rena
Home Page
  • About Rena
  • ATS
  • Advanced interviewer
  • Intelligent AI Screening
  • Automated Two-Way Interviews
  • 24/7 Hiring Process
  • HRIS
  • Interview Scheduling
  • Candidate Messaging
  • AI Hiring Assistant
AboutBook a call

Solutions

About RenaATSAdvanced interviewer

FEATURES

Intelligent AI ScreeningAutomated Two-Way Interviews24/7 Hiring ProcessHRIS

Company

About Us

Legal

Privacy Policy
Rena advanced interviewer

Copyright © 2026 Rena AI

ISO Certification Logo

ISO/IEC 27001

Information Security Management System (ISMS)

View Certificate

Rena Legal Hub

All of Rena’s legal policies and documents are available below. Here you will find our Privacy Policy, Terms of Service, Cookie Policy, and other key legal information, designed to give you clear guidance on how we operate and safeguard your data.

Policies 3

  • Data Processing Addendum
  • Privacy Policy
  • Acceptable Use Policy

Data Processing Addendum

Last Updated:04 September 2025
Effective Date:04 September 2025

This Data Processing Addendum ("DPA") forms part of the Terms of Service between Capital Placement Ltd trading as Rena ("Processor" or "Rena") and the Customer identified in the Order Form ("Controller" or "Customer").

1. Definitions and Interpretation

The terms "Personal Data", "Controller", "Processor", "Processing", "Special Category Data", and "Personal Data Breach" shall have the meanings given in Applicable Data Protection Law.

"Applicable Data Protection Law" means all laws and regulations relating to the processing of Personal Data applicable to a Party's performance under this DPA, including where applicable:

  • The UK GDPR and UK Data Protection Act 2018
  • The EU GDPR (Regulation 2016/679)
  • The Personal Data Protection Act 2012 of Singapore
  • The Personal Data Protection Act No. 9 of 2022 of Sri Lanka
  • The Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data of the United Arab Emirates
  • Any other applicable national data protection laws

Where specific jurisdictional variations or clarifications apply, these are set out in Schedule 4 (Jurisdiction-Specific Terms).

"Customer Personal Data" means Personal Data that Customer uploads to or collects through the Services, including Candidate Data.

All other capitalised terms not defined herein shall have the meanings given in the Principal Agreement.

2. Scope and Roles

The Parties acknowledge that with regard to the Processing of Customer Personal Data, Customer is the Controller and Rena is the Processor.

Customer shall:

  • Ensure that its instructions for the Processing of Customer Personal Data comply with Applicable Data Protection Law
  • Ensure it has all necessary lawful bases and has obtained all consents and authorisations necessary for the Processing of Customer Personal Data
  • Ensure the accuracy of all Customer Personal Data and any Processing instructions
  • Be solely responsible for determining the lawfulness of Processing including for Special Category Data
  • Inform Rena if Processing instructions infringe Applicable Data Protection Law

3. Processing Obligations

Rena shall Process Customer Personal Data only on Customer's documented instructions as set out in this DPA, the Principal Agreement, via the Services' features, or as otherwise agreed in writing, unless required by law to Process Customer Personal Data otherwise, in which case Rena shall inform Customer unless legally prohibited.

Rena shall:

  • Ensure that personnel Processing Customer Personal Data are subject to appropriate confidentiality obligations
  • Ensure personnel receive appropriate training on data protection
  • Process Customer Personal Data only as necessary to provide the Services
  • Not sell Customer Personal Data or Process it for Rena's own purposes or any purposes other than providing the Services

4. Security Measures

Rena shall implement and maintain appropriate technical and organisational measures to protect Customer Personal Data against unauthorised access, use, disclosure, alteration, or destruction.

Rena maintains ISO/IEC 27001:2022 certification for its information security management system and shall maintain such certification or equivalent industry standard throughout the term of the Principal Agreement.

Rena reserves the right to update or modify its security measures from time to time provided that such updates do not materially decrease the overall protection of Customer Personal Data, and will maintain industry‑standard security practices appropriate to the nature of the Services.

5. Sub‑processors

Customer generally authorises Rena to engage Sub‑processors to Process Customer Personal Data, subject to appropriate safeguards. The Sub‑processors currently engaged by Rena are listed in Schedule 3, and Customer consents to the use of these Sub‑processors.

Rena shall:

  • Enter into written agreements with Sub‑processors imposing data protection obligations materially similar to those in this DPA
  • Ensure all critical Sub‑processors maintain appropriate certifications (SOC 2, ISO 27001, or equivalent) and demonstrate GDPR compliance
  • Apply ISO 27001 standards for Sub‑processor selection, monitoring, and management
  • Perform appropriate due diligence before engaging any Sub‑processor including security assessment and certification verification
  • Remain fully liable for Sub‑processors' performance

Changes to Sub‑processors

Changes to Sub‑processors may be made by Rena providing Customer reasonable advance notice, typically fourteen days, via email to Customer's administrators or through the Services.

