1.Scope and roles
This Data Processing Addendum (“DPA”) forms part of the Terms of Service between SiddiTek LLC (“Renameproof”) and the business customer that accepts them (“Customer”). It applies when Renameproof processes personal data on Customer’s behalf while providing the Service (“Customer Personal Data”).
For Customer Personal Data, Customer is the controller and Renameproof is the processor. Renameproof is an independent controller for data it processes for its own purposes, such as account security and billing, as described in the Privacy Policy.
Words such as “personal data”, “processing”, “controller”, “processor” and “supervisory authority” have the meanings given in applicable data protection law, including the GDPR and UK GDPR.
2.Processing on instructions
Renameproof processes Customer Personal Data only to provide the Service and on Customer’s documented instructions, which are the Terms, this DPA and Customer’s use of the Service’s features. If Renameproof believes an instruction breaks data protection law, it will tell Customer. Renameproof will process data otherwise only where the law requires it, and will tell Customer first unless the law forbids that.
3.Confidentiality
Renameproof ensures that anyone authorised to process Customer Personal Data is bound by confidentiality and has access only where needed for their role.
4.Security
Renameproof maintains appropriate technical and organisational measures to protect Customer Personal Data, taking into account the state of the art, cost and the risks involved. A summary is in Annex 2. Renameproof may update these measures as long as overall protection is not reduced.
5.Sub-processors
Customer gives general authorisation for Renameproof to use sub-processors. The categories are listed in Annex 3, and a current list of sub-processors is available to Customer on request at support@renameproof.com.
Renameproof will give notice before adding or replacing a sub-processor. Customer may object on reasonable data protection grounds within 30 days; if the parties can’t resolve the objection, Customer may end the affected Service. Renameproof imposes data protection terms on each sub-processor that are no less protective than this DPA and remains responsible for their performance.
6.Assistance
Taking into account the nature of the processing, Renameproof will help Customer respond to requests from individuals exercising their rights, and with security, breach notification, data protection impact assessments and consultations with supervisory authorities. If Renameproof receives a request directly, it will refer the individual to Customer.
7.Personal data breaches
Renameproof will notify Customer without undue delay, and where feasible within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will include the information Customer reasonably needs to meet its own obligations, as it becomes available, and Renameproof will take reasonable steps to contain and remedy the breach.
8.International transfers
Where Customer Personal Data is transferred outside the UK or the European Economic Area to a country without an adequacy decision, the parties rely on the European Commission’s Standard Contractual Clauses (Module 2 or 3, as applicable) and, for UK data, the UK International Data Transfer Addendum, which are incorporated by reference.
9.Information and audits
Renameproof will make available the information reasonably needed to demonstrate compliance with this DPA. Where that information isn’t enough, Customer may carry out an audit, at most once a year unless required by a supervisory authority or after a breach, on at least 30 days’ notice, during business hours, at Customer’s cost, and subject to confidentiality terms that protect Renameproof’s systems and other customers.
10.Deletion and return
When the Service ends, Renameproof will delete Customer Personal Data, or return it if Customer asks within 30 days, unless the law requires it to be kept. Customer can also export and delete account data at any time from the account page.
11.General
Liability under this DPA is subject to the limits in the Terms. If this DPA conflicts with the Terms, this DPA prevails for the processing of Customer Personal Data. This DPA is governed by the same law as the Terms, the Commonwealth of Virginia, USA, except where the Standard Contractual Clauses require otherwise.
12.Annex 1: Details of processing
- Subject matter and purpose
- Providing the Service: running name checks, generating and storing reports, suggesting names and keeping saved items.
- Duration
- For the term of the Service, then until deletion under section 10.
- Nature of processing
- Collection, storage, retrieval, analysis to produce reports and summaries, and deletion.
- Categories of data subjects
- Customer’s authorised users, and any individuals Customer chooses to name or describe in the content it submits.
- Categories of personal data
- Account contact details such as email addresses; content submitted to the Service, such as names and product descriptions; usage records needed for security.
- Special categories
- None intended. Customer should not submit them.
13.Annex 2: Security measures
- Encryption of data in transit.
- Passwords stored only as salted one-way hashes; session tokens stored only as hashes.
- Access to production systems limited to authorised personnel, on a least-privilege basis.
- Rate limiting and monitoring to detect and slow down abuse.
- Separation of customer data at the application level.
- Regular backups and a process for restoring service after incidents.
- Vendor review before engaging sub-processors.
14.Annex 3: Sub-processor categories
- Cloud hosting and storage
- Runs the Service and stores account data and reports.
- AI model provider
- Generates name ideas and summaries when AI features are used.
- Email delivery
- Sends account and service emails, where used.
Names and locations of current sub-processors are available on request at support@renameproof.com.