | If active: sub-processor | — | **Action item:** confirm with `platform.md` § Stack — current state shows Cloudflare Workers via `@opennextjs/cloudflare`, no Vercel reference. Likely retired. |
| 13 | Studio → **Infisical** (secrets storage, no PII) | Controller of access metadata | Infisical = sub-processor (for metadata only) | Performance of contract | Infisical does not process personal data of clients or end-users in normal use; secrets are credentials, not PII. Note for completeness. |
| 14 | Studio → **n8n Cloud** (Telegram/WhatsApp → studio bridges) | Controller / processor-transmitting (mirrors flow 3) | n8n = sub-processor | Mirrors flow 3 | Add to sub-processor list. |

**Three role allocations the ToS must state explicitly:**

1. **Marketing-site visitors: studio is controller.** Privacy Policy applies; ToS references it.
2. **Client engagement personal data: client is controller, studio is processor.** ToS references DPA.
3. **Studio's own records about clients (contact data, engagement metadata): studio is controller.** Privacy Policy applies.

The studio is *never* a joint controller with its clients in the engagement-data flow — that would conflate the client's regulatory exposure with the studio's. Joint controllership only arises in flow 3 (messaging platforms), where it is structural.

---

## 4. Sub-processor inventory

Cross-referenced against `_legal/vendors/` cards (in flight under change `establish-studio-legal-baseline`).

| Vendor | Purpose | Data categories | Location | Transfer mechanism (EU → vendor) | DPA link | Status |
|---|---|---|---|---|---|---|
| **Anthropic** | LLM inference (Forge, Maestro, Muse) | Code, ticket bodies, spec text, incidental PII | US (California / Delaware) | EU-U.S. DPF + SCCs as fallback; commercial DPA available | [anthropic.com/legal/commercial-terms](https://www.anthropic.com/legal/commercial-terms) | DPA execution required (`_legal/vendors/anthropic.md` Q3) |
| **OpenAI** | LLM inference (occasional fallback) | Same as Anthropic | US (California) | EU-U.S. DPF + SCCs; Commercial DPA + zero-retention option | [openai.com/policies/data-processing-addendum](https://openai.com/policies/data-processing-addendum/) | DPA execution required |
| **Supabase** | Postgres + Auth + Storage | Auth data (email), session JWTs, application data | AWS eu-central-2 (Frankfurt) | Data stays in EEA; Supabase corporate entity is US (Delaware) — SCCs in DPA | [supabase.com/legal/dpa](https://supabase.com/legal/dpa) | DPA signature required (`_legal/vendors/supabase.md` Q1) |
| **Cloudflare** | Workers, KV, CDN, edge runtime | Request/response payloads in transit; access logs | Global edge; corporate US | EU-U.S. DPF + Swiss-U.S. DPF + UK Extension + SCCs (Customer DPA v6.3, 20 June 2025) | [cloudflare.com/cloudflare-customer-dpa](https://www.cloudflare.com/cloudflare-customer-dpa/) | DPA auto-applies to Enterprise; verify acceptance for Pro/self-serve tier |
| **GitHub** | Source-code hosting, Issues, Actions | Code, commit metadata (author email), Issue bodies | US (multi-region; Enterprise can pin region) | EU-U.S. DPF + SCCs (DPA Oct 2025) | [docs.github.com/en/site-policy/privacy-policies/github-data-protection-agreement](https://docs.github.com/en/site-policy/privacy-policies/github-data-protection-agreement) | DPA available; ensure execution at Enterprise/Team tier |
| **Linear** | Project/issue tracking | Ticket bodies (may incidentally contain PII), assignee emails | US (multi-region) | EU-U.S. DPF + SCCs in their DPA | [linear.app/dpa](https://linear.app/dpa) (verify) | DPA execution required |
| **Telegram** | Client comms primary | Conversation content, handles, group metadata | Dubai HQ, undisclosed infra | **No published DPA; not GDPR-compliant for B2B per multiple sources (2025)** | None published | Treat as **joint controller** with disclosure to clients in DPA + Privacy Policy; advise EU-corporate clients to use canvas/email surface instead. |
| **WhatsApp (Cloud API)** | Client comms secondary | Conversation content, phone numbers, message metadata | Meta global; servers can be EU via BSP routing | Meta DPA + Business Data Transfer Addendum; SCCs | [whatsapp.com/legal/business-data-processing-terms](https://www.whatsapp.com/legal/business-data-processing-terms) | Use only via EU-based BSP per WhatsApp Business API; not the consumer app. |
| **n8n Cloud** | Telegram/WhatsApp → studio bridges | Messages in transit; mirror of conversation content | EU (Berlin); n8n GmbH | EU-controller-to-EU-processor — no third-country issue | [n8n.io/legal/dpa](https://n8n.io/legal/dpa) | Sign their DPA. |
| **Infisical** | Secrets management | Operational secrets (not PII of clients/end-users) | EU instance (`eu.infisical.com`) | EU-to-EU | [infisical.com/legal/dpa](https://infisical.com/legal/dpa) (verify) | DPA optional for PII-clean use; sign for completeness. |
| **Analytics provider** | Site analytics (TBD) | IP, session ID, UA, page-view events | TBD | Depends on choice | TBD | **Open item:** the analytics provider is TBD per the brief. Strong recommendation: Plausible or simpleanalytics (EU-hosted, cookieless) over Google Analytics 4. GA4 forces DPF reliance and a cookie consent banner. |
| Vercel | (historical) | (historical) | — | — | — | **Confirm retired.** `platform.md` § Stack shows Cloudflare Workers as exclusive runtime. Remove from inventory if not active. |

