Compliance — GDPR & UK GDPR

For the content you put in your workspaces, you are the controller and RowFold is the processor. For your own account and our marketing site, we are the controller. The Privacy Policy covers lawful bases, retention, and how to exercise access, correction, deletion and portability rights — all of which are self-service in the product under Settings. The Article 28 terms themselves — our instructions, subprocessor authorisation, breach notification, transfer mechanism and security measures — are published in full as our Data Processing Agreement. It is incorporated into the Terms of Service and applies automatically; there is nothing to request or sign, though we will provide a countersigned copy if your procurement process needs one. Two limits worth stating up front: RowFold is operated from the United States, so using it involves an international transfer for EU and UK customers; and we do not currently offer EU data residency. If your assessment requires data to stay in the EEA, that is not something we can accommodate today.