Data protection statement

Controller and processor roles

PrivacyStead is the controller for website enquiries, early access registrations and its own business administration. For casework placed in a customer workspace, the customer organisation is normally the controller and PrivacyStead is its processor. Production customers should receive contractual processing terms covering instructions, confidentiality, security, subprocessors, assistance with individual rights, breach support, deletion and audit information.

Security approach

• Role based access controls for administrators, DPOs, caseworkers and viewers.
• Signed, time limited authentication sessions and password hashing.
• Tenant scoped records, audit events and controlled case actions.
• Secure transport through HTTPS and managed cloud infrastructure.
• Data minimisation in public tools: the deadline calculator stores no entered case data.
• Review of suppliers and access needed to operate the service.

Security is an ongoing process. These measures describe the current prototype and design direction; they are not a claim of independent certification.

Individual rights and incidents

We support customers in responding to applicable individual rights requests and in investigating personal data incidents. Customers remain responsible for deciding how a request concerning their casework should be answered and whether a personal data breach must be reported. PrivacyStead will notify an affected controller without undue delay after becoming aware of a breach involving that controller’s personal data, subject to the applicable processing agreement.

Data protection by design

New features should be reviewed for necessity, proportionality, access, retention, disclosure and supplier risk. Higher risk processing should undergo a data protection impact assessment before launch. Default settings should limit data collection, visibility and retention to what the intended workflow requires.

Contact

For privacy or data protection questions, email PrivacyStead@pm.me.