---

## 5. Key drafting recommendations (ToS-only)

These are the privacy-bearing clauses the ToS needs. Each clause is short by design — depth lives in the Privacy Policy and DPA.

### 5.1 Data-Protection clause (one paragraph in ToS)

States: (a) studio's controller role for site/account/contact data, (b) studio's processor role for client-provided material, (c) reference to the Privacy Policy URL for controller flows, (d) reference to the DPA template for processor flows, (e) reference to the sub-processor list URL.

### 5.2 Sub-Processor disclosure clause

States: (a) the list URL is the authoritative source, (b) studio commits to give clients reasonable advance notice (≥ 30 days) of new sub-processors that will handle their personal data, (c) clients may object by written notice within the notice period; if objection cannot be reconciled, the engagement may be terminated for that engagement scope without penalty. Cf. Anthropic / OpenAI / Cloudflare standard 30-day notice posture.

### 5.3 International transfers clause

States: (a) some sub-processors are outside the EEA / Moldova / Israel, (b) studio relies on the transfer mechanisms in the table maintained at the sub-processor list URL — primarily SCCs (2021/914) with EU-U.S. DPF as supplementary mechanism where applicable, (c) studio commits to update the transfer mechanism if DPF is invalidated.

### 5.4 Security clause (TOMs reference)

States, at principle level: (a) encryption in transit (TLS 1.2+) and at rest (Supabase/Cloudflare defaults), (b) RBAC + principle of least privilege, (c) the full TOMs are in the DPA schedule. The ToS does not enumerate controls — that's a moving target.

### 5.5 Breach-notification clause (mutual)

States: (a) studio will notify the client without undue delay and in any event within 48 hours of becoming aware of a personal-data breach affecting the client's processed data, (b) studio will provide the information required by Article 33(3) GDPR insofar as known, (c) the client commits to a parallel obligation for breaches that originate client-side. Detailed timing and format live in the DPA.

The 48-hour internal-deadline is a deliberate undercut of the 72-hour Article 33 obligation to give the controller time to fulfil its own 72-hour duty to the supervisory authority.

