Legal & data residency

Controller and processor

For your end users’ personal data, you are the controller and Oclavex is your processor: you decide what is collected and why, and Oclavex processes it on your instructions to run licensing, metering, and analytics. The mechanics of that processing — how a data-subject request is filed and executed — are in Privacy & DSR.

Data processing agreement

A Data Processing Agreement (DPA) governs this relationship: the categories of data processed, the purposes, sub-processors, security measures, and the data-subject-request workflow the platform implements. Request the current DPA from [email protected] as part of onboarding; it is signed alongside the commercial agreement.

Data residency

Your tenant’s data is stored in the region of the Oclavex deployment you are provisioned into. For the hosted service this is disclosed at onboarding; for a self-hosted or dedicated deployment, residency is wherever you operate it. If you have a specific residency requirement (a particular jurisdiction, or in-region processing only), raise it during onboarding so you are placed in an appropriate deployment, or one is provisioned for you.

Terms and privacy policy

The terms of service and privacy policy governing use of the platform are provided with your commercial agreement and linked from the portals. This documentation describes how the platform behaves; it is not itself the contract.