Data Processing Agreement

1. Scope

This Data Processing Agreement applies where a user or processor ("Processor") processes personal data on behalf of R&R Digital Platform Solutions Ltd. ("Controller") in connection with the platform, or where we process data as a processor for you.

2. Roles

Each party acts as an independent controller for its own data; where we process data on your documented instructions, we act as a processor.

3. Instructions & purposes

The Processor processes personal data only on documented instructions from the Controller and for the agreed purposes, never for its own unrelated purposes unless independently permitted.

4. Confidentiality & security

The Processor ensures confidentiality (personnel bound by confidentiality) and implements appropriate technical and organisational measures per Art.32 GDPR to protect data against loss, unauthorised access, and breach.

5. Sub-processors

The Processor may engage sub-processors only with the Controller's authorisation and under written terms imposing the same obligations. A current list of sub-processors is available on request.

6. Data-subject rights & assistance

The Processor assists the Controller in responding to data-subject requests (access, rectification, erasure, etc.) and in complying with its obligations.

7. Breach notification

The Processor notifies the Controller without undue delay of any personal-data breach that risks the rights and freedoms of individuals, so the Controller can notify authorities and affected persons as required.

8. International transfers

Where data is transferred outside the EEA/UK, the Processor applies appropriate safeguards, including Standard Contractual Clauses, and records any sub-processor transfers.

9. Deletion & return

On termination, the Processor returns or securely deletes personal data at the Controller's choice, unless law requires retention.

10. Audits

The Processor allows the Controller to audit compliance, subject to reasonable notice and confidentiality.

11. Liabilities & duration

Each party is liable for its own processing obligations. This DPA survives termination of the underlying agreement while data is processed.

Last updated: August 2026. Operated by R&R Digital Platform Solutions Ltd.