  • For immaterial changes such as corporate rebranding or intra‑group reorganisations, updates may be made with shorter notice
  • Emergency replacements necessary for security, legal compliance, or service continuity may be made immediately with subsequent notice

Customer may object to material Sub‑processor changes on reasonable data protection grounds within seven days of notice. If Rena cannot reasonably accommodate the objection, Customer may terminate the affected Services as its sole remedy with a pro‑rata refund for any prepaid fees.

6. Data Subject Rights

Where technically feasible and commercially reasonable, Rena shall assist Customer in responding to Data Subject requests through the Services' built‑in features and standard export functionality.

Where Rena receives a request directly from a Data Subject, it shall promptly forward it to Customer unless legally prohibited.

Additional assistance beyond standard features may be subject to Rena's professional services rates.

Rena shall provide Customer the ability to export Customer Personal Data in a structured, commonly used, and machine‑readable format via the Services' standard export features.

7. Security Incidents and Breaches

Rena shall notify Customer without undue delay and in any event within seventy‑two hours after becoming aware of a Personal Data Breach affecting Customer Personal Data.

Such notification shall include available information about:

  • The nature, scope, and potential impact of the breach

Rena shall:

  • Cooperate with Customer and take reasonable commercial steps to assist in the investigation, mitigation, and remediation of any Personal Data Breach
  • Maintain records of all Security Incidents and provide reports to Customer upon reasonable request

8. Compliance Assistance

Upon Customer's reasonable request and where technically feasible, Rena shall provide assistance with data protection impact assessments and supervisory authority consultations through:

  • Providing relevant security documentation
  • Completing reasonable questionnaires with limited frequency
  • Making available information about the Services' data protection features

Such assistance shall be provided at Rena's then‑current professional services rates unless included in Customer's subscription plan.

9. International Data Transfers

Customer acknowledges that Rena Processes Customer Personal Data in the following locations:

  • United Kingdom
  • Sweden
  • United Arab Emirates
  • For certain AI processing operations, the United States

For customers requiring data residency in Saudi Arabia, dedicated infrastructure is available subject to enterprise agreements.

Safeguards for International Transfers

Where Customer Personal Data is transferred internationally, appropriate safeguards apply:

For UK and EEA originating data:

  • UK International Data Transfer Agreement (UK IDTA) or UK Addendum to EU SCCs for UK data
  • EU Standard Contractual Clauses Module 2 for EEA data
  • Incorporated herein by reference where applicable

For all international transfers:

  • Encryption in transit using TLS 1.2 or higher and at rest using AES‑256
  • Access controls and authentication measures
  • Security measures as described in Schedule 2
  • Compliance with applicable local data protection laws

Rena has conducted transfer risk assessments and implemented appropriate supplementary measures. Customer acknowledges these assessments and agrees that the safeguards are appropriate for their data transfers.

Enterprise customers may request specific data residency arrangements subject to additional fees and technical feasibility.

10. Audit Rights

Customer may verify Rena's compliance with this DPA through reviewing Rena's ISO 27001 certificate, which demonstrates comprehensive security controls and regular independent auditing. Rena will provide its current ISO 27001 certificate upon reasonable request and may also provide executive summaries of recent penetration testing or other security assessments where available.

Additional Assurance

For customers requiring additional assurance, Rena will complete reasonable security questionnaires, limited to once per year unless following a Security Incident. Responses may reference existing documentation where appropriate to avoid duplicative efforts.

Enterprise Audit Provisions

Enterprise customers with specific contractual audit provisions may arrange additional review procedures as agreed in their Order Form. Any such reviews shall be subject to:

  • Reasonable advance notice
  • Execution of Rena's confidentiality agreement
  • Reasonable cost reimbursement for extensive time requirements
  • Shall not unreasonably interfere with Rena's operations or compromise the security or confidentiality of other customers' data

Cloud Infrastructure

Customer acknowledges that as Rena utilises managed cloud infrastructure from Azure and Google Cloud, physical data centre inspections are neither applicable nor necessary. The cloud providers' certifications including SOC 2, ISO 27001, and other industry standards provide appropriate infrastructure assurance, and Rena's ISO 27001 certification covers the application layer controls.

11. Data Return and Deletion

Customer may export Customer Personal Data at any time during the term via the Services' export features.

