Data Processing Agreement
1. Whan a DPA apples
A DPA applies when RODMENA LIMITED acts as a processor — processing personal data on behalf of a customer (the controller) as part of a contracted service, for example operating or supporting a deployment of our software that holds your users' data. For our own website and business correspondence we act as a controller, covered by our Privacy Policy.
2. Staundart commitments
Under oor staunart DPA, RODMENA commits tae:
- Documented instructions: process personal data only on the controller's documented instructions
- Confidentiality: ensure everyone authorised to process the data is bound by confidentiality
- Security: pit appropriate technical an organisational measures in place (encryption in transit, least-privilege access, hardened infrastructure)
- Sub-processors: engage sub-processors only wi authorisation, under equivalent obligations. Oor current list is on the Trust Centre. We gie at least 30 days' notice o an intendit chynge, by email tae customers wi a signed DPA an in the sub-processor feed, an the customer may object afore the chynge taks effect.
- Data-subject richts: gie the controller a haun in answerin data-subject requests
- Breach notification: notify the controller without undue delay, and in any event within 24 hours, after becoming aware of a personal-data breach affecting its data, with the information then available, followed by updates.
- Assistance: support data-protection impact assessments and consultations wi the ICO whaur required
- Scuggin or giein back: at the end o the contract, scug or gie back aa personal data as the controller wales, an certify the scuggin on request
- Audit: mak available information necessar tae shaw compliance, an allou an contreebut tae audits within a reasonable notice an scope
3. Internaitional transfers
Bi defaut, processin takks place in the Unitit Kinrick. Ony transfer ootwi the UK happens ainly wi appropriate safeguards (UK adequacy, the UK Addendum tae the EU Standard Contractual Clauses, or the UK International Data Transfer Agreement) an is reflectit in the sub-processor list.
4. Axin for an cairryin oot a DPA
Email legal@rodmena.co.uk wi yer company details an the service concerned. We will provide oor staundart DPA for signature, or review yer organisation's template. The executed agreement — no this summary — governs.