### 5.6 Data subject rights clause (reference only)

The ToS does not enumerate DSRs — that's Privacy Policy. ToS says: "Data subjects may exercise their rights as described in the Privacy Policy. For personal data we process on behalf of a Client, requests will be forwarded to the Client unless we are legally required to respond directly."

### 5.7 Retention clause (principle only)

ToS states only: "We retain personal data no longer than necessary for the purposes described in the Privacy Policy or in any executed DPA, subject to legal-retention requirements (Moldovan / Romanian / Israeli tax and accounting law)." Specifics in Privacy Policy.

### 5.8 No-training warranty for AI sub-processors

A clause unique to AI-substrate engagements (the studio's differentiator). States: "The studio uses AI sub-processors (Anthropic, OpenAI) under commercial terms that prohibit training on Customer Content. The studio will not enable training opt-in features unless expressly directed by the Client in writing." This is a privacy-side warranty; AI Governance counsel owns the output-classification clause separately.

---

## 6. Draft clause text

Each clause below is targeted for the **Terms of Service** at `rapoport.studio/terms`, EN controlling.

### 6.1 Data protection — controller / processor allocation

> **[DRAFT — requires DPO/privacy counsel review]**
>
> **Data Protection.** Rapoport Studio SRL (the "Studio") is a Moldovan société à responsabilité limitée acting as controller of personal data it collects directly from users of `rapoport.studio` and `app.rapoport.studio` (including names, contact details, and account information). Where the Studio processes personal data on behalf of a Client during an engagement — including, without limitation, personal data incidentally contained in source code, repository metadata, support transcripts, customer datasets, or other materials the Client makes available — the Studio acts as processor, and the Client acts as controller. The terms of such processing are set out in the Data Processing Agreement ("DPA") executed between the Studio and the Client, which is incorporated by reference into the engagement and prevails over these Terms in any conflict on data-protection matters. The Studio's processing of personal data as controller is described in the Studio's Privacy Policy at `rapoport.studio/privacy`. The Studio maintains an up-to-date list of sub-processors at `rapoport.studio/sub-processors`.

### 6.2 Sub-processor change notification

> **[DRAFT — requires DPO/privacy counsel review]**
>
> **Sub-Processors.** The Studio engages sub-processors to deliver the Services. The current list of sub-processors and the categories of personal data each may process is maintained at `rapoport.studio/sub-processors`. The Studio will provide Clients with at least thirty (30) days' prior notice before engaging a new sub-processor that will process personal data the Client makes available to the Studio. Such notice will be given by email to the Client's notified data-protection contact, or, in the absence of one, to the Client's primary engagement contact. The Client may object to the engagement of a new sub-processor by written notice within fifteen (15) days of the Studio's notification, setting out reasonable, documented data-protection grounds. The Studio will use good-faith efforts to address the Client's concerns. If no resolution is reached within thirty (30) days of the Client's objection, the Client may terminate the affected engagement scope without further liability, subject to payment for Services rendered through the effective date of termination.

### 6.3 International transfers

> **[DRAFT — requires DPO/privacy counsel review]**
>
> **International Transfers.** The Studio is established in the Republic of Moldova, which has not received a European Commission adequacy decision as of the effective date of these Terms. Where personal data subject to Regulation (EU) 2016/679 ("GDPR") is transferred from the European Economic Area, the United Kingdom, or Switzerland to the Studio or to a Studio sub-processor located in a third country that has not received an adequacy decision, such transfer is governed by the European Commission Standard Contractual Clauses adopted by Implementing Decision (EU) 2021/914 ("SCCs"), with the modules and annexes incorporated into the DPA. Where a Studio sub-processor relies on the EU-U.S. Data Privacy Framework (or Swiss-U.S. or UK Extension equivalents) as the primary transfer mechanism, the SCCs in the DPA apply as a supplementary mechanism and a fallback in the event the relevant Privacy Framework is invalidated, suspended, or amended in a way that materially affects its legal sufficiency. Where personal data is transferred from Israel, the Studio relies on the Israeli Privacy Protection Authority's published transfer regime and, where applicable, on the European Commission's adequacy decision in respect of Israel. The Studio will reasonably cooperate with the Client to put in place additional transfer safeguards required by a competent supervisory authority.