Following termination of the Principal Agreement:

  • Rena shall provide a sixty‑day period for Customer to export Customer Personal Data
  • After such period, Rena shall delete Customer Personal Data from active systems and backups on their standard rotation schedule
  • Rena may retain Customer Personal Data as required by law, subject to continuing confidentiality
  • Upon request, Rena shall provide written certification of deletion

12. Special Category Data

Where Customer uploads Special Category Data as defined in UK GDPR Article 9, Customer warrants that:

  • It has a valid lawful basis under Article 6 and meets a condition under Article 9 of UK GDPR
  • Such Processing is necessary for employment law purposes, equality monitoring, or other permitted purposes under Applicable Data Protection Law
  • It has implemented appropriate safeguards

For Special Category Data, Rena implements enhanced access controls and audit logging.

Customer acknowledges that Special Category Data is logically segregated within the multi‑tenant database architecture.

13. Liability

The liability provisions of the Principal Agreement apply to this DPA.

Each Party's liability for data protection breaches shall be subject to the limitations set forth in the Principal Agreement.

Rena maintains appropriate measures to address potential security incidents, including incident response procedures and financial provisions for breach‑related obligations.

14. Term and Updates

This DPA shall remain in effect for the duration of the Principal Agreement. Obligations relating to security, confidentiality, and data deletion shall survive termination.

In case of conflict between this DPA and the Principal Agreement regarding data protection matters, this DPA prevails.

Updates to this DPA

Rena may update this DPA from time to time to reflect:

  • Changes in Applicable Data Protection Law
  • Security improvements
  • Operational requirements

For active customers:

  • Material changes that reduce Customer's rights or protections will require consent or will take effect at the next renewal
  • Updates required by law may take effect immediately with notice
  • Non‑material updates such as clarifications or enhanced protections may be made with reasonable notice

The current version will be available on Rena's website or upon request.

15. Governing Law

This DPA is governed by the laws of England and Wales.

If any provision is invalid, the remainder continues in effect.

16. AI Processing

Where Customer uses Rena's AI‑powered features (including but not limited to AI‑assisted interview analysis, scoring, or candidate evaluation), the following terms apply in addition to the general processing terms above:

Roles and Responsibilities

Customer is the data controller and retains full decision‑making authority regarding candidate selection, hiring decisions, and employment actions. Rena provides AI tools to assist Customer's personnel but does not make decisions on Customer's behalf.

AI Sub-processors

Customer acknowledges that AI processing may involve sending Customer Personal Data to specialised AI sub‑processors identified in Schedule 3, including:

  • Microsoft Azure AI (processing in UAE, UK, and US regions)
  • OpenAI
  • Anthropic
  • Groq Cloud

Such sub-processors may process data outside the UK/EEA. Such transfers are protected by appropriate safeguards as set out in Section 9 of this DPA.

Customer Responsibilities for AI Processing

Customer is responsible for:

  • Ensuring compliance with GDPR Article 22 requirements regarding automated decision‑making
  • Configuring appropriate human review and validation of all AI outputs before making decisions that produce legal or similarly significant effects
  • Obtaining all necessary consents from data subjects for AI processing of their personal data
  • Ensuring that AI‑assisted processes do not result in unlawful discrimination
  • Informing data subjects that AI technology is being used and their right to object under applicable data protection law

Limitations

Rena does not make hiring, employment, or other decisions on behalf of Customer. AI outputs may contain errors or bias, and Rena does not warrant that AI outputs are accurate, complete, or non‑discriminatory. Customer acknowledges these limitations and agrees to implement appropriate safeguards.

Schedule 1: Details of Processing

Subject Matter: Processing of Customer Personal Data in connection with Rena's provision of recruitment, HR technology and workforce management services.

Duration: For the term of the Principal Agreement plus any retention period.

Nature and Purpose: Rena Processes Customer Personal Data to provide the Services, including:

  • Applicant tracking and recruitment management
  • AI‑assisted interview analysis and scoring
  • HR information system functions
  • Performance management
  • Leave and attendance management
  • Onboarding and offboarding processes
  • Reporting and analytics
  • Integration with Customer's other systems

Categories of Data Subjects:

  • Job applicants and candidates
  • Customer's employees and contractors
  • Customer's hiring managers and HR personnel
  • Referees and emergency contacts
  • Other individuals whose data Customer uploads to the Services

Categories of Personal Data:

  • Identification data including name, email, phone, and address
  • Professional data including CV, work history, and qualifications
  • Interview data including recordings, transcripts, and assessments
  • Employment data including contracts, compensation, and performance
  • System data including user accounts, access logs, and communications
  • Special Category Data only where Customer determines necessary for employment law compliance, equality monitoring, or other lawful purposes

Frequency of Transfer: Continuous, as necessary to provide the Services.

Schedule 2: Technical and Organisational Measures

Rena implements comprehensive security measures aligned with ISO/IEC 27001:2022.

