Privacy Policy

R&D Entrepreneurship & Outsourcing Center PLC ("R&D Group", "the Company", "we", "us", "our") operates Annotate Plus — a data annotation and AI training-data platform available at annotateplus.ai (the "Platform" or "Service").

We build training datasets for artificial intelligence systems. That work depends on data entrusted to us by our clients and on the people who label it. Both deserve protection. This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, how long we keep it, how we secure it, what rights you have over it, and how we look after the people who do the annotation work.

This Policy is written to meet the requirements of the Personal Data Protection Proclamation No. 1321/2024 of the Federal Democratic Republic of Ethiopia and reflects generally accepted international data protection practice. Where we act for clients established in other jurisdictions, additional terms may apply under the relevant data processing agreement.

By accessing the Platform or our website, or by submitting data to us, you acknowledge that you have read and understood this Policy. If you do not agree with it, please do not use the Service.

1.1 Who this Policy covers

• Website visitors — anyone browsing annotateplus.ai or www.randd-group.com.
• Clients and client personnel — organisations that engage us for annotation services, and the individuals who administer their accounts.
• Platform users — anyone with an account on Annotate Plus, including client users, project managers, annotators and quality reviewers.
• Applicants and members of our annotation workforce — people who apply to join or work within our annotator network.
• Data subjects appearing within client data — individuals whose personal data may be contained in images, video, audio, text or point-cloud files that a client submits for annotation. Section 3 explains our limited role in relation to this data.

1.2 What this Policy does not cover

• The privacy practices of our clients, who decide independently what data they collect and why.
• Third-party websites, applications or services that we link to but do not control.
• The full detail of our internal security controls and staff disciplinary procedures, which are governed by our internal Information Security and Data Protection Policy. A public-facing summary of how we look after our workforce is given in Section 7.

The words below have the following meanings wherever they appear capitalised in this Policy.

The obligations that apply to us depend on which of two roles we are performing. This distinction matters — please read it carefully.

3.1 Where we act as Data Controller

We are the Controller, and decide the purposes and means of processing, for:

• Personal data of website visitors and enquirers;
• Account and contact data of client personnel and platform users;
• Applicant, recruitment and workforce data for our annotation teams;
• Billing, tax, audit and corporate record data;
• Security logs, access records and platform telemetry.

For this data, the rights in Section 13 are exercised directly against us.

3.2 Where we act as Data Processor

For Client Data submitted to the Platform, our client is the Controller and we act solely as a Processor. This means:

• We process Client Data only on the documented instructions of the client, as set out in the service agreement and the accompanying Data Processing Agreement (DPA).
• We do not decide what Client Data is collected, from whom, or for what underlying purpose.
• We do not sell Client Data, and we do not use it to train our own models, to build our own products, or for any purpose other than delivering the contracted annotation service — unless the client has given separate, specific and documented written permission.
• Where a Data Subject whose personal data appears inside Client Data contacts us directly, we will not act on the request ourselves. We will refer the individual to the client and notify the client promptly, and we will assist the client in responding as required by our DPA.

3.3 Client responsibilities

Clients warrant, under their service agreement, that they have a lawful basis for the data they submit, that they have provided any required notices to Data Subjects, and that they have obtained any consents or authorisations required for annotation by a third party. Clients must not submit Sensitive Personal Data, data of children, or data subject to special legal regimes unless this has been declared in advance, recorded in the project data sheet, and covered by additional safeguards agreed in writing with us.

4.1 Data you give us directly

4.2 Data collected automatically

When you use the Service we automatically collect Usage Data, which may include your Internet Protocol (IP) address, browser type and version, operating system, device type and unique device identifiers, the pages and features you visit, the date and time of your visit, time spent on pages, referring URLs, language settings, and diagnostic and error data.

Within the Platform we also record operational and audit data — which account opened which task, which records were viewed, what labels were applied or changed, when data was exported, and from which IP address and session. These logs exist to protect client data, to support quality assurance, and to allow us to investigate security incidents. They are described further in Section 11.

4.3 Data contained in Client Data

Client Data may itself contain personal data — for example faces, vehicle registration plates, house numbers or street signs in images and video; names, addresses or account references in documents; voices and spoken content in audio; and identifiable structures in 3D point-cloud scans.

We do not seek out this data and we have no independent purpose for it. We process it only as instructed, under the safeguards described in Section 6.

