Data Processing Addendum

The client is usually the controller and RK TECH LTD is usually the processor for client personal data processed to deliver agreed services. If the parties act as independent controllers for a specific activity, that activity should be described in the project agreement.

RK TECH LTD will process client personal data only on documented instructions from the client, including instructions contained in the project agreement, statement of work, support ticket, or authorised project communication, unless required by law.

RK TECH LTD will ensure that people authorised to process client personal data are subject to confidentiality obligations. We will use appropriate technical and organisational measures considering the nature of the project, such as access controls, encrypted transport, least-privilege access, secure credential handling, and reasonable development environment controls.

RK TECH LTD may use sub-processors needed for delivery, hosting, collaboration, diagnostics, communication, and development operations. The project agreement may list project-specific sub-processors. RK TECH LTD remains responsible for sub-processor performance of data protection obligations.

Where client personal data is transferred outside the UK or EEA, RK TECH LTD will use an applicable transfer mechanism such as adequacy regulations, EU Standard Contractual Clauses, the UK International Data Transfer Agreement, or the UK Addendum to EU Standard Contractual Clauses.

Taking into account the nature of processing and information available, RK TECH LTD will reasonably assist the client with data subject requests, security obligations, breach assessment, data protection impact assessments, and regulator consultation where required by applicable data protection law.

RK TECH LTD will notify the client without undue delay after becoming aware of a personal data breach affecting client personal data and will provide information reasonably available to help the client meet its legal obligations.

At the end of services, RK TECH LTD will delete or return client personal data in line with the project agreement, unless retention is required by law or legitimate record-keeping obligations. Backup deletion may follow ordinary backup cycles.

RK TECH LTD will make information reasonably necessary to demonstrate compliance available to the client and allow reasonable audits or inspections under agreed confidentiality, security, timing, and scope controls.