Privacy
Baseline: 4 September 2026.
Assisted pilot · self-service blockedData controller
The operator's legal details have not yet been published. CERTACTUM therefore does not enable self-service contracting or checkout. Commercial use is limited to pilots and assisted contracting, with contractual identification supplied before any payment.
1. Data processed
Depending on use, CERTACTUM may process account and contact data, organisation and project data, change records, evidence and related metadata, notices, decisions, messages, field-team data, clock events, project contacts, audit logs and commercial requests.
2. Purposes
Data is processed to provide and protect the service, authenticate users, isolate organisations, maintain records and audit trails, support project workflows, respond to support or pilot requests and comply with applicable legal obligations.
3. Lawful bases
The applicable basis depends on context: performance of a contract or pre-contractual steps for use of the service; legitimate interests for security, abuse prevention and continuity; consent where explicitly requested; and legal obligation where applicable. Customers introducing worker, witness or third-party data remain responsible for defining their own lawful basis when acting as controllers.
4. Subprocessors and infrastructure
The service may use hosting, database, email and other technical providers strictly necessary for operation. Activation of new providers must comply with applicable controls and contracts.
5. Retention
Data is retained while necessary to provide the service, preserve the operational trail and meet legal or contractual obligations. Specific retention policies may be agreed contractually for enterprise customers.
6. Security
Current controls include Row Level Security isolation on product tables, authentication, audit trails, reviews and evidence-integrity mechanisms. No control eliminates risk entirely.
7. Rights
Where the GDPR or equivalent law applies, data subjects may have rights of access, rectification, erasure, restriction, objection and portability, subject to legal conditions. Requests should be sent to the privacy contact identified on this page once configured.
8. Marketing
Public pilot/demo requests use explicit consent. A previous suppression or unsubscribe request is not automatically removed by a new form submission.
9. International transfers
Where providers process data outside the European Economic Area, legally appropriate transfer mechanisms must be in place when required.