Data processing — Audits & information

We will make available the information reasonably necessary to demonstrate compliance with Article 28 and allow for and contribute to audits. In practice that means documentation and questions rather than a report, because there is no audit report to hand you — see section 06. Send a security questionnaire to security@rowfold.com and we will complete it; the answers will be self-attested and will say "no" where the answer is no. Where that is genuinely insufficient for your regulator, you may audit us on 30 days' written notice, no more than once in any 12 months (unless required more often by a Supervisory Authority or following a Personal Data Breach), during business hours, without unreasonable disruption, subject to confidentiality, and at your own cost.