Data Processing Agreement (DPA)

Last updated: 2026-08-27

Public draft pending counsel validation (CF-06 / LIVE-02). This is not a countersigned processor DPA.

This document describes the framework under which Runway Ready AI SL (controller) and processors handle RunwayReady user personal data under GDPR Art. 28.

1. Parties

Controller: Runway Ready AI SL, CIF B27598499, Calle Faraday 7, Parque Científico de Madrid, 28049 Madrid, Comunidad de Madrid, Spain. Data protection contact: contact@runwayready.ai.

Typical processors: Apple, Google Cloud / Firebase / Vertex AI (EU), Google Play, Stripe, Shippo, fal.ai (US; DPA/SCC pending CF-04/ENG-05), OpenRouter, Brevo (email — not SendGrid), Sentry, Meta (gated on marketing consent and ATT). Full list in the Privacy Policy and vendor SLA section.

2. Subject matter & duration

Processing of account, wardrobe images, marketplace, and analytics data (if consented) while the service is active or until deletion instruction.

3. Instructions

Processors act only on documented controller instructions and not for unauthorized own marketing purposes.

4. Security & sub-processors

Appropriate technical and organizational measures; sub-processors under equivalent obligations; international transfers with SCCs or other safeguards.

5. Data-subject rights & deletion

Assist the controller with DSARs; delete or return data at end of processing, except legal retention.

Contact: contact@runwayready.ai · AEPD: https://www.aepd.es