### 6.4 Personal-data breach notification (mutual)

> **[DRAFT — requires DPO/privacy counsel review]**
>
> **Breach Notification.** The Studio will notify the Client without undue delay and in any event within forty-eight (48) hours of becoming aware of a personal-data breach (as defined in Article 4(12) GDPR) affecting personal data the Studio processes on behalf of the Client. Such notification will, at minimum and to the extent then known, describe the nature of the breach including the categories and approximate number of data subjects and data records concerned, the likely consequences of the breach, and the measures taken or proposed to address the breach and mitigate its effects. The Studio will provide further information as it becomes available and will reasonably assist the Client in meeting the Client's own notification obligations under applicable law. The Client agrees to notify the Studio without undue delay of any personal-data breach originating in the Client's environment that affects data the Studio is processing on the Client's behalf, so that the Studio may take appropriate technical and organisational measures.

### 6.5 No-training warranty

> **[DRAFT — requires DPO/privacy counsel review]**
>
> **AI Sub-Processors; No Training.** The Studio uses AI sub-processors (currently Anthropic and OpenAI) to deliver portions of the Services. The Studio engages these sub-processors under their respective commercial terms, which, as of the effective date of these Terms, provide that the AI sub-processor will not use Customer Content for the training or improvement of its models. The Studio will not enable any training-opt-in feature offered by an AI sub-processor without the Client's prior written instruction. Where a Client requires a stricter posture — including, without limitation, Zero-Data-Retention configuration with the AI sub-processor — the Studio will use commercially reasonable efforts to procure such configuration, subject to the AI sub-processor's standard availability of that option for the relevant Service tier.

---

## 7. Jurisdictional add-ons

### 7.1 Moldova

- **Operative law today: Law No. 133/2011 on Personal Data Protection.** Pre-GDPR alignment, partial; supervised by the **National Centre for Personal Data Protection** (`datepersonale.md`).
- **Operative law from 23 August 2026: Law No. 195/2024.** Closely transposes GDPR with deviations. Adopted 25 July 2024. The 24-month implementation window is now ~15 months remaining as of this analysis date.
- **Adequacy with EU: NONE.** Moldova is not on the EU adequacy list and not in active adequacy negotiation. EU → Moldova transfers require SCCs even though Moldova is, on paper, GDPR-equivalent after Aug 2026.
- **Territorial scope of Law 195/2024:** mirrors GDPR Article 3 — applies to controllers/processors established in Moldova *and* to those offering goods/services to or monitoring behaviour of data subjects in Moldova. The studio is directly in scope under (a).
- **DPO threshold:** to be confirmed against Law 195/2024 final text; expect GDPR-Art-37 thresholds with Moldovan-specific public-authority overlays. The studio, as a small private SRL, is likely not statutorily required to appoint a DPO but should appoint a privacy-responsible person internally (Pavel, until headcount grows).
- **Registration with National Centre:** under Law 133/2011 currently there is a notification regime. Law 195/2024 is expected to drop notification in favour of accountability + record-keeping, mirroring GDPR. Confirm at counsel review.

**Gotcha:** the asymmetry between current Moldovan law (pre-GDPR-grade) and what EU clients will demand (GDPR-grade) means the studio should contractually commit to GDPR-grade processing irrespective of Moldovan statutory minima during the 24-month transition. The ToS / DPA already do this by anchoring to GDPR directly. This is correct and should be preserved on counsel review.

