Roles
The client is the controller (or “business”) of personal data contained in its systems. Ninjaz is the processor (or “service provider”) and processes that data only to deliver the Services described in the Client Agreement and on the client’s documented instructions.
Details of processing
| Element | Description |
|---|---|
| Subject matter | Designing, integrating, hosting, monitoring, supporting and operating the client’s business systems. |
| Duration | The term of the Client Agreement, plus the return and deletion period. |
| Data subjects | The client’s customers, prospects, employees, contractors and suppliers. |
| Data categories | Contact details, customer and vehicle or asset records, transaction, service and finance records, communications, user and audit logs. |
| Sensitive data | Not expected. Processed only if the client instructs it and appropriate safeguards are agreed in writing. |
Our commitments
- Process client data only on documented instructions and tell the client if we believe an instruction breaches law.
- Bind everyone with access to confidentiality, and limit access to those who need it.
- Maintain the technical and organisational measures described in our Security overview.
- Engage sub-processors only under written terms at least as protective, maintain a list of them, and give advance notice of changes with a right to object.
- Assist the client in responding to data subject requests, impact assessments and regulator enquiries.
- Notify the client without undue delay — and in any event within 48 hours — after becoming aware of a personal data breach, with the information needed to meet the client’s own obligations.
- Never sell client data, use it for our own purposes, or combine it with other clients’ data, except as Anonymized Data for service operation where permitted.
- Never use client data to train general-purpose AI models.
- At the end of the engagement, return client data in an agreed format and delete remaining copies within 30 days, unless retention is required by law.
- Make available the information needed to demonstrate compliance and allow reasonable audits, normally through our security documentation and questionnaires.
International transfers
Delivery runs across our team and our delivery operation in India. Transfers of personal data from the EEA, UK or Switzerland are made under the Standard Contractual Clauses (Module 2 or 3, as applicable) and the UK Addendum, incorporated into the DPA by reference, with supplementary measures. Clients may request regional data residency where the underlying systems support it.