Technical Measures

Rena implements:

  • Encryption of Customer Personal Data in transit using TLS 1.2 or higher and at rest using AES‑256
  • Multi‑factor authentication for administrator accounts
  • Logical segregation of Customer data in multi‑tenant architecture
  • Web application firewall and DDoS protection
  • Vulnerability scanning and patch management
  • Security logging and monitoring with automated alerting
  • Backup and disaster recovery procedures with defined RTOs and RPOs
  • Annual independent penetration testing

Organisational Measures

Rena maintains:

  • Information security policies and procedures
  • Security awareness training for all personnel
  • Access control on least‑privilege and need‑to‑know basis
  • Confidentiality agreements with all personnel
  • Vendor security assessment programme
  • Incident response procedures
  • Change management controls
  • Regular security reviews and updates

Physical Security

Data centres maintain:

  • 24/7 security with biometric access controls and CCTV
  • Environmental controls including fire suppression, climate control, and power redundancy
  • Secure disposal of hardware and media

Compliance

Rena:

  • Maintains ISO/IEC 27001:2022 certification
  • Conducts regular internal and external audits
  • Applies privacy by design and by default principles
  • Conducts Data Protection Impact Assessments where appropriate

Schedule 3: Sub‑processors

All Sub‑processors listed below maintain appropriate certifications (SOC 2 Type II, ISO 27001, or equivalent) and demonstrate GDPR compliance:

Cloud Infrastructure

Microsoft Azure: Cloud infrastructure and AI services, processing in UK, Sweden, UAE, Saudi Arabia, and US. Certifications: ISO 27001, SOC 2, CSA STAR.

Google Cloud Platform: Cloud infrastructure and regional storage, processing in UK and Saudi Arabia. Certifications: ISO 27001, SOC 2, CSA STAR.

AI/ML Processing

Microsoft Azure AI: AI/ML processing services, processing in UAE, UK, and US regions. Certifications: ISO 27001, SOC 2 (via Azure).

OpenAI: AI/ML processing for interview analysis, processing in US, UK, and Sweden. Certifications: SOC 2 Type II.

Anthropic: AI/ML processing for interview analysis, processing in US and UK. Certifications: SOC 2 Type II.

Groq Cloud: AI/ML processing, processing in US. Certifications: SOC 2.

Communication Services

SendGrid: Email delivery services, processing in EU and US. Certifications: ISO 27001, SOC 2.

Azure Communication Services: Communication services, processing in UK and UAE. Certifications: ISO 27001, SOC 2 (via Azure).

Notes

  • Specific services may be processed in specific regions based on Customer configuration
  • This list is subject to updates per Section 5 of this DPA
  • Rena ensures all Sub‑processors meet appropriate compliance standards before engagement
  • Current list with certification status available upon request

Appendix: International Data Transfer Mechanisms

For UK/EEA Data Transfers

Where required, the following standard contractual clauses apply and are incorporated by reference:

  • UK International Data Transfer Agreement (IDTA) available at ico.org.uk
  • EU Standard Contractual Clauses Module 2 available at ec.europa.eu

For Other Regions

This DPA, combined with the security measures in Schedule 2 and contractual commitments herein, constitutes appropriate safeguards for international data transfers under applicable laws. Rena commits to compliance with local data protection requirements in all jurisdictions where it processes Customer Personal Data.

For Specific Jurisdictions

Where Personal Data is subject to the laws of Singapore, Sri Lanka, United Arab Emirates, or other jurisdictions with specific data protection requirements, the additional terms and clarifications set out in Schedule 4 (Jurisdiction-Specific Terms) shall apply.

In the event of any conflict between the main DPA and Schedule 4, Schedule 4 shall prevail to the extent necessary to comply with the applicable jurisdiction's requirements.

Schedule 4: Jurisdiction-Specific Terms

This Schedule 4 forms part of the Data Processing Addendum dated 4 September 2025 between Capital Placement Ltd trading as Rena ("Processor" or "Rena") and Customer ("Controller" or "Customer").

Purpose: This Schedule sets out jurisdiction-specific variations and clarifications to the DPA to ensure compliance with applicable data protection laws in the jurisdictions where Customer operates or where Customer Personal Data is processed.

Application: The provisions in this Schedule apply in addition to the main DPA. Where there is any conflict between this Schedule and the main DPA, this Schedule shall prevail to the extent necessary to comply with the applicable jurisdiction's data protection law.

1. SINGAPORE

1.1 Applicable Law

The definition of "Applicable Data Protection Law" includes the Personal Data Protection Act 2012 (No. 26 of 2012) of Singapore ("Singapore PDPA") and all regulations, codes and guidelines issued thereunder, including the Personal Data Protection Regulations 2021.

1.2 Definitions

For the purposes of processing Personal Data subject to the Singapore PDPA:

(a) The definition of "Personal Data" includes "personal data" as defined in Section 2(1) of the Singapore PDPA, meaning data, whether true or not, about an individual who can be identified from that data, or from that data and other information to which the organisation has or is likely to have access.

