Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Forge Terms between Rok Enterprises Ltd, trading as Intelligent Operations, a company registered in England and Wales (company number 13757176) (“we”, “us”), and the business that holds a Forge subscription (“you”). It applies whenever we process personal data for you as your processor.

It is written to meet Article 28 of the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018. Terms such as “personal data”, “controller”, “processor”, “processing” and “data subject” have the meanings given in the UK GDPR.

1. Roles

• For personal data you store or process in your workspace, such as details of your staff, contractors, customers, site contacts and suppliers, you are the controller and we are your processor.
• For the personal data we hold about you as our customer (account, billing and support records), we are the controller, as described in our Privacy Policy.

2. Details of the processing

3. Our obligations as processor

We will:

• process your personal data only on your documented instructions, including about transfers outside the UK. Your instructions are the Forge Terms, this DPA and the actions you, your team and your connected AI assistants take in Forge, unless UK law requires otherwise, in which case we will tell you first where the law allows;
• make sure everyone we authorise to process your personal data is bound by confidentiality;
• apply the security measures in section 5;
• use sub-processors only under section 6;
• help you respond to requests from data subjects, by providing export and deletion tools and, where needed, direct help;
• help you meet your obligations on security, breach notification, data protection impact assessments and consultation with the ICO, taking into account the information available to us;
• delete or return your personal data at the end of the service under section 8;
• make available the information needed to show we comply with Article 28, and allow for audits under section 9; and
• tell you promptly if we believe one of your instructions breaks data protection law.

4. Your obligations as controller

You are responsible for the lawfulness of the personal data you put into Forge, for having a lawful basis for it, for giving data subjects the privacy information they are entitled to, for the instructions you and your AI assistants give, and for the people you give access to, share links with or collect data from through public forms.

AI assistants you connect are provided to you by their own providers under your own agreements with them. They are not our sub-processors, and data they receive through your connection is your responsibility.

5. Security

• Each workspace’s records are kept in a separate database, and access is checked on every request.
• All traffic is encrypted in transit using TLS. Passwords are stored hashed and connection tokens are stored encrypted.
• Backups are encrypted on our server before they are uploaded.
• Access to production systems is by SSH key only, with password login turned off, and limited to named Rok Enterprises Ltd personnel.
• Actions in each workspace are recorded against the person or AI assistant that took them, and security-sensitive actions are also written to a tamper-proof security record.
• Public share links are opt-in for each item and can be turned off at any time.

6. Sub-processors

You authorise us to use the following sub-processors:

Each sub-processor is engaged under a written contract that imposes data protection obligations equivalent to this DPA, in particular appropriate technical and organisational measures under Article 32. We remain liable to you for each sub-processor’s performance of those obligations, subject to the limits in section 15 of the Forge Terms.

We will give you at least 30 days’ notice of any new or replacement sub-processor by updating this page and emailing your workspace owner. You may object on reasonable data protection grounds before the change takes effect. If we can’t resolve your objection, you may cancel your subscription before the change applies and we will refund any payment for time after that date.

If you choose to keep your workspace files in your own Google Drive or Dropbox, that provider holds them under your own agreement with it. It is not our sub-processor.

7. International transfers

Your workspace data is hosted in the United Kingdom. A backup copy of stored files is kept in Germany, and our error-monitoring provider may process data in the USA. For each transfer outside the UK, we rely on the UK adequacy regulations (including the UK-US Data Bridge where the provider is certified) or the ICO’s International Data Transfer Addendum to the EU Standard Contractual Clauses, as set out in that sub-processor’s terms.

8. Deletion and return

You can export your workspace data at any time while you have access. When your access ends under the Forge Terms:

• for 30 days you can still read and export your data;
• 60 days after access ends, we delete your workspace’s database and files from our live systems, unless UK law requires us to keep any of it. We email your workspace owner 14 days before this happens;
• encrypted database backups that contain your data are deleted automatically within 35 days after that;
• encrypted backup copies of your files are removed by a clean-up process once nothing in Forge refers to them any more. This can take longer than 60 days after access ends, and earlier versions of files can stay in our encrypted backups until we remove them manually; and
• the security record, which holds details of security-sensitive actions but not your workspace content, is locked and kept for seven years.

We use backups only to recover Forge after a failure. We will not restore your deleted data for any other reason, and if a recovery brings back data that had already been deleted, we delete it again. On request, we will confirm deletion in writing.

9. Personal data breaches and audits

We will tell your workspace owner without undue delay, and except in exceptional circumstances within 48 hours, after becoming aware of a personal data breach affecting your data. We will give you the information you need to meet your own 72-hour obligation to report it to the ICO.

Once in any 12-month period, and additionally after a personal data breach affecting your data or where the ICO requires it, on 30 days’ written notice, you may audit our compliance with this DPA by written questions or, where that isn’t enough, by an on-site or remote inspection at your cost, carried out so that it doesn’t disrupt other customers.

10. General

This DPA is governed by the law of England and Wales. If it conflicts with any other Forge term about data protection, this DPA takes priority. We may update it to reflect changes in the law or in Forge. We will email workspace owners about significant changes, and the version and date at the top will change.

Contact

Rok Enterprises Ltd, trading as Intelligent Operations: ops@intelligentoperations.uk.