IDRune

1. Subject Matter & Duration

We process personal data on your behalf for as long as your account remains active and you have published at least one live product, and for any additional period required to fulfil our data-retention obligations under Section 6 of our Privacy Policy after account closure.

2. Nature & Purpose of Processing

We host and administer product registration, warranty status, consent records, and feedback submissions on your behalf, and calculate (but do not send) recall/safety-notice reach against that data, so that you can operate the consumer-facing features of the Service for your own products.

3. Types of Personal Data & Categories of Data Subjects

Types of data: email address, optionally name and phone number, product/serial/purchase information, consent choices, and any free-text feedback submitted. Categories of data subjects: the end consumers who purchase and register your products, or who submit feedback through a public product page.

4. Controller Instructions & Processor Obligations

We will process personal data only on your documented instructions (as reflected in your use of the Service's own features), unless required to do otherwise by law, in which case we will inform you unless legally prohibited from doing so. We will ensure our personnel are subject to confidentiality obligations, and will assist you in responding to data-subject requests and in meeting your own obligations under Articles 32–36 of the UK/EU GDPR, to the extent this is within our control as processor.

5. Sub-Processors

You grant us general written authorization to engage the sub-processors listed at idrune.com/subprocessors, which forms part of this DPA by reference. We will give at least 30 days' notice (via that page and, for material additions, direct email) before engaging a new sub-processor with access to end-consumer personal data, during which you may object on reasonable data-protection grounds.

6. Security Measures

We maintain the technical and organizational measures described in Section 8 of our Privacy Policy, including encrypted transport, hashed credentials, and application-level tenant isolation. We disclose, rather than imply otherwise, that formal third-party security certification (e.g. ISO 27001) and penetration testing have not yet been completed as of this DPA's last-updated date; a current security questionnaire is available on request.

7. International Transfers

The Service's shared database is hosted in the United Kingdom. Some sub-processors listed at idrune.com/subprocessors process data outside the UK/EEA (currently: the United States, for our AI-assist and primary email-delivery providers). Each such transfer relies on that sub-processor's own Standard Contractual Clauses or equivalent UK-recognized transfer mechanism, as disclosed on that page.

8. Deletion or Return of Data

On termination of the Service, we will delete or return end-consumer personal data we hold on your behalf within a reasonable period, except to the extent we are required by law to retain it, consistent with our published retention practices.

9. Audit Rights

We will make available the information reasonably necessary to demonstrate compliance with this DPA, including our current security questionnaire, and will allow for and contribute to audits conducted by you or an auditor you mandate, subject to reasonable notice and confidentiality.

10. Contact Information

Build Actions Ltd, trading as IDRUNE Origin (part of the IDRUNE product family)
Company number: 13333702
Registered office: Unit Da2 Sutherland House, 43 Sutherland Road, London, United Kingdom, E17 6BU
Data protection inquiries: [email protected]

IDRUNE Origin Data Processing Agreement