1. General
This policy describes what data is processed when using the service, for what purpose, how long it is kept and who has access to it.
2. What data is processed
- Account data: email address, nickname, login history and session IP addresses.
- Technical request data: time, key identifier, outcome, duration, whether it was charged.
- Search request contents and results: personal data of third parties supplied by the Customer and returned by the source.
3. What is stored and for how long
The minimisation principle applies: only what is needed for billing and for resolving disputes is kept.
- Request contents are kept in shortened form — enough to identify the operation, not enough to reconstruct the full result set.
- Search results are kept for a limited time and in encrypted form.
- The request log is kept for [90] days and then deleted automatically.
- Account data is kept for the duration of the agreement and [N] months after it ends.
4. Who has access
Only one staff role of the Provider has access to the full contents of requests and to results. The “Finance”, “Support” and “Analyst” roles work with anonymised records: they see the fact, the time and the outcome of a request, but not its contents.
Every access to full contents is written to the audit log with the staff member, the time and the reason.
5. Security measures
- Encryption of data in transit and at rest.
- Two-factor authentication for every staff member with access to the control panel.
- Role-based permissions and logging of significant actions.
- Automatic deletion of outdated records.
6. Rights of the data subject
A data subject may request information about the processing and demand correction, blocking or erasure of the data. Requests are accepted at the address given in “Contacts” and are handled within [30] days.
7. Customer obligations
The Customer acts as an independent controller of the data obtained through the service and must have a lawful basis for processing it. The Provider acts as a processor, to the extent needed to deliver the service.
8. Contacts
Questions about data processing: privacy@example.com