Agreements
Data Processing Terms
How we handle personal information in your business data on your behalf (DPA).
1. Roles
When your business data includes personal information — your Users, employees, customers, suppliers and contacts — you decide why and how it is processed, and RPMCODE processes it for you. In the language of the laws, you are the "controller" (GDPR and UK GDPR), "responsible party" (South Africa's POPIA) or "business" (California's CCPA); RPMCODE is your "processor", "operator" or "service provider".
For the information we collect about you as our customer (accounts, billing, support), RPMCODE decides, and the Privacy Statement applies instead.
These terms form part of the Terms and Conditions, and apply as Article 28 of the GDPR, sections 20 and 21 of POPIA and the equivalent provisions of other laws require.
2. What is processed
| Subject matter | Hosting and operating RPM for you. |
|---|---|
| Duration | While the agreement lasts, and until deletion afterwards (see section 10). |
| Nature and purpose | Storing, retrieving, organising, calculating, reporting, exporting and displaying records; sending account emails (codes, invites, notices); securing and backing up the service. |
| Kinds of personal information | Whatever you enter. Typically names, job titles, email and postal addresses, phone numbers, tax and registration numbers, bank details, order, invoice and payment history, messages, and records of who changed what. |
| People concerned | Your Users, employees, customers, suppliers, contacts and anyone else whose information you enter. |
3. Our commitments
- We process the information only on your documented instructions — these Terms and the way you use and configure RPM — unless the law requires otherwise, in which case we tell you first unless the law forbids it.
- Everyone at RPMCODE who can access it is bound to confidentiality.
- We protect it with the measures in Cybersecurity Statement and Disclaimer.
- We help you respond to people exercising their rights. RPM lets you find, correct, export and delete records yourself; if someone asks us directly, we pass the request to you.
- We help you with security, breach notification, impact assessments and consultations with regulators, as far as our role allows.
- We do not sell it, share it for advertising, or use it for any purpose of our own. We do not combine it with other information, except as the law permits a service provider to.
4. Sub-processors
You authorise us to use the following sub-processors. Each is bound to protect the information to the standard of these terms.
| Sub-processor | What for | What it receives |
|---|---|---|
| Provided on request (support@rpmcode.com) | Infrastructure that runs the shared server | Encrypted storage holding all Customer Data |
| Provided on request (support@rpmcode.com) | Delivering account emails | Recipient address, and the email (codes, invites, notices) |
| Provided on request (support@rpmcode.com) | Shared intelligence about attacks on the service | Internet addresses that attacked the service, and the kind of attack — never Customer Data |
We will tell you by email at least 14 days before adding or replacing a sub-processor that receives Customer Data. If you object on reasonable data protection grounds and we cannot address the objection, you may end the agreement and we will refund Fees paid in advance for the time after it ends.
5. Personal information breaches
If we become aware of a breach of security affecting your personal information, we will tell you without undue delay, with what we know and what we are doing, and keep you updated. This lets you meet your own obligations to notify regulators and people affected, such as within 72 hours under the GDPR.
6. Transfers between countries
Customer Data is stored on a server whose location is given in Company Details and Legal Notice. Where information leaves the country it is held in — for example to a sub-processor — we make sure it stays protected as the law requires: by the European Commission's Standard Contractual Clauses (which are incorporated into these terms by reference where needed, with you as exporter and us as importer), the UK's International Data Transfer Addendum, a binding agreement under section 72 of POPIA, or reasonable steps under Australian Privacy Principle 8.
7. Audits
We will give you the information you reasonably need to check that we keep these terms, including answers to security questionnaires. If that is not enough, you may audit us once a year, on 30 days' notice, during business hours, at your cost, under confidentiality, and without access to other customers' information.
8. Your obligations
You confirm you have a lawful basis, and have given any notice or obtained any consent required, for the personal information you put into RPM, and that your instructions comply with the law.
9. Liability
The limits in the Terms and Conditions apply to these terms too, so far as the law allows.
10. At the end
When the agreement ends you have 30 days to export your data or ask us for an export. We then delete it from the live system; backups containing it expire within the periods in Data Retention, Backup and Deletion. Where the law requires us to keep something, we keep only that, protect it, and delete it when the requirement ends.