1. Purpose
This page describes the enterprise EU/EEA data-protection framework. It supplements the Privacy Policy and does not replace a signed Data Processing Agreement.
2. Controller and processor roles
PRO LEVEL is generally controller for account administration, security, billing and its own analytics. It may be processor when customers determine recruitment, scouting, registry or workforce purposes. Some activities require separate or joint-controller analysis.
3. DPA
Enterprise customers should execute a GDPR-compliant DPA covering instructions, confidentiality, security, subprocessors, transfers, rights assistance, breaches, audits and deletion/return. Add [INSERT DPA REQUEST PROCESS].
4. Principles
- Lawfulness, fairness and transparency.
- Purpose limitation.
- Data minimisation.
- Accuracy.
- Storage limitation.
- Integrity and confidentiality.
- Accountability and privacy by design/default.
5. Records and DPIAs
Maintain Article 30 records and lawful-basis assessments. Complete DPIAs for high-risk processing involving systematic evaluation, sensitive data, minors, broad monitoring, biometrics or significant automated decision support.
6. Sensitive data
Health, injury, disability, biometric and similar data require strict necessity, an Article 9 condition, restricted access, retention controls and often a DPIA.
7. Rights support
PRO LEVEL will support access, correction, deletion, restriction, portability, objection and automated-decision requests. Customer controllers remain responsible for responding to their data subjects.
8. Subprocessors and transfers
Maintain a current list, provide required change notice and use lawful international-transfer safeguards with risk assessment and supplementary measures.
9. Breach management
Document every breach. Processors notify controllers without undue delay. Controllers assess supervisory-authority reporting within the GDPR 72-hour framework and individual notice where high risk exists.
10. Retention and deletion
Configure retention where feasible. On termination, return or delete processor data unless law requires retention; maintain deletion and backup-expiry evidence.
11. Children
Implement age-appropriate transparency, guardian authority, restricted visibility, safeguarding and market-specific consent rules.
12. AI and decisions
Before AI activation, classify roles under the EU AI Act, document data, transparency, human oversight, bias testing, logging, provider obligations and GDPR Article 22 impact.
13. Accessibility
Legal notices, consent and rights mechanisms should be accessible and understandable. Assess the European Accessibility Act and national implementation.
14. Contact
Privacy: [INSERT PRIVACY CONTACT / DPO EMAIL]. Lead authority and representative: [INSERT AFTER ESTABLISHMENT ANALYSIS].