Roles & instructions
Controller, processor or service-provider roles are stated for the applicable processing.
LEGAL · DATA PROCESSING
Data roles should be explicit before data moves.
Where Mediator processes personal data on behalf of a customer, the applicable agreement should identify roles, instructions, security, subprocessors, transfers, retention and deletion.
OVERVIEW
Processing follows documented instructions.
The data-processing framework is intentionally separate from the website privacy notice because customer-controlled processing creates different obligations and authority.
Security
Appropriate technical and organizational measures follow the system and data involved.
Subprocessors
Applicable subprocessors and material changes are handled under the governing agreement.
Requests & incidents
Cooperation for data-subject requests and security incidents follows the applicable legal and contractual role.
Return & deletion
End-of-service handling follows the agreement, retention needs and legal obligations.