Data Processing Addendum

The processor is Atilade Oke, trading as Refinery, London, United Kingdom. The controller is the customer named in the written agreement. Refinery is installed in the customer’s environment and we do not host it, so we have no access to the code, evidence or account records it holds unless the customer shares them with us for support.

Subject matter and purpose:supporting the customer’s use of Refinery. Duration: the term of the agreement.

People:the customer’s staff who contact us or whose details appear in material the customer shares for support. Data: names, business contact details, account identifiers, and any personal data in logs or records the customer chooses to share.

We will process personal data only on the customer’s documented instructions; make sure anyone with access is bound by confidentiality; keep it secure with appropriate technical and organisational measures; help the customer respond to requests from individuals, security incidents and impact assessments; and, at the customer’s choice, delete or return it at the end of the agreement, unless the law requires us to keep it.

Our current sub-processor is Google LLC(United States), which provides the email inbox through which support correspondence arrives. We will give at least 30 days’ notice before adding or replacing a sub-processor, and the customer may object on reasonable data protection grounds. Services the customer connects to its own deployment, such as an AI model provider, are engaged by the customer under its own terms and are not our sub-processors.

Support email may be processed in the United States. That transfer relies on the UK Extension to the EU-US Data Privacy Framework where the provider is certified to it, or otherwise the UK International Data Transfer Addendum and the EU Standard Contractual Clauses.

We will tell the customer about a personal data breach affecting its data without undue delay, and within 48 hours of becoming aware of it, with the information the customer needs to meet its own reporting duties.

We will make available the information reasonably needed to show we comply with this addendum. The customer, or an auditor it appoints, may audit once a year on 30 days’ written notice, at the customer’s cost, and more often if a regulator requires it.

Questions about this addendum: okeatilade@gmail.com.