### 7.2 Romania

- **Operative law: GDPR (directly applicable) + Law No. 190/2018.** Law 190/2018 sets local implementation: processing of national identification numbers, special-category overlays, employee monitoring rules, public-authority sanction framework.
- **Supervisory authority: ANSPDCP** (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal).
- **No special small-SRL exemption.** Private entities including SRLs are subject to GDPR-standard fines without intermediate tiers — Law 190/2018 deliberately did not create a small-business carve-out.
- **DPO threshold:** GDPR Article 37; Law 190/2018 does not add bright-line triggers for private B2B. The studio, with Romanian clients, is unlikely to cross the "core activity = large-scale monitoring or special-category processing" threshold for mandatory DPO.
- **Client engagement implication:** Romanian B2B clients will expect a DPA executed under GDPR + Law 190/2018. The studio's DPA template should reference Law 190/2018 by name in the choice-of-applicable-law clause when the Client is Romanian.

### 7.3 Israel

- **Operative law: Privacy Protection Law 1981 + Amendment 13 (in force 14 August 2025).**
- **Amendment 13 effects:**
  - Adds GDPR-style data-subject rights (access, correction, deletion expanded).
  - Introduces a formal **Data Protection Officer** concept ("Privacy Protection Officer" — `מנהל הגנת הפרטיות`) with appointment threshold tied to database scale and sensitivity.
  - Imposes **stricter cross-border transfer rules** requiring receiving country adequacy or contractual safeguards.
  - Expands the Privacy Protection Authority's powers (administrative orders, financial sanctions in the millions of shekels, cease-and-desist).
  - Introduces a **separate EEA transfer regime in force 2025** for Israeli databases that also contain EEA-origin data — these "mixed databases" face GDPR-grade obligations.
- **EU adequacy: in force.** Renewed by Commission decision in January 2024 (four-year cycle per GDPR Art. 45(3)). Live political pressure to reassess (EDRi / Access Now letters of April 2024 and June 2025) but adequacy is operative as of this report.
- **Studio implication:** EU → Israel data flows under adequacy. Israel → Moldova flows (e.g., Israeli founder client engages the studio) require the studio to demonstrate adequate protection in Moldova — Amendment 13 makes this a substantive obligation. The Moldovan adequacy gap (§ 7.1) is what makes this acute. Mitigation: contract Israeli clients with SCC-equivalent language in the DPA covering studio-side processing.

### 7.4 EU broader (GDPR baseline)

- **GDPR Article 28 DPA: non-negotiable for EU corporate clients.**
- **DPF status:** valid as of analysis date. Latombe challenge dismissed by EU General Court 3 September 2025; appealed to CJEU 31 October 2025. A second "Schrems III" challenge is in preparation but not filed. Risk-management posture: rely on DPF where vendors offer it but always carry SCCs as fallback. The studio's `_legal/vendors/` cards already note this exposure.
- **DPIA threshold (Art. 35):** the studio's processing does not currently meet the "high risk to rights and freedoms" threshold (no large-scale monitoring of public spaces, no large-scale special-category processing, no automated decision-making with legal effect). Should the studio's AI-substrate operations evolve toward profiling end-users at scale, a DPIA becomes mandatory.
- **EU AI Act overlap:** out of scope for this domain (AI Governance counsel) but worth flagging: the privacy and AI Act surfaces interlock at training-data provenance, GPAI obligations, and high-risk-system DPIA equivalents.

### 7.5 Cookies / ePrivacy

- **ePrivacy Directive (2002/58/EC) still operative** on cookies pending the long-stalled ePrivacy Regulation.
- **Consent banner required** for any non-essential cookie or storage access on `rapoport.studio`. Strictly-essential cookies (session, CSRF) are exempt.
- **Choice of analytics matters more than the banner.** EU-hosted cookieless analytics (Plausible, Simple Analytics, Matomo self-hosted) avoid the banner entirely for analytics. GA4 requires banner + DPF reliance + risk that EU DPAs may rule on GA4 lawfulness again as they did in 2022. Recommendation: avoid GA4.
- **Moldovan ePrivacy equivalent: Law on Electronic Communications + Law 133/2011 (and Law 195/2024 from August 2026).** Currently lighter-touch than EU but EU traffic on `rapoport.studio` requires EU-grade compliance regardless.

