Legal
Data processing addendum
A signed DPA is required before customer personal data is processed in a live pilot.
Roles and instructions
The customer acts as controller for campaign data and ROCKnWOOL acts as processor only on documented instructions, except where it acts independently by law.
Security and incidents
Technical and organizational measures include access controls, tenant scoping, audit events, private storage, provider verification, backups, and incident handling.
Subprocessors and deletion
Authorized subprocessors support service delivery. Contract-end return and deletion are handled under the signed DPA and applicable retention duties.