GDPR Readiness

1. Roles and scope

A managed Secuvon operator may act as processor for customer-provided scan data and as controller for its own account, security, and billing records. In a self-hosted installation where no data is sent to NexPhase Technology Limited, the customer controls that environment and NexPhase may have no processor role. The signed terms determine the actual role.

2. Product controls

• Authenticated data export in the full edition; hosted MVP users can request a copy through the contact route below.
• Password-confirmed account deletion in hosted MVP Settings and Security, subject to billing safety checks.
• Retention settings exist in the full edition; global customer-data purge is disabled pending tenant-scoped controls.
• Role-based access, MFA support, audit trails, and encrypted provider credentials.
• Deployment controls for TLS, secure cookies, trusted hosts, and offsite backups.

These capabilities support an organisation's process; they do not by themselves establish a lawful basis, satisfy a data-subject request, or prove compliance.

3. Location and transfers

The current hosted deployment runs on Railway in its US region sfo. Cloudflare handles traffic at its global edge. The current provider inventory and its reconciliation status are on the trust page. Transfer mechanisms still need operator and counsel review before contractual promises are made. Self-hosted deployments may differ. Assessment content is sent to the AI provider the customer selects.

4. Personal-data incidents

Incidents are assessed under the documented response plan. Where Secuvon is a processor, it must notify the controller without undue delay as required by the applicable DPA. Where it is a controller and a breach is likely to risk people's rights and freedoms, the competent supervisory authority must be notified without undue delay and, where feasible, within 72 hours after awareness. High-risk impacts can also require notice to affected people without undue delay.

5. Requests, DPOs, and DPIAs

Privacy requests can be submitted through the contact form. Secuvon does not claim that a statutory DPO has been appointed or that a DPIA has been completed. Those steps are required only in the circumstances set by law and must be assessed from the actual processing.

Individuals may lodge a complaint with the supervisory authority that is competent for their situation. See the European Commission's GDPR obligations guidance.