1. Scope & Roles
This Data Processing Addendum (“DPA”) forms part of the Terms of Service between RIR LLC (“Processor”) and the customer (“Controller”) and applies where RIR LLC processes Personal Data contained in Customer Data on the Controller’s behalf. Where there is a conflict on data-protection matters, this DPA controls.
2. Definitions
“Applicable Data Protection Laws” means privacy and data-protection laws applicable to the processing, which may include the GDPR, UK GDPR, and U.S. state privacy laws. “Personal Data,” “Controller,” “Processor,” “Data Subject,” and “process” have the meanings given in Applicable Data Protection Laws.
3. Processing of Personal Data
The Processor will process Personal Data only: (a) to provide the Service per the Terms; (b) in accordance with the Controller’s documented lawful instructions; and (c) as required by law (with notice where permitted). The subject matter, duration, nature, and purpose of processing, the types of Personal Data, and categories of Data Subjects are described in an annex or as configured by the Controller within the Service.
4. Processor Obligations
- process Personal Data only on documented instructions;
- ensure persons authorized to process are bound by confidentiality;
- implement appropriate technical and organizational security measures (Section 7);
- assist the Controller, taking into account the nature of processing, with data-subject requests and with security, breach notification, and impact assessments;
- make available information reasonably necessary to demonstrate compliance.
5. Controller Obligations
The Controller is responsible for the accuracy and legality of Customer Data, for having a lawful basis for the processing, and for providing required notices and obtaining required consents from Data Subjects.
6. Subprocessors
The Controller authorizes the Processor to engage subprocessors to provide the Service. Current subprocessors include those listed in our Privacy Policy (for example, Stripe, Cloudflare, and our email and hosting providers). The Processor will impose data-protection obligations on subprocessors substantially similar to those in this DPA and remains responsible for their performance. We will provide notice of new subprocessors and a reasonable opportunity to object.
7. Security Measures
The Processor maintains technical and organizational measures appropriate to the risk, including: encryption of data in transit; hashed credential storage; role-based access controls; network protections; logging and audit trails; and regular review of security practices. Specific measures may be detailed in a Security Annex available on request.
8. Personal Data Breach
The Processor will notify the Controller without undue delay after becoming aware of a Personal Data Breach affecting Customer Data, and will provide information reasonably available to assist the Controller in meeting its notification obligations.
9. Data Subject Requests
Taking into account the nature of the processing, the Processor will assist the Controller by appropriate technical and organizational measures, insofar as possible, to respond to requests from Data Subjects exercising their rights. If a request is made directly to the Processor, it will, where lawful, direct the Data Subject to the Controller.
10. International Transfers
Where processing involves transfer of Personal Data across borders, the parties will rely on a lawful transfer mechanism, such as the EU Standard Contractual Clauses and UK Addendum, which are incorporated by reference where applicable.
11. Return & Deletion
Upon termination, the Processor will, at the Controller’s choice, delete or return Customer Data, and delete existing copies except where retention is required by law. Export is available for 30 days after termination; thereafter data is deleted in the ordinary course, subject to rolling backups.
12. Audits
The Processor will make available information reasonably necessary to demonstrate compliance and allow for audits, subject to reasonable confidentiality, scope, frequency, and notice requirements as further described in this Section.
13. Liability
Each party’s liability under this DPA is subject to the limitations and exclusions of liability set out in the Terms.
14. Contact
Data-protection inquiries: [email protected]
RIR LLC — 1750 14th Street, Orange City, FL 32763