Data processing agreement.

For employee records supplied by an employer — names, employee numbers, departments, cost centers, home cities and shift patterns — the employer is the controller and Rydlnk is the processor.

For a rider's own account — their phone number, ID, personal trips and personal balance — Rydlnk is the controller. An employer never becomes a controller of that data by funding a seat.

Employee identifier, department and cost center, to attribute a seat to the right budget line. Home city or pickup point, to cluster people into corridors. Shift start and end, to schedule runs. Employment status, so a leaver's wallet freezes.

We do not process employee data for any purpose the employer has not instructed, and we do not use it to train models or to market to your staff.

Cloud hosting, SMS and text message delivery, and payment processing. A current list is available on request and we give notice before adding one, so you have the chance to object.

Authorization is scoped per seat at the query layer rather than in the interface, which is what keeps one employer from reading another's staff on a pooled trip. ID documents are encrypted at rest. Access to production data is limited, logged and reviewed.

We notify the employer without undue delay and in any case within 72 hours of becoming aware of a personal data breach affecting their employees, with what we know at the time and what we're doing about it.

Employee records are deleted or anonymized within 90 days of the end of the agreement, except trip and ledger entries retained for the period US tax and tax reporting rules require — those back the benefit records already issued and cannot be removed earlier.

We'll respond to reasonable audit requests, and assist with data subject requests your employees make to you — access, correction and deletion — within the statutory window.

Data protection queries: work@rydlnk.us