Data processing and confidentiality
Last updated: October 2026 (draft)
This text is a draft and must be reviewed by a legal adviser before final publication.
Companies' financial and operational data is sensitive. This page explains how that data is received, processed, stored and deleted.
Confidentiality
Each client's data is processed only to carry out that project and only by the people authorised for it.
Where needed, a non-disclosure agreement (NDA) is signed before any data is received.
Separation of organisations' data
Each organisation's data is kept logically separate, and every request in the system is checked against that organisation's identifier; users of one organisation have no access to another organisation's data.
Secure transfer and storage
Files are received through the secure portal over an encrypted connection (HTTPS).
Files are stored in private storage and can be downloaded only after authentication and an access check. Access is recorded in the system (audit log).
Retention period
Project data is kept until the end of the contract and for at most 90 days afterwards, and then deleted, unless otherwise agreed in writing.
Backups are deleted automatically after 14 days under the rotating backup schedule.
Deletion on request
You can request deletion of your data at any time. Once your identity is confirmed, the data is deleted from the main system, and from backups in the next rotation cycle.