1. Roles
For customer content processed through the API, the customer is the controller and LATIAO is a processor. For account and billing data, LATIAO acts as an independent controller as described in the privacy policy.
2. Processor obligations
We process personal data only on documented instructions, apply appropriate technical and organisational measures, assist with data subject requests, and notify the controller without undue delay after becoming aware of a personal data breach.
3. Subprocessors
The controller authorises the engagement of subprocessors listed on the subprocessors page. We impose equivalent data protection obligations and give notice before adding a new subprocessor, with an opportunity to object.
4. International transfers
Where personal data is transferred outside the EEA/UK, the parties rely on an adequacy decision or standard contractual clauses, including the supplementary measures described in the security annex.
5. Return and deletion
On termination, personal data is deleted or returned within the period stated in the agreement, except where retention is required by law or for the establishment of legal claims.
6. Audits
We make available current security documentation and respond to reasonable audit questionnaires. On-site audits are available at most once per year, subject to confidentiality and cost allocation.
Questions about this document? Email [email protected] (placeholder). Responses to data protection requests are handled under the privacy policy.