Data Processing Agreement

Business customers often ask how R&C Recycling Pvt. Ltd. ("R&C", "we", "us") handles personal data when providing services. This page summarises the data-processing terms we offer. A countersigned Data Processing Agreement ("DPA") is available on request. Where a customer's own DPA has been executed with us, that agreement governs.

1. Roles of the parties

For personal data processed through our recycling services, the customer (the organisation engaging us) acts as the data fiduciary and R&C acts as the data processor, in each case as defined in the Digital Personal Data Protection Act, 2023 ("DPDP Act").

2. Scope of processing

• Purpose: scheduling and completing pickups, coordination with logistics partners, weighing, grading, documentation, invoicing, payment, and support.
• Duration: the term of the services, plus any period required by law for retention of records.
• Categories of personal data: names, business contact details, pickup site addresses, and identifiers of the customer's representatives and site contacts.
• Data subjects: employees, representatives, vendors, and site contacts of the customer.

3. Our obligations

• Process personal data only on the customer's documented instructions;
• Ensure that personnel authorised to process data are bound by confidentiality obligations;
• Apply reasonable technical and organisational safeguards, including encryption in transit, access controls, and vendor due diligence;
• Assist the customer in responding to data-subject requests, to the extent reasonably possible;
• Notify the customer without undue delay after becoming aware of a personal data breach; and
• On termination, return or delete personal data as instructed, subject to legal retention requirements.

4. Sub-processors

We use a limited set of sub-processors to deliver the services, such as:

• Form-delivery and communication providers;
• Cloud productivity and record-keeping providers; and
• Transport and logistics partners performing collections.

Sub-processors are bound by obligations no less protective than those in our DPA. We will keep customers informed of material changes and offer an opportunity to object.

5. Cross-border transfers

Personal data is primarily stored and processed in India. Where a sub-processor processes data outside India, we take contractual steps to ensure a comparable standard of protection and comply with any transfer restrictions notified under the DPDP Act.

6. Data-subject requests

If a data subject contacts R&C directly about personal data processed on a customer's behalf, we will refer the request to the customer and provide reasonable assistance, without responding to the request ourselves.

7. Liability and term

Liability under the DPA is subject to the limitations agreed in the main services contract. The DPA remains in force for as long as we process personal data on the customer's behalf and survives termination for the period needed to comply with retention obligations.

8. Request a signed DPA

R&C Recycling Pvt. Ltd.
9-A, Mohan Niwas Colony, Station Road, Kota, Rajasthan – 324001, India
Phone: +91 80009 47682