(b) The definition of "Processing" includes "collect", "use" and "disclose" as defined in the Singapore PDPA.

(c) The definition of "Controller" shall be read as "organisation" as defined in the Singapore PDPA.

(d) The definition of "Processor" shall be read as "data intermediary" as defined in Section 2(1) of the Singapore PDPA.

(e) The definition of "Data Subject" shall be read as "individual" as defined in the Singapore PDPA.

1.3 Regulatory Authority

The regulatory authority for Singapore is the Personal Data Protection Commission ("PDPC").

1.4 Specific Obligations

(a) Purpose Limitation: Customer acknowledges that under the Singapore PDPA, organisations may only collect, use or disclose Personal Data for purposes that a reasonable person would consider appropriate in the circumstances, and must notify individuals of such purposes.

(b) Consent: Where Customer relies on consent as the basis for Processing, Customer warrants it has obtained valid consent in accordance with the Singapore PDPA, including deemed consent where applicable.

(c) Notification of Data Breaches: In addition to Section 7 of the DPA, where a data breach affects 500 or more Singapore individuals and is likely to result in significant harm or involves prescribed personal data or identification information, Rena shall notify Customer promptly to enable Customer to notify the PDPC within 3 calendar days of assessment.

(d) Cross-Border Transfers: Customer acknowledges that Rena processes Singapore Personal Data in the United Kingdom, Sweden, United Arab Emirates, and for certain AI processing operations, the United States. Customer confirms that such transfers are permitted under Section 26 of the Singapore PDPA on the basis that:

  • Rena is bound by legally enforceable obligations to provide a standard of protection comparable to the Singapore PDPA through this DPA and applicable Standard Contractual Clauses; and
  • Customer has taken appropriate steps to ensure ongoing compliance.

(e) Retention Limitation: Customer is responsible for determining retention periods for Singapore Personal Data. Rena shall cease to retain Singapore Personal Data, or remove the means by which the data can be associated with particular individuals, as soon as it is reasonable to assume that retention no longer serves the purpose for which it was collected and is no longer necessary for legal or business purposes, in accordance with Section 11 of the DPA.

1.5 Data Subject Rights

Where Customer Personal Data is subject to the Singapore PDPA:

(a) Customer acknowledges that individuals have the right to request access to and correction of their Personal Data under Sections 21 and 22 of the Singapore PDPA.

(b) Rena shall assist Customer in responding to such requests in accordance with Section 6 of the DPA.

(c) Customer may charge a reasonable fee for access requests in accordance with Section 21(4) of the Singapore PDPA, where permitted.

1.6 Do Not Call Registry

Where Customer uses the Communication Module for SMS or telephone communications to Singapore phone numbers, Customer is solely responsible for compliance with the Do Not Call Registry provisions of the Singapore PDPA (Part IX) and ensuring that individuals have provided clear and unambiguous consent to receive such communications.

2. SRI LANKA

2.1 Applicable Law

The definition of "Applicable Data Protection Law" includes the Personal Data Protection Act No. 9 of 2022 of Sri Lanka ("Sri Lanka PDPA") and all regulations, guidelines, codes of practice and directives issued by the Data Protection Authority of Sri Lanka.

2.2 Effective Date

Customer acknowledges that Parts I, II, III, and VII of the Sri Lanka PDPA (relating to data protection principles, controller and processor obligations, data subject rights, and penalties) came into force on 18 March 2025.

2.3 Definitions

For the purposes of processing Personal Data subject to the Sri Lanka PDPA:

(a) The definition of "Personal Data" includes "personal data" as defined in Section 51 of the Sri Lanka PDPA, meaning any information relating to an identified or identifiable natural person.

(b) The definition of "Sensitive Personal Data" or "Special Category Data" includes "sensitive personal data" as defined in Section 51 of the Sri Lanka PDPA, meaning personal data revealing or concerning:

  • Racial or ethnic origin, political opinion, religious or philosophical belief, or trade union membership
  • Genetic data, biometric data, or data concerning health
  • Data concerning a natural person's sex life or sexual orientation
  • Financial data
  • Location data that can be used to track an individual
  • Any other category prescribed by regulations

(c) The definition of "Controller" shall be read as "data controller" as defined in Section 51 of the Sri Lanka PDPA.

(d) The definition of "Processor" shall be read as "data processor" as defined in Section 51 of the Sri Lanka PDPA.

(e) The definition of "Data Subject" includes "data subject" as defined in the Sri Lanka PDPA.

2.4 Regulatory Authority

The regulatory authority for Sri Lanka is the Data Protection Authority of Sri Lanka ("DPA of Sri Lanka"), established under Part V of the Sri Lanka PDPA.