4.4 Data we ask you not to send us

Do not submit Sensitive Personal Data, government identification numbers, payment card numbers, health records or children's data through general support channels, contact forms or email. If you need to transmit such data for a project, use the secure ingestion method agreed for that project. Data sent through inappropriate channels will be deleted where we can do so consistently with our legal obligations.

We process Personal Data only where at least one lawful basis under Article 5 of Proclamation No. 1321/2024 applies. The basis depends on the purpose:

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal, and it may mean we can no longer provide part of the Service.

Annotate Plus is a human-in-the-loop platform. Trained annotators view and label the data our clients submit. We consider this the most significant privacy risk in our operation, and we control it as follows.

6.1 Access is scoped, minimal and time-limited

• Annotators are assigned to specific projects and can access only the data batches allocated to their open tasks. There is no browsing of client repositories.
• Access is granted on a least-privilege basis and is revoked automatically when a task is completed or an assignment ends.
• Access rights are reviewed at least quarterly and immediately upon any change of role or termination.
• All access is authenticated with individual named accounts and multi-factor authentication. Shared or generic accounts are prohibited.

6.2 Vetting and binding obligations

• Every annotator, reviewer, project manager and administrator is identity-verified before onboarding and, where lawful and proportionate to the sensitivity of the project, background-checked.
• Every person with access signs a binding confidentiality and data protection undertaking that survives the end of their engagement.
• Everyone with access completes data protection and information security training before their first task and refresher training at least annually.
• Clients may require project-specific undertakings, additional vetting or named-individual approval; we support these requirements.

6.3 The controlled annotation environment

• Annotation is performed in a controlled environment — a secured delivery centre or, where a client permits remote work, a managed and monitored configuration agreed for that project.
• Client Data is streamed to the annotation interface. Download, copy, print, local storage and clipboard export are disabled by technical control unless the project design requires otherwise.
• Personal mobile phones, cameras, recording devices and personal storage media are prohibited in secure annotation areas.
• Screenshots and screen recording are blocked or detected, and screen-capture attempts are logged and investigated.
• Removable media is disabled on annotation endpoints. Outbound network access from those endpoints is restricted to the Platform.
• Discussing, describing or sharing the content of Client Data outside the project team is a disciplinary offence.

6.4 Reducing exposure in the first place

• Where a project permits it, we apply de-identification before human review — for example blurring faces or plates that are not the annotation target, or redacting direct identifiers in text.
• Where the annotation target itself is identifying data (for example face landmark detection), de-identification is not possible; in those cases we rely on the access, environment and contractual controls above, and we record the decision in the project data sheet.
• We work with clients to minimise the data submitted — sampling rather than whole archives, and stripping metadata fields not needed for the task.

Protecting data and protecting the people who work with it are, to us, the same commitment. Our annotators and reviewers are colleagues, not anonymous labour, and the same discipline we apply to your data we apply to their working conditions.

7.1 Who works on client data

Client Data is handled only by identity-verified, trained personnel who have signed a binding confidentiality undertaking before they are given any access. Every person completes data protection and security training before their first task, with refresher training at least once a year. Access is granted per project and per task, and is removed automatically the moment it is no longer needed — described fully in Section 6.

7.2 Fair and transparent working conditions

• Pay and task terms are agreed and communicated in writing before work begins.
• Working hours, rest breaks and leave follow Ethiopian labour law.
• Work is organised so that no one is asked to work in isolation without a point of contact and support.
• Everyone can raise a question about how they are treated, paid or assessed, and receive a timely answer.

7.3 Care around difficult content

Some annotation tasks can involve sensitive, graphic or otherwise difficult material. Where that is the case:

• We tell people what a task involves before they are assigned to it.
• Participation in such tasks is voluntary, and a person may step back from one at any time without any negative consequence.
• We limit continuous exposure, build in regular breaks, and rotate this kind of work across the team rather than concentrating it on one person.
• Confidential support is made available to anyone who needs it, at the Company's expense.

7.4 Monitoring, done openly

We monitor platform activity for security, quality and payment purposes — for example, which account accessed which task and when. Every person is told in advance what is monitored and why. Monitoring is limited to work systems and working activity: we do not use covert surveillance, we do not monitor personal devices or personal accounts, and monitoring data is never used for any purpose beyond the ones we have stated.

7.5 A safe way to speak up

Anyone — staff, annotators, contractors — can raise a concern about data handling, safety or fair treatment with their manager, with HR, or through a confidential channel, including anonymously. Raising a concern in good faith never results in any disadvantage to the person who raised it. We would always rather hear about a problem, including our own mistakes, than have it stay hidden.

