Controller & contact
Legal entity, contact point and relevant roles must be unambiguous.
PRIVACY ASSURANCE
Privacy without boilerplate on autopilot.
The final privacy notice must be based on actual data types, purposes, roles, legal basis, retention and recipients — not generic wording.
Data & purpose
Which personal data is processed, why and in which flows.
Legal basis & recipients
Basis, processors and any other recipients.
Retention & rights
Storage, access, rectification, deletion, objection and complaint route.
International transfers
Must be described if third countries or relevant suppliers are involved.
Customer roles
It must be clear when EPTT acts as controller, processor or technical supplier.
Technical or legal clarification?
Use the contact flow for concrete questions about deployment, responsibility, data and security.
DATA RESPONSIBILITY REGISTER
Data responsibility should be visible before production.
The register shows what must be concretely clarified for the selected deployment. It is not a substitute for legal approval.
DPA / processing terms
When EPTT processes personal data on behalf of a customerRoles, instructions, safeguards and termination handling should be reflected in the agreement.Confirm per agreement
Subprocessors
Where third-party suppliers are used by the selected operating modelThe list, role and change process should be available.Publish before production
Data residency
Cloud / Dedicated / relevant managed servicesHosting and data location should be confirmed for the concrete environment.Confirm per deployment
Retention
Account data, operational data, logs and possible location dataRetention and deletion should be defined by data type and purpose.Define by data type
International transfers
If data or suppliers involve third countriesTransfer basis and relevant safeguards should be documented.Document if applicable