Data processing addendum

This addendum applies when you (the organiser) use AwardRocket to process personal data of entrants, judges, guests and website visitors.

Roles

You are the controller. AwardRocket Limited (or the trading entity named on your invoice) is the processor.

Instructions

We process that data only to provide the service, on your documented instructions, including these terms and the actions you take in the app.

Security

We use access control, encryption in transit, Row Level Security in the database, and least-privilege keys. The secret database key is never sent to the browser.

Sub-processors

We use the sub-processors listed on the sub-processors page. We will notify you of material changes.

International transfers

Where a sub-processor is outside the UK, we put an approved transfer tool in place.

Assistance

We will help you respond to data-subject requests and security incidents that affect your programme data, and we will delete or return that data when you close the account, except where law requires us to keep it.

Audits

On reasonable notice we will provide information reasonably needed to show we meet this addendum.