---

## 8. Open questions for human counsel

1. **DPO appointment.** Is statutory DPO designation required for the studio's current scale and processing? Recommendation is no, but a written designation of Pavel (or successor) as the privacy-responsible function is good practice and a credibility signal to EU clients.
2. **Privacy Policy versioning.** What versioning + notice mechanism does the studio adopt for Privacy Policy updates? Recommend: version number + last-updated date in the document footer; material-change notice to active Clients via the engagement comms channel.
3. **Special-category processing.** Will any engagement scope ever touch Article 9 GDPR special categories (health, biometric, etc.)? If yes, dedicated DPA addendum required. Recommendation: contractually exclude special-category processing from the standard engagement unless explicitly scoped.
4. **Children's data.** The studio's services are B2B, but client material *could* contain data about minors (e.g., a children's education-app engagement). Add an explicit clause stating studio does not knowingly accept engagements involving minors' data without a dedicated addendum.
5. **Data-residency commitments.** Should the standard DPA promise "EU-only processing" or remain silent and rely on the sub-processor list? Recommendation: silent in DPA boilerplate; offer "EU-only processing" as a premium engagement-tier commitment that can be priced separately.
6. **Anthropic / OpenAI ZDR (Zero Data Retention).** Confirm with Anthropic Enterprise and OpenAI Enterprise whether ZDR is available at the studio's API tier or requires Enterprise contract uplift. If unavailable at current tier, the studio's claim in clause § 6.5 ("commercially reasonable efforts to procure") is the correct hedge.
7. **Linear ticket-body PII.** Operational: enforce a "no client PII in Linear titles or descriptions" rule, since Linear ticket bodies feed into AI prompts via Forge/Maestro. The Moldovan and Israeli privacy regimes both treat operational hygiene as a security-measure obligation.
8. **Vercel.** Confirm with `platform.md` § Stack that Vercel is no longer in active use. If retired, remove from sub-processor inventory; if active for any surface, add it.
9. **Analytics vendor.** Lock the choice (the brief flags TBD). Strong privacy-side recommendation: Plausible.io (EU-hosted, no banner needed) or Simple Analytics.
10. **Joint controllership with Telegram / WhatsApp.** Should the engagement charter expressly note that Telegram/WhatsApp comms are joint-controller flows and that the client carries some shared exposure? This is a frank disclosure that EU corporates will appreciate; many agencies obscure it.
11. **Cross-vendor data-subject request orchestration.** When a data subject sends an Art. 15 request to the studio about data the studio processes on behalf of a client, what's the SLA and the routing? DPA should specify "forward within 5 working days; cooperate within Art. 28(3)(e) limits."
12. **Insurance.** Out of scope for this domain but flag for the commercial lawyer: cyber-liability insurance with regulatory-fine coverage where lawful (some jurisdictions forbid insuring administrative fines).

---

## 9. Sources

All accessed 2026-05-13 unless otherwise noted. Privacy law moves quickly — re-verify before any compliance or contractual reliance.

**Moldova:**
- [Moldova: New data protection law adopted — CSOMETER](https://csometer.info/updates/moldova-new-data-protection-law-adopted) — Law 195/2024 adoption, effective 23 Aug 2026.
- [Moldova's New Personal Data Protection Law — ACI Partners (legal-expert review)](https://aci.md/legal-expert-review-moldovas-new-personal-data-protection-law/) — Moldovan-counsel analysis of GDPR alignment + deviations.
- [Moldova: GDPR almost there — Schoenherr](https://www.schoenherr.eu/content/moldova-gdpr-almost-there) — practitioner overview of the 24-month transition.
- [DLA Piper Data Protection Laws of the World — Moldova](https://www.dlapiperdataprotection.com/?t=law&c=MD) — Law 133/2011 baseline, current as of 2024.
- [National Centre for Personal Data Protection (Moldova)](https://datepersonale.md/en/) — regulator's own site.

