Data protection and information security

In projects we build or operate for a company, that company (the client) is the data controller and decides why and how data is used. INTEDIG acts as data processor: it processes the data only on the client’s behalf and following its instructions. When INTEDIG decides the purposes and means of its own processing (for example, the commercial management of its relationship with the client), it acts as controller.

With each client we put in place a data processing agreement or clauses under Article 28 GDPR, setting out the subject matter, duration, nature and purpose of the processing, the types of data, the categories of data subjects and the obligations of both parties.

We process data solely to provide the contracted service and in accordance with the client’s documented instructions. If an instruction seems to us contrary to the rules, we tell the client immediately.

Only people who need it to provide the service have access to the data, bound by a duty of confidentiality that continues after the relationship ends.

We apply measures proportionate to the risk, including:

• Encryption of communications in transit (TLS) and, where the infrastructure allows, of data at rest.
• Least-privilege access control, strong authentication (two-step verification) on critical systems and periodic review of permissions.
• Separation of environments (development, testing and production) and use of fictitious or anonymized data in development whenever possible.
• Management of secrets and credentials outside the source code.
• Activity logging and backups with restoration tests.
• Updating and vulnerability management of dependencies and infrastructure.
• Security review of code before it goes into production.
• Security and data-protection training and awareness for the team.

To provide the service we may rely on infrastructure providers (hosting, databases, e-mail, payments, messaging) and artificial intelligence providers. We select them for their guarantees, sign contracts with them that impose equivalent obligations, and remain answerable to the client for their compliance. We inform the client of the sub-processors involved in its project and notify relevant changes so it can object.

Whenever the project allows, we prefer to locate data in European Union regions. If a provider processes data outside the European Economic Area, we require appropriate safeguards: an adequacy decision (for example, the EU-US Data Privacy Framework), the European Commission’s standard contractual clauses and, where appropriate, supplementary measures.

• We do not use a client’s data to train our own or third-party models or for other clients’ projects.
• We configure AI services, where the provider allows it, so that they do not keep data longer than necessary and do not use it for their own training.
• We minimize the personal data sent to models and, where possible, pseudonymize or anonymize it.
• We document with the client the purpose, the data used and the limitations of each AI solution.

Through appropriate technical and organizational measures, we help the client to handle requests for access, rectification, erasure, restriction, portability and objection. If we receive a request from a data subject concerning a client’s data, we forward it without delay.

If we detect a security breach affecting personal data processed on the client’s behalf, we notify the client without undue delay and with the information available, so that it can meet its duty to notify the supervisory authority and affected individuals where required. We investigate the cause and apply corrective measures.

When the contract ends, and as the client chooses, we return the data in a commonly used format or delete it, including copies, unless a rule requires it to be kept. Backups are deleted in line with their rotation cycle.

We make available to the client the information needed to demonstrate compliance with these obligations and cooperate with reasonable audits, on prior notice and respecting the confidentiality and security of other clients.

For questions about data protection and security, or to request the current list of sub-processors for a project, write to us through the contact form on this website.