2.5 Data Protection Officer

(a) Customer acknowledges that under Section 13 of the Sri Lanka PDPA, data controllers whose core activities consist of processing operations which require regular and systematic monitoring of data subjects on a large scale, or whose core activities consist of processing sensitive personal data on a large scale, must appoint a Data Protection Officer.

(b) Rena has appointed a Data Protection Officer:

  • Name: Niranjan Thampu
  • Contact: [email protected]

(c) Where Customer is required to appoint a Data Protection Officer under the Sri Lanka PDPA, Customer remains solely responsible for such appointment and compliance.

2.6 Lawful Basis for Processing

Customer acknowledges that under Section 8 of the Sri Lanka PDPA, processing of Personal Data must be based on at least one of the following lawful bases:

(a) Consent of the data subject
(b) Performance of a contract to which the data subject is party
(c) Compliance with a legal obligation
(d) Protection of vital interests of the data subject or another person
(e) Performance of a task carried out in the public interest or in the exercise of official authority
(f) Legitimate interests pursued by the controller or a third party (except where overridden by the interests or fundamental rights of the data subject)

Customer warrants that it has established and documented appropriate lawful bases for all Processing of Customer Personal Data.

2.7 Specific Obligations

(a) Purpose Limitation and Data Minimisation: Customer acknowledges its obligations under Sections 7(1)(b) and 7(1)(c) of the Sri Lanka PDPA to collect Personal Data only for specified, explicit and legitimate purposes and to ensure data is adequate, relevant and limited to what is necessary.

(b) Transparency: Customer is responsible for providing data subjects with clear and comprehensive information about data processing activities in accordance with Section 10 of the Sri Lanka PDPA.

(c) Security Measures: Rena's security measures set out in Schedule 2 of the DPA are designed to comply with Section 18 of the Sri Lanka PDPA, which requires appropriate technical and organisational measures to ensure security appropriate to the risk.

(d) Data Breach Notification: In addition to Section 7 of the DPA:

  • Rena shall notify Customer without undue delay upon becoming aware of a Personal Data Breach affecting Sri Lankan Personal Data
  • Customer is responsible for notifying the DPA of Sri Lanka where required by Section 19 of the Sri Lanka PDPA
  • Where the breach is likely to result in a high risk to the rights of data subjects, Customer must also notify affected individuals in accordance with Section 19(3)

(e) Cross-Border Transfers: Customer acknowledges that Rena processes Sri Lankan Personal Data in the United Kingdom, Sweden, United Arab Emirates, and for certain AI processing operations, the United States. Under Section 26 of the Sri Lanka PDPA, such transfers are permitted on the basis that:

  • This DPA, combined with applicable Standard Contractual Clauses and the security measures in Schedule 2, provides adequate safeguards as required by Section 26(1)(b)
  • Rena has implemented appropriate supplementary measures
  • Customer acknowledges these safeguards are appropriate for the transfers

(f) Records of Processing: Rena maintains records of processing activities in accordance with Section 16 of the Sri Lanka PDPA and shall make such records available to Customer upon reasonable request.

2.8 Data Subject Rights

Where Customer Personal Data is subject to the Sri Lanka PDPA, data subjects have the following rights under Part III:

(a) Right to be informed (Section 10)
(b) Right of access (Section 21)
(c) Right to rectification (Section 22)
(d) Right to erasure ("right to be forgotten") (Section 23)
(e) Right to restriction of processing (Section 24)
(f) Right to data portability (Section 25)
(g) Right to object to processing (Section 20)

Rena shall assist Customer in responding to data subject rights requests in accordance with Section 6 of the DPA. Customer remains responsible for responding to data subjects within the time periods specified in the Sri Lanka PDPA (generally within twenty-one working days, extendable by two further months).

2.9 Automated Decision-Making

Where Customer uses Rena's AI-powered features for processing Sri Lankan Personal Data, Customer acknowledges its obligations under Section 27 of the Sri Lanka PDPA regarding automated decision-making and profiling. Customer must:

(a) Not rely solely on automated processing to make decisions that produce legal effects or similarly significantly affect individuals, unless an exception under Section 27(2) applies

(b) Implement suitable measures to safeguard data subject rights, including the right to human intervention and the right to contest the decision

(c) Ensure meaningful human review of all AI-assisted decisions as required by Rena's Acceptable Use Policy

3. UNITED ARAB EMIRATES

3.1 Applicable Law

The definition of "Applicable Data Protection Law" includes:

(a) Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("UAE Data Protection Law")

(b) All regulations, resolutions and decisions issued by the UAE Data Office pursuant to the UAE Data Protection Law

(c) For entities operating in the Dubai International Financial Centre (DIFC), the DIFC Data Protection Law (DIFC Law No. 5 of 2020)

(d) For entities operating in the Abu Dhabi Global Market (ADGM), the ADGM Data Protection Regulations 2021

3.2 Definitions

For the purposes of processing Personal Data subject to UAE data protection law:

(a) The definition of "Personal Data" includes "personal data" as defined in Article 1 of the UAE Data Protection Law, meaning any data that leads to the identification of an individual or makes their identification possible by any means.

