The organisational and technical commitments Baalvion makes to protect personal data, complementing the Privacy Policy.
1. Principles
Baalvion handles personal data according to established data-protection principles:
- Lawfulness, fairness, and transparency.
- Purpose limitation — data is used only for the purposes for which it was collected.
- Data minimisation — we collect the least data necessary.
- Accuracy — we keep data correct and current.
- Storage limitation — we retain data only as long as needed.
- Integrity and confidentiality — data is secured against loss and unauthorised access.
- Accountability — we can demonstrate compliance with these principles.
2. Technical measures
- Encryption of data in transit using TLS, and encryption of sensitive data at rest.
- Passwordless authentication and signed, short-lived sessions — no stored passwords to leak.
- Tenant isolation and row-level access controls so each organisation’s data stays separated.
- Least-privilege access for staff and services, with audit logging of sensitive actions.
- Rate limiting, abuse detection, and human-verification on authentication endpoints.
3. Organisational measures
- Access to personal data is restricted to those who need it for their role.
- Processors are engaged only under written data-processing agreements.
- Security and privacy are reviewed as part of how systems are designed and changed.
4. Processors and sub-processors
We use vetted infrastructure providers, including Amazon Web Services (Amazon SES for transactional email) and Cloudflare (edge delivery and bot mitigation). Each processes data only on our instructions and under contract. A current list of material sub-processors is available on request to privacy@baalvion.com.
5. Data-subject requests and breach response
We respond to data-subject requests within the timeframes required by applicable law. In the event of a personal-data breach that poses a risk to individuals, we will assess, contain, and notify affected parties and regulators as required.
6. Contact
For data-protection matters, including to exercise your rights or request our sub-processor list, contact privacy@baalvion.com.