The full operational detail behind these commitments — vetting procedures, workspace controls, incident handling and disciplinary process — is set out in our internal Information Security and Data Protection Policy, available to clients under NDA on request.

We use Personal Data for the following purposes and no others:

1. To provide and maintain the Service, including creating and managing accounts, allocating tasks, running quality assurance, and delivering completed datasets.
2. To manage your relationship with us — responding to enquiries, providing technical support, and sending service and administrative notices such as security alerts, maintenance windows and changes to terms.
3. To perform our contracts, including onboarding, project delivery, invoicing and collection of payment.
4. To recruit, onboard, pay and support our annotation workforce.
5. To secure the Platform — authentication, access control, audit logging, intrusion detection, abuse and fraud prevention, and incident investigation.
6. To improve the Service — diagnosing faults, analysing aggregate usage patterns, and testing new features, using de-identified or aggregated data wherever this is sufficient.
7. To measure the effectiveness of our communications and promotional campaigns, where you have consented to receive them.
8. To comply with law — tax and accounting records, responses to lawful requests from competent authorities, and regulatory reporting.
9. To establish, exercise or defend legal claims.
10. To evaluate a corporate transaction such as a merger, acquisition, financing or sale of assets, under confidentiality and with the safeguards in Section 9.3.

We share Personal Data only in the circumstances set out below, and only to the minimum extent necessary.

9.1 Service providers and sub-processors

We use carefully selected providers for hosting, storage, email delivery, analytics, payment processing, customer support and communications. They may access Personal Data only to perform tasks on our behalf and are bound by written contracts that require confidentiality, security measures at least equivalent to our own, purpose limitation, assistance with data subject requests, and deletion or return of data at the end of the engagement.

9.2 Within our group

We may share Personal Data with affiliates and group entities of R&D Group where necessary to deliver the Service, under the same confidentiality and security obligations described in this Policy.

9.3 Business transactions

If the Company is involved in a merger, acquisition, restructuring, financing or sale of all or part of its assets, Personal Data may be disclosed to the counterparty and its advisers under a confidentiality agreement, and may be transferred as part of the transaction. We will give notice before Personal Data becomes subject to a materially different privacy policy. Client Data will be transferred only in accordance with the relevant client agreement.

9.4 Law enforcement and legal requirements

We may disclose Personal Data where we are required to do so by law or in response to a valid request by a competent public authority. Before disclosing we will verify that the request is lawful, properly issued and proportionate, and we will limit disclosure to what is strictly required. Where we are legally permitted to do so, we will notify the affected client or Data Subject. We may also disclose Personal Data where necessary to protect our legal rights, to investigate wrongdoing, to protect the safety of any person, or to defend against legal liability.

9.5 With your direction

We will share Personal Data with any other party where you or your organisation instruct us to do so.

9.6 What we never do

• We do not sell, rent or trade Personal Data.
• We do not disclose Client Data to other clients, and project teams are segregated.
• We do not permit sub-processors to use data for their own purposes.
• We do not use Client Data for advertising or profiling of any kind.

We use cookies and similar technologies — including web beacons, clear GIFs and pixel tags — on our website. Cookies are small files placed on your device. Session cookies are deleted when you close your browser; persistent cookies remain until they expire or you delete them.

You can accept, refuse or withdraw consent for non-essential cookies through the cookie banner, and you can delete or block cookies through your browser settings. Blocking strictly necessary cookies will prevent parts of the site from working.

We honour Global Privacy Control and similar automated opt-out signals where your browser transmits them. We do not currently respond to legacy "Do Not Track" headers, because no common standard for interpreting them has been agreed.

We maintain an information security programme aligned to recognised good practice and governed by our internal Information Security and Data Protection Policy. Our controls include:

No method of transmission over the Internet and no method of electronic storage is completely secure. While we use commercially acceptable means to protect Personal Data, we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential and for notifying us immediately if you suspect unauthorised access to your account.

We maintain a documented incident response procedure. If a personal data breach occurs:

• We will notify the Ethiopian Communications Authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach, in accordance with Proclamation No. 1321/2024.
• Where the breach is likely to result in a high risk to the rights and freedoms of Data Subjects, we will notify affected individuals without undue delay, in clear language, describing what happened, the likely consequences, the measures taken, and what the individual can do.
• Where the breach affects Client Data, we will notify the affected client without undue delay and in any event within 24 hours of becoming aware, so that the client can meet its own notification obligations as Controller. We will provide the information the client needs and will cooperate with its response.
• We maintain an internal register of all personal data breaches, including those not notifiable, recording the facts, the effects and the remedial action taken.
• Every incident is followed by a documented review and corrective action plan.

