RHIXO

RHIXO Data Processing Addendum

Business-customer data processing and subprocessor terms.

This document forms part of the RHIXO controlled legal framework and applies as described below. It operates together with the RHIXO Customer Agreement, RHIXO Product and Service Schedule, accepted order and other incorporated documents where relevant.

1. Definitions

Customer Personal Data means personal information contained in Customer Data that the Service Provider processes to provide the Service. Applicable Privacy Law means privacy/data-protection law that applies to the relevant processing.

2. Roles and instructions

Each party will comply with obligations that apply to it. Where the Service Provider acts as processor/service provider for Customer Personal Data, it will process that data on documented customer instructions expressed through the Agreement, Product Schedule, product configuration and lawful support requests, except where law requires otherwise.

3. Customer obligations

The Customer is responsible for the lawfulness of its instructions, notices, consents, collection and use of Customer Personal Data; configuring access appropriately; and not instructing processing that would cause the Service Provider to breach applicable law.

4. Confidentiality and personnel

People authorised to process Customer Personal Data must be subject to appropriate confidentiality duties and access controls. Access will be limited according to role and business need.

5. Security

The Service Provider will maintain reasonable technical and organisational measures appropriate to the nature of the Service and risk. Security controls may evolve provided overall protection is not materially reduced without a valid operational reason.

6. Subprocessors

The Customer authorises use of subprocessors necessary to provide the Service. The Service Provider will require subprocessors to protect Customer Personal Data consistently with applicable obligations. A current subprocessor register will identify material subprocessors. Where applicable law requires notice or objection rights, those rights will be provided through the register or customer communications.

7. International transfers

Where Customer Personal Data is transferred internationally, the parties will use transfer mechanisms and safeguards required by applicable law. The Customer acknowledges that cloud, communications and support providers may operate globally as disclosed in the Privacy Policy or subprocessor register.

8. Assistance with requests

Taking into account the nature of processing and available functionality, the Service Provider will provide reasonable assistance with access, correction, deletion or other legally applicable data-subject requests. The Customer remains responsible for deciding how to respond where it controls the relevant data.

9. Security incidents

The Service Provider will investigate confirmed unauthorised access to or disclosure of Customer Personal Data and will notify the Customer without undue delay where required by law or where notification is reasonably necessary for the Customer to meet its obligations. Notices may be updated as facts become available and do not constitute an admission of fault.

10. Return, export and deletion

During the term, export functionality is provided as described in the Product Schedule. Following termination, Customer Personal Data will be deleted or de-identified according to the applicable retention schedule, subject to backups, legal holds, security records and other lawful retention.

11. Audit and assurance

On reasonable request and subject to confidentiality and security restrictions, we may provide available security, compliance or audit information relevant to the Service. On-site or intrusive audits are only required where mandated by law or where existing assurance is insufficient and the parties agree reasonable scope, timing and cost allocation.

12. Government and legal requests

Where legally permitted, the Service Provider will seek to redirect a request for Customer Personal Data to the Customer or notify the Customer before disclosure. We may disclose data where legally compelled.

13. Liability and precedence

Liability under this DPA is subject to the Customer Agreement except where applicable law requires otherwise. For personal-data processing matters, this DPA prevails over inconsistent general terms.