The paperwork, in plain language

For customer data you put into the platform, you are the controller (or processor for your own client) and ReDesk is the processor (or sub-processor). We process personal data only on your documented instructions, which include your configuration of the platform and your use of its features.

• Process only on your instructions, and tell you if an instruction appears to breach applicable law.
• Bind everyone with access to confidentiality obligations.
• Maintain the technical and organisational measures described in the Security annex.
• Assist you with data subject requests, impact assessments and regulator consultations.
• Notify you without undue delay, and in any case within 48 hours, of a personal data breach.
• Delete or return personal data at the end of the subscription, at your choice.

You give general authorisation for us to engage sub-processors. The current list is published and versioned. We give 30 days' notice before adding a new one, and you may object on reasonable data-protection grounds — if we cannot resolve the objection you may terminate the affected service without penalty.

Every sub-processor is bound by terms no less protective than this addendum.

We will make available the information needed to demonstrate compliance, including our current SOC 2 Type II report and penetration test summary under NDA. Enterprise customers may audit once per year with 30 days' notice, or more often if a regulator requires it.

Where the addendum requires a transfer mechanism, the EU Standard Contractual Clauses (module two or three, as applicable) and the UK Addendum are incorporated by reference, with India as the primary hosting location and Bengaluru courts as the forum where the clauses permit a choice.