(b) The definition of "Sensitive Personal Data" or "Special Category Data" includes "sensitive personal data" as defined in Article 1, meaning:

  • Data relating to race, ethnic origin, political opinions, or religious or philosophical beliefs
  • Biometric data, genetic data, or health data
  • Data relating to criminal convictions or offences
  • Financial data
  • Location data
  • Data of minors
  • Any other category prescribed by the Executive Regulations

(c) The definition of "Controller" shall be read as "data controller" as defined in the UAE Data Protection Law.

(d) The definition of "Processor" shall be read as "data processor" as defined in the UAE Data Protection Law.

3.3 Regulatory Authority

The regulatory authority is the UAE Data Office, established under Article 4 of the UAE Data Protection Law, which operates under the supervision of the Ministry of Interior.

3.4 Data Processing in the UAE

Customer acknowledges that:

(a) Rena processes Customer Personal Data using Microsoft Azure UAE North (Dubai) and Azure UAE Central (Abu Dhabi) data centres

(b) Rena processes Customer Personal Data using Google Cloud Platform infrastructure in the UAE

(c) For certain AI processing operations, data may be processed in other locations as set out in Section 9 of the DPA

3.5 Specific Obligations

(a) Lawful Basis: Customer acknowledges that under Article 5 of the UAE Data Protection Law, processing must be based on:

  • Consent of the data subject
  • Performance of a contract
  • Legal obligation
  • Protection of vital interests
  • Public interest
  • Legitimate interests

(b) Purpose Limitation: Processing must be for specified, declared and legitimate purposes in accordance with Article 6 of the UAE Data Protection Law.

(c) Data Minimisation and Accuracy: Customer is responsible for ensuring Personal Data is adequate, relevant, limited to what is necessary, accurate and kept up to date, in accordance with Article 6.

(d) Transparency: Customer must provide data subjects with clear information about processing activities as required by Article 7 of the UAE Data Protection Law.

(e) Security: Rena's security measures in Schedule 2 are designed to comply with Article 9 of the UAE Data Protection Law, which requires appropriate technical and organisational measures to protect Personal Data.

(f) Data Breach Notification: In addition to Section 7 of the DPA, where a Personal Data breach affecting UAE Personal Data occurs:

  • Rena shall notify Customer without undue delay and in any event within 72 hours
  • Customer is responsible for notifying the UAE Data Office within 72 hours in accordance with Article 10
  • Where the breach poses a high risk, Customer must notify affected data subjects

3.6 Cross-Border Data Transfers

(a) Customer acknowledges that Rena may transfer Personal Data outside the UAE to the United Kingdom, Sweden, and for certain AI processing, the United States.

(b) Under Article 13 of the UAE Data Protection Law, such transfers are permitted where:

  • The receiving country has been deemed to provide adequate protection (the UAE Data Office maintains a list of approved countries)
  • Standard contractual clauses approved by the UAE Data Office are in place
  • Other appropriate safeguards are implemented

(c) This DPA, together with applicable Standard Contractual Clauses referenced in the Appendix to the DPA, provides appropriate safeguards for such transfers.

(d) The Executive Regulations may specify additional requirements for cross-border transfers, which Customer and Rena agree to comply with.

3.7 Data Subject Rights

Where Customer Personal Data is subject to UAE data protection law, data subjects have the following rights under Chapter 3 of the UAE Data Protection Law:

(a) Right to access (Article 14)
(b) Right to rectification (Article 15)
(c) Right to erasure (Article 16)
(d) Right to restriction of processing (Article 17)
(e) Right to data portability (Article 18)
(f) Right to object (Article 19)
(g) Right to opt out of direct marketing (Article 20)

Rena shall assist Customer in responding to such requests in accordance with Section 6 of the DPA. Customer must respond within the timeframes specified in the UAE Data Protection Law (typically 15 working days, extendable by 15 working days).

3.8 Automated Decision-Making

Where Customer uses automated decision-making (including profiling) for UAE Personal Data, Customer must comply with Article 11 of the UAE Data Protection Law, including:

(a) Informing data subjects about the automated processing

(b) Providing data subjects with the right to human intervention

(c) Allowing data subjects to express their point of view and contest the decision

(d) Implementing suitable measures to safeguard data subject rights

3.9 Free Zones

(a) For Customers operating in DIFC or ADGM, the relevant free zone data protection laws shall apply in addition to (for DIFC) or instead of (for ADGM) the UAE Federal data protection law.