**Israel:**
- [Israel marks a new era in privacy law: Amendment 13 ushers in sweeping reform — IAPP](https://iapp.org/news/a/israel-marks-a-new-era-in-privacy-law-amendment-13-ushers-in-sweeping-reform) — IAPP overview of Amendment 13.
- [What Israel's Amendment 13 Means for Businesses in 2025 — BigID](https://bigid.com/blog/what-israel-amendment-13-means-for-businesses-in-2025/) — business-impact summary, 14 August 2025 effective date confirmed.
- [Pearl Cohen — Israel: Significant Amendment to the Privacy Law Takes Effect](https://www.pearlcohen.com/israel-significant-amendment-to-the-privacy-law-takes-effect/) — Israeli-counsel commentary post-effect.
- [Statewatch — EU under pressure to cancel data adequacy agreement with Israel (June 2025)](https://www.statewatch.org/news/2025/june/eu-under-pressure-to-cancel-data-adequacy-agreement-with-israel/) — civil-society pressure on EU-Israel adequacy.
- [Tech Policy Israel — Overview of Amendment No. 13 (October 2024)](https://techpolicy.org.il/wp-content/uploads/2024/10/Overview-of-Amendment-no-13-FINAL-FINAL-FOR-UPLOAD-FOR-WEBSITE-COLLATED-1.pdf) — detailed academic / policy brief.
- [Pearl Cohen — EU Renews Israel's Data Protection Adequacy Recognition](https://www.pearlcohen.com/eu-renews-israels-data-protection-adequacy-recognition/) — January 2024 renewal.

**Romania:**
- [Romania: implementation of the GDPR – Law no. 190/2018 — Schindhelm](https://it.schindhelm.com/en/news-jusful/news/romania-implementation-of-the-gdpr-law-no-190-2018) — practitioner overview.
- [Law No. 190/2018 English translation — privacyon.ro](https://privacyon.ro/wp-content/uploads/2018/12/Romanian-GDPR-implementation-law-English-translation.pdf) — full English text of the implementing law.
- [GDPR Guide to National Implementation: Romania — White & Case](https://www.whitecase.com/insight-our-thinking/gdpr-guide-national-implementation-romania) — biglaw summary.
- [DLA Piper Data Protection Laws of the World — Romania](https://www.dlapiperdataprotection.com/index.html?t=law&c=RO) — current as of 2024.
- [ANSPDCP (Romanian DPA)](https://www.dataprotection.ro/) — supervisory authority site.

**EU / GDPR / DPF:**
- [EU-U.S. Data Privacy Framework upheld — General Court Latombe ruling (September 2025) — Freshfields](https://www.freshfields.com/en/our-thinking/blogs/technology-quotient/eu-us-data-privacy-framework-survives-its-first-judicial-challenge-but-more-are-102l4m1) — DPF first-instance challenge dismissed.
- [European Court of Justice to Review Challenge to EU-U.S. Data Privacy Framework — WilmerHale (December 2025)](https://www.wilmerhale.com/en/insights/blogs/wilmerhale-privacy-and-cybersecurity-law/20251201-european-court-of-justice-to-review-challenge-to-eu-us-data-privacy-framework) — CJEU appeal status.
- [EU Adequacy Decisions list — European Commission](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en) — current list; Moldova not included; Israel included.
- [New Standard Contractual Clauses — European Commission Q&A](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/new-standard-contractual-clauses-questions-and-answers-overview_en) — SCC 2021/914 modules.

