Processing roles
The service provider may act as controller for user account data and direct service administration. For data an organization submits for storage or processing under its instructions, the provider generally acts as processor within the agreed scope.
Legal bases and required data
Processing may rely on contract, legal duties, legitimate interests, vital interests or consent depending on context. Without required information, some functions may be unable to authenticate, connect or operate.
Indirect and sensitive data
Organization documents may contain data about counterparties, employees, payees or other people and may inadvertently contain sensitive data. The organization should notify relevant people and submit only what is necessary. Excess or incorrect data should have a route to restriction, correction or deletion where no retention duty applies.
Rights requests
We verify identity, scope and legal exceptions before acting. Where an organization controls the data, we may refer the request to that controller and support its response in our role as processor.
Transfers and subprocessors
Where a provider or cross-border transfer is used, we assess necessity, access scope and safeguards required by law, and restrict recipients according to their duties.
Consent and cookies
Consent applies only where the flow relies on it, must be separate and understandable, and must be as easy to withdraw as to give. Withdrawal affects future processing but does not remove legal duties or evidence that must be retained. Non-essential cookies must wait for the user's choice.
Retention and mistake correction
Retention periods must follow the data type and accounting, tax, contract or security duties. Incorrect data should support correction or replacement evidence. Evidence that must preserve integrity uses a linked before-and-after correction so both data rights and document reliability remain auditable.
Personal data breaches
We maintain processes to detect, assess, contain and record incidents. Where notification thresholds are met, we coordinate with the controller and relevant authority or individuals within the applicable timeframe.
Contact and complaints
A rights-request channel must support status tracking and additional evidence without revealing another person's data before identity verification. Confirmed controller, responsible-person and complaint contact details must be displayed before the effective document launches.