(b) Customer is responsible for determining which laws apply to their operations and ensuring compliance with the applicable regime.

(c) Rena shall cooperate with Customer to meet the requirements of the applicable free zone data protection laws.

4. GENERAL PROVISIONS

4.1 Hierarchy

In the event of any conflict or inconsistency between:

(a) This Schedule 4 and the main DPA, this Schedule 4 shall prevail to the extent necessary to comply with the specific jurisdiction's data protection law

(b) The requirements of different jurisdictions in this Schedule, each shall apply to the Personal Data subject to that jurisdiction's law

4.2 Multiple Jurisdictions

Where Customer Personal Data is subject to the laws of multiple jurisdictions:

(a) Customer and Rena shall comply with all applicable requirements

(b) Where requirements conflict, the Parties shall cooperate in good faith to determine an appropriate approach that satisfies the most protective requirements

(c) Customer may configure the Services to meet specific jurisdictional requirements where technically feasible

4.3 Updates

(a) Rena may update this Schedule 4 to reflect:

  • Changes in applicable data protection laws
  • Guidance or decisions from regulatory authorities
  • Additional jurisdictions as Rena expands its service offerings
  • Technical or operational changes to the Services

(b) Material updates that reduce Customer's rights or protections will be subject to the update provisions in Section 14 of the DPA.

(c) Non-material updates (including addition of new jurisdictions or clarifications) may be made with reasonable notice and will be posted on Rena's website.

4.4 Customer Responsibilities

Customer acknowledges and agrees that:

(a) Customer is responsible for determining which jurisdictions' data protection laws apply to its use of the Services

(b) Customer must configure the Services appropriately to meet jurisdiction-specific requirements (e.g., data residency preferences)

(c) Customer must ensure it has appropriate lawful bases for processing under all applicable laws

(d) Customer must provide appropriate privacy notices to data subjects in accordance with applicable laws

(e) Customer must implement jurisdiction-specific requirements that are within Customer's control (e.g., responding to data subject rights within prescribed timeframes)

4.5 Rena's Commitments

Rena commits to:

(a) Processing Customer Personal Data in accordance with this DPA and applicable data protection laws

(b) Maintaining security measures appropriate to the risks and in compliance with applicable requirements

(c) Assisting Customer in meeting its compliance obligations as set out in the DPA

(d) Providing Customer with information necessary to demonstrate compliance

(e) Monitoring changes to data protection laws in jurisdictions where Rena processes data and updating this Schedule 4 accordingly

4.6 Regulatory Inquiries

Where Rena receives an inquiry, investigation or enforcement action from a regulatory authority in any jurisdiction:

(a) Rena shall promptly notify Customer if the inquiry relates to Customer Personal Data

(b) Rena shall cooperate with Customer in responding to the inquiry

(c) Customer shall be responsible for responding to inquiries directed to Customer as the data controller

(d) Each Party shall bear its own costs unless otherwise agreed or required by law

4.7 Additional Jurisdictions

For jurisdictions not specifically addressed in this Schedule 4:

(a) The main DPA provisions shall apply

(b) "Applicable Data Protection Law" includes all applicable data protection laws in such jurisdictions

(c) Parties shall cooperate to implement any additional measures required by such laws

(d) Customer may request Rena to add specific jurisdiction provisions to this Schedule, subject to technical feasibility and commercial agreement

5. DEFINITIONS FOR THIS SCHEDULE

For the purposes of this Schedule 4, unless otherwise specified:

"DPA" means the Data Processing Addendum dated 4 September 2025 between Rena and Customer.

"Regulatory Authority" means the supervisory authority, data protection authority, commission or other government body responsible for enforcement of data protection law in the relevant jurisdiction.

"Data Residency" means the practice of storing and processing data within the geographical boundaries of a specific country or region.

"Standard Contractual Clauses" means the contractual clauses approved by relevant authorities for the transfer of personal data to countries that do not provide adequate protection, including:

  • EU Standard Contractual Clauses (for EU/EEA transfers)
  • UK International Data Transfer Agreement (UK IDTA) or UK Addendum to EU SCCs (for UK transfers)
  • Any equivalent transfer mechanisms approved by other jurisdictions

"Data Localisation Requirement" means a legal requirement to store or process personal data within a specific jurisdiction.

EXECUTION

BY EXECUTING THE PRINCIPAL AGREEMENT OR ANY ORDER FORM THAT REFERENCES THIS DPA, THE PARTIES AGREE TO BE BOUND BY THIS DATA PROCESSING ADDENDUM AND ALL SCHEDULES HERETO.

rena Logo

Saving you thousands in subscriptions

Rena provides all your hiring solutions, saving you not just time but also money. 

Book a call