**Anthropic:**
- [Anthropic Commercial Terms of Service](https://www.anthropic.com/legal/commercial-terms) — incorporates DPA by reference; no-training default for Commercial customers.
- [Updates to Anthropic Consumer Terms and Privacy Policy (August 2025)](https://www.anthropic.com/news/updates-to-our-consumer-terms) — note that the August 2025 consumer changes do NOT apply to Commercial / API.
- [Anthropic Privacy Center — Commercial Customers](https://privacy.claude.com/en/collections/10663361-commercial-customers) — DPA + ZDR availability for Enterprise.
- [Anthropic API retention reduced to 7 days (Sept 2025)](https://techcrunch.com/2025/08/28/anthropic-users-face-a-new-choice-opt-out-or-share-your-data-for-ai-training/) — TechCrunch coverage; Commercial unaffected by the consumer-tier opt-out shift.

**OpenAI:**
- [OpenAI Data Processing Addendum](https://openai.com/policies/data-processing-addendum/) — current DPA with SCC incorporation.
- [OpenAI Business Data Privacy](https://openai.com/business-data/) — no-training-by-default for API, Enterprise, Business.
- [OpenAI Expanding data residency to business customers worldwide](https://openai.com/index/expanding-data-residency-access-to-business-customers-worldwide/) — EU residency options.

**Supabase:**
- [Supabase Data Processing Addendum](https://supabase.com/legal/dpa) — current DPA.
- [Supabase Available Regions](https://supabase.com/docs/guides/platform/regions) — confirms eu-central-2 (Zurich/Frankfurt AWS).
- [Supabase GDPR](https://supabase.com/gdpr) — GDPR posture statement.

**Cloudflare:**
- [Cloudflare Customer DPA v6.3 (20 June 2025)](https://cf-assets.www.cloudflare.com/slt3lc6tev37/3LmXORq5FW5EuJ0OT1B871/f466268011407efbc07f4fadbd1af466/Cloudflare_Customer_DPA_v6.3_June_20__2025.pdf) — latest version with DPF + SCC dual reliance.
- [Cloudflare Customer SCCs page](https://www.cloudflare.com/cloudflare-customer-scc/) — module-by-module application.

**GitHub:**
- [GitHub Data Protection Agreement (October 2025)](https://assets.ctfassets.net/8aevphvgewt8/9rRh60u9m8AJGCKPHSnkI/f665de2992d6aa66bab425d19a559dd1/TPL-202510-GitHubDataProtectionAgreement.pdf) — current DPA.
- [GitHub Subprocessors list](https://docs.github.com/en/site-policy/privacy-policies/github-subprocessors) — sub-processor inventory.

**Telegram / WhatsApp:**
- [Is Telegram GDPR compliant? — SimpleAnalytics](https://www.simpleanalytics.com/is-gdpr-compliant/telegram) — no published DPA, not recommended for B2B.
- [Telegram and GDPR — Zextras](https://community.zextras.com/telegram-and-gdpr-are-the-data-controllers-covered/) — controller-coverage analysis.
- [WhatsApp Business Data Processing Terms](https://www.whatsapp.com/legal/business-data-processing-terms) — Meta's business DPA for WhatsApp.
- [Using WhatsApp for Business Without Violating GDPR — heyData](https://heydata.eu/en/magazine/how-to-use-whats-app-for-business-while-staying-gdpr-compliant/) — EU-BSP requirement for compliance.

**Internal references:**
- `openspec/current/platform.md` — studio's canonical operational description.
- `openspec/changes/establish-studio-legal-baseline/proposal.md` + `design.md` — in-flight legal-baseline change.
- `_legal/vendors/anthropic.md`, `_legal/vendors/supabase.md`, etc. — vendor cards (v0.1 drafts, 2026-05-13).
- `_legal/policies/ai-usage-policy.md` — AI-usage policy v0.1.

---

**End of report.** All clause drafts are marked `[DRAFT — requires DPO/privacy counsel review]`. Privacy law moves quickly; every external citation should be re-verified before any compliance or contractual reliance.
