Data & Compliance Policy

Section 01

Roles: controller vs. processor

• Subscriber (Data Controller): Your organization determines the purpose and means of processing personal data uploaded to the Platform.
• RedRock (Data Processor): RedRock processes Subscriber Data solely on your instructions as defined in your subscription agreement and our Data Processing Agreement (DPA).

A Data Processing Agreement (DPA) is available upon request at info@redrock-cm.com and is incorporated by reference into the Master Subscription Agreement for all EEA/UK subscribers.

Section 02

Technical security measures

Section 03

Organizational security controls

• Employee access: Limited to those with a defined operational need, provisioned on a least-privilege basis.
• Background checks: Employment screening for all staff with access to production systems.
• Security training: Annual security awareness training for all staff.
• Incident response plan: Documented plan with defined escalation paths and notification timelines.
• Vendor management: All sub-processors undergo security review and are subject to contractual data protection obligations.

Section 04

Data breach notification

• RedRock will notify affected Subscribers within 72 hours of becoming aware of a breach involving EEA/UK personal data, as required by GDPR Article 33.
• Notification will include the nature of the breach, categories affected, likely consequences, and remediation measures taken.
• For US Subscribers, RedRock will comply with applicable state breach notification laws including the Texas Identity Theft Enforcement and Protection Act.
• Subscribers are responsible for downstream notifications to affected individuals as data controllers.

Section 05

Data lifecycle and retention

• Active subscription: Subscriber Data retained for the full Subscription Term.
• Post-termination export window: 30 days to export all Subscriber Data via built-in export tools.
• Deletion: After 90 days post-termination, RedRock deletes Subscriber Data from active systems. Backup copies purge on normal rotation.
• Deletion certification: Enterprise subscribers may request written confirmation of deletion.
• Legal holds: Data retained beyond standard periods only where required by applicable law.

Section 06

Cross-border data transfers

• Standard Contractual Clauses (SCCs) — Module 2 — incorporated into the DPA for all EEA Subscribers.
• UK International Data Transfer Agreements (IDTAs) available for UK Subscribers.
• Transfer Impact Assessments (TIAs) conducted for all sub-processors processing EEA/UK personal data outside the EEA.

Section 07

Sub-processor management

RedRock maintains a current sub-processor list available at redrock-cm.com/subprocessors. Material changes are communicated with at least 30 days' notice. Subscribers with GDPR DPAs may object within the notice period; failure to object constitutes acceptance.

Section 08

Regulatory compliance posture

Section 09

Data subject rights fulfillment

• In-platform data export tools enabling Subscribers to retrieve Subscriber Data on behalf of data subjects.
• Account deletion workflows allowing Subscribers to remove Authorized User records.
• Rectification support via Subscriber administrative controls.
• Direct DSR escalation: info@redrock-cm.com for situations requiring RedRock's direct involvement.