Legal
Data Processing Addendum
Last updated [TO CONFIRM]
This addendum applies where we process personal data on your behalf. In a self-hosted deployment that is often little or none, but procurement will still want this on file, and it should say so plainly rather than being silent.
01Roles
Where we process personal data on your instructions, you are the controller and we are the processor. Where Refinery is deployed entirely within your own environment and we have no access to it, we are not processing that data at all, and this addendum applies only to the limited support and account data described below.
02Subject matter and duration
Subject matter: provision of the Refinery verification software and associated support. Duration: the term of your agreement with us. Nature and purpose: operating, supporting and securing the service.
Categories of data subject: your personnel who hold Refinery accounts or who contact us for support. Categories of personal data: name, business contact details, account identifiers, authentication data, and the actor recorded against entries in the activity log. [TO CONFIRM: extend this list if you introduce a hosted deployment option.]
03Our obligations
We will process personal data only on your documented instructions; ensure personnel with access are bound by confidentiality; implement appropriate technical and organisational measures; assist you with data subject requests, security incidents and impact assessments; and, at your choice, delete or return personal data at the end of the engagement.
04Sub-processors
Our current sub-processors are [TO CONFIRM: name each one, its role, and its processing location]. We will give you notice before adding or replacing a sub-processor, and you may object on reasonable data-protection grounds. [TO CONFIRM: notice period.]
05International transfers
[TO CONFIRM: state whether any personal data leaves the UK/EEA and, if so, the transfer mechanism relied on: UK IDTA, the UK Addendum to the EU SCCs, or an adequacy decision.]
06Security incidents
We will notify you without undue delay after becoming aware of a personal data breach affecting your data, with the information you need to meet your own notification obligations. [TO CONFIRM: commit to a specific notification window.]
07Audit
We will make available the information reasonably necessary to demonstrate compliance with this addendum and will contribute to audits conducted by you or an auditor you appoint. [TO CONFIRM: frequency, notice, and who bears the cost.]