Status: draft for legal review.
Roles
Customer: Data Controller.
Senvarel: Data Processor for customer-provided personal data and connected integration data.
Processing Instructions
Senvarel processes customer data only to provide contracted services, secure the platform, support the customer, and meet legal obligations.
Confidentiality
Personnel with access to customer data must be subject to confidentiality obligations.
Security Measures
Access control and role-based authorization.
HttpOnly cookie sessions with refresh-token rotation.
Encryption of customer integration secrets at rest.
Audit logs for sensitive operations.
Environment separation for staging and production.
Subprocessors
Subprocessors are listed in subprocessors.md. Customers must be notified of material subprocessors changes when required by contract.
Data Subject Requests
Senvarel assists the customer with export, deletion, and correction requests according to documented procedures.
Return Or Deletion
On termination, customer data is deleted or returned according to the customer instruction and retention policy.