Data Processing Agreement
Summary of standard terms · Last updated: 19 July 2026
1. When a DPA applies
A DPA applies when RODMENA LIMITED acts as a processor — processing personal data on behalf of a customer (the controller) as part of a contracted service, for example operating or supporting a deployment of our software that holds your users' data. For our own website and business correspondence we act as a controller, covered by our Privacy Policy.
2. Standard commitments
Under our standard DPA, RODMENA commits to:
- Documented instructions: process personal data only on the controller's documented instructions
- Confidentiality: ensure everyone authorised to process the data is bound by confidentiality
- Security: apply appropriate technical and organisational measures (encryption in transit, least-privilege access, hardened infrastructure)
- Sub-processors: engage sub-processors only with authorisation, under equivalent obligations — our current list is on the Trust Centre
- Data-subject rights: assist the controller in responding to data-subject requests
- Breach notification: notify the controller without undue delay after becoming aware of a personal-data breach
- Assistance: support data-protection impact assessments and consultations with the ICO where required
- Deletion or return: at contract end, delete or return all personal data as the controller chooses, and certify deletion on request
- Audit: make available information necessary to demonstrate compliance, and allow and contribute to audits within reasonable notice and scope
3. International transfers
Processing takes place in the United Kingdom by default. Any transfer outside the UK happens only with appropriate safeguards (UK adequacy, the UK Addendum to the EU Standard Contractual Clauses, or the UK International Data Transfer Agreement) and is reflected in the sub-processor list.
4. Requesting and executing a DPA
Email enquiries@rodmena.co.uk with your company details and the service concerned. We will provide our standard DPA for signature, or review your organisation's template. The executed agreement — not this summary — governs.