Data Processing Agreement
1. Whan a DPA applies
A DPA applies when RODMENA LIMITED acts as a processor — processing personal data on behalf of a customer (the controller) as part of a contracted service, for example operating or supporting a deployment of our software that holds your users' data. For our own website and business correspondence we act as a controller, covered by our Privacy Policy.
2. Staundart commitments
Under oor staundart DPA, RODMENA commits tae:
- Documentit instructions: process personal data only on the controller's documentit instructions
- Confidentiality: mak siccar at awbody that is alloued tae process the data is bund bi confidentiality
- Security: pit appropriate technical and organisational measures in place (encryption in transit, least-privilege access, hardened infrastructure)
- Sub-processors: engage sub-processors only wi authorisation, under equivalent obligations. Oor current list is on the Trust Centre. We gie at least 30 days' notice o an intendit chynge, by email tae customers wi a signed DPA and in the sub-processor feed, and the customer may object afore the chynge taks effect.
- Data-subject richts: help the controller tae respond tae data-subject requests
- Breach notification: notify the controller without undue delay, and in any event within 24 hours, after becoming aware o a personal-data breach affectin its data, wi the information then available, followed bi updates.
- Assistance: support data-protection impact assessments and consultations with the ICO where required
- Deletion or return: at contract end, delete or return aw personal data as the controller chooses, and certify deletion on request
- Audit: mak available the information necessar tae shaw compliance, an allou an contribute tae audits within reasonable notice an scope
3. Internaitional transfers
Processin takks place in the Unitit Kinrick bi default. Ony transfer ootwi the UK happens anely wi appropriate safeguards (UK adequacy, the UK Addendum tae the EU Standard Contractual Clauses, or the UK International Data Transfer Agreement) and is reflectit in the sub-processor leet.
4. Speirin for and executin a DPA
Email legal@rodmena.co.uk wi yer company details an the service concerned. We will provide oor staundart DPA for signature, or review yer organisation's template. The executed agreement — no this summary — governs.