LEGAL FOUNDATION
Data Processing Policy
How to review responsibilities before using customer-controlled personal data in a project.
Controller and processor roles
A customer normally determines why its workspace records are processed. BOT processes those records to deliver the agreed service. BOT separately determines the purposes of its own account administration, enquiries and business records, as explained in the Privacy Policy.
A written processing agreement
Where a controller-processor relationship requires an agreement, the signed agreement must define the subject, duration, nature and purpose of processing, data categories, people concerned and each party’s responsibilities. This public overview does not replace that agreement.
Instructions and confidentiality
Before production data is provided, agree documented instructions, authorised access and confidentiality obligations. Specify whether support, integrations or AI features may access selected records and prohibit uses outside the agreed instructions.
Providers and international transfers
Confirm the relevant legal entities, processing locations and authorised sub-processors for the purchased service. The agreement should address authorisation, change notices and objections. Review applicable transfer safeguards before processing data outside the relevant jurisdiction.
Security and incident assistance
The agreement should specify appropriate controls, incident notification, assistance with rights requests and any required assessments. Review the evidence for access controls, backups and recovery arrangements rather than assuming every project includes identical controls.
Return, deletion and review
Agree export formats, deletion responsibilities, backup treatment and lawful retention exceptions at the end of service. Include the information and review arrangements required to demonstrate the applicable contractual obligations.
Request the applicable documents
Email info@byteoperationstechnologies.com or info@byteopestech.it with your proposed service and data categories. Request the applicable processing agreement and provider details before submitting production personal data. Do not send sensitive records with the initial enquiry.