Subject to the conditions and exemptions in Proclamation No. 1321/2024, you have the following rights in relation to Personal Data for which we are the Controller.

13.1 How to exercise your rights

Registered users can review and update much of their information directly by signing in to their account.

We will acknowledge your request promptly and respond within 30 days of receipt. Where a request is complex or where we receive a number of requests from you, we may extend this period by a further 30 days and will tell you why within the original 30 days.

We will take reasonable steps to verify your identity before acting, so that we do not disclose your data to someone else. There is no charge for exercising your rights; we may charge a reasonable fee, or refuse, where a request is manifestly unfounded or excessive, and we will explain our reasoning if we do.

13.2 Requests concerning Client Data

If you believe your Personal Data appears within a dataset submitted to us by one of our clients, we are the Processor and not the Controller. Please direct your request to the organisation that collected your data. If you contact us, we will — where we can identify the relevant client — pass your request to them without undue delay and tell you that we have done so. We cannot disclose our clients' identities or the contents of their datasets to third parties.

13.3 Complaints

If you are dissatisfied with how we have handled your Personal Data or your request, please contact our Data Protection Officer first so we have the opportunity to put it right. You retain the right to complain to the Ethiopian Communications Authority at any time.

We keep Personal Data only for as long as necessary for the purposes described in this Policy, or for as long as required by law. When the retention period ends, data is securely deleted or irreversibly anonymised. Backups containing deleted data are overwritten on the normal backup rotation cycle.

Clients may request deletion or return of Client Data at any time under their agreement. On termination we delete Client Data within 30 days and provide written confirmation of deletion on request, except where retention is required by law.

We are based in Addis Ababa, Ethiopia, and Personal Data is primarily processed here. Some of our service providers operate outside Ethiopia, which means your Personal Data may be transferred to and stored in other countries.

Under Proclamation No. 1321/2024 we transfer Personal Data outside Ethiopia only where at least one of the following applies:

• The Ethiopian Communications Authority has determined that the receiving country provides an adequate level of protection;
• Appropriate safeguards are in place, such as standard contractual clauses or binding corporate rules approved by the Authority;
• The Data Subject has given explicit, informed consent to the transfer after being told of the risks;
• The transfer is necessary for the performance of a contract with the Data Subject, or for the establishment or defence of legal claims; or
• The transfer is otherwise authorised by the Authority.

Transfers of Sensitive Personal Data outside Ethiopia require prior approval of the Authority, and we will not make such a transfer without it.

Client Data is stored in the location agreed with the client and recorded in the project data sheet. Where a client requires data residency in a particular jurisdiction, we will confirm in writing whether we can meet that requirement before the project begins.

We use machine-assisted pre-labelling and automated quality checks to make annotation faster and more consistent. These are always subject to human review and do not make decisions about individuals.

We do not make decisions producing legal or similarly significant effects concerning any individual based solely on automated processing. Where automated scoring contributes to a decision about a member of our workforce — for example a quality score affecting task allocation — a human reviews the outcome, the individual is told, and the individual may request an explanation and contest the result.

The Service is a business-to-business platform. It is not directed at children, and we do not knowingly collect Personal Data from anyone under the age of 18. We do not create accounts for minors, and we do not profile children or use their data for marketing.

If you are a parent or guardian and believe your child has provided us with Personal Data, contact us at info@randd-group.com and we will delete it. If we become aware that we have collected Personal Data from a child without appropriate parental consent, we will take steps to remove it.

Clients must not submit datasets containing the personal data of children unless this has been declared before the project begins, is supported by a lawful basis and any required parental consent, and is covered by additional safeguards agreed with us in writing.

The Service may contain links to websites and services we do not operate. If you follow a link to a third-party site, you will be subject to that site's own privacy policy. We have no control over and assume no responsibility for the content, privacy practices or security of any third-party site. We recommend that you review the privacy policy of every site you visit.

We may update this Policy from time to time to reflect changes in our practices, technology, legal requirements or the Service. When we do:

• We will post the revised Policy on this page and update the "Effective date" and version number.
• For material changes, we will notify account holders by email or by a prominent notice on the Service at least 14 days before the change takes effect.
• We will keep previous versions available on request so you can see what has changed.

Your continued use of the Service after a change takes effect indicates acceptance of the revised Policy. If you do not agree with a change, you may close your account and, for clients, exercise your rights under the service agreement.