General Data Protection Regulation (GDPR) Policy

_Last reviewed: 23 June 2026 · Effective: 23 June 2026 · Document owner: Silux Connect, Data Protection Office_

This General Data Protection Regulation Policy explains how Silux Connect complies with Regulation (European Union) 2016/679 (the General Data Protection Regulation, hereafter the "GDPR") and the equivalent United Kingdom General Data Protection Regulation as retained by the Data Protection Act 2018. It supplements, and is referenced from, our Privacy Policy, Data Processing Agreement, Acceptable Use Policy, Sub-processor list, Cookie Policy, and Terms and Conditions.

If anything in this policy conflicts with the Data Processing Agreement signed with your organisation, the executed Data Processing Agreement controls.

1. Roles under the General Data Protection Regulation

Scenario	Controller	Processor
You sign in to Silux Connect with your own work email	You / your employer	Silux Connect
A Silux Connect customer's technician runs a remote support session against an end-user device	The Silux Connect customer	Silux Connect
A visitor reads our public marketing pages and we record analytics	Silux Connect	n/a (first-party only — see Cookie Policy)
A prospect submits a sales enquiry form	Silux Connect	n/a

Silux Connect therefore acts as a processor on behalf of customers for in-product personal data, and as a controller for marketing, billing, and corporate-relationship data.

2. Lawful bases we rely on

We rely on the following lawful bases set out in Article 6(1) of the General Data Protection Regulation:

Article 6(1)(b) — Performance of a contract. Authenticating users, brokering remote sessions, enrolling devices, sending operational notifications, and storing session recordings against the tenant's retention setting.
Article 6(1)(c) — Legal obligation. Tax records, anti-fraud logs, sanctions screening, and lawful-intercept compliance where mandated.
Article 6(1)(f) — Legitimate interests. Product security (rate-limiting, intrusion detection, audit logs), fraud prevention, and aggregated service-improvement analytics. Our Legitimate Interest Assessments are documented internally and available on request.
Article 6(1)(a) — Consent. Optional analytics cookies, marketing emails, the Session Monitor add-on's discretionary categories, and feature-feedback surveys. Consent is captured granularly via our cookie banner and the in-product notification settings page, and can be withdrawn at any time without affecting service.

For special-category data (Article 9), Silux Connect does not intentionally process special-category data on behalf of customers; customers who choose to remote-control devices that display such data remain responsible for their own Article 9 lawful basis.

3. Data subject rights

European Union and United Kingdom data subjects have the following rights, and we honour requests free of charge within 30 calendar days (extendable by up to 60 days under Article 12(3) for complex requests, with notice):

Right of access (Article 15) — request a copy of the personal data we hold about you.
Right to rectification (Article 16) — correct inaccurate or incomplete data.
Right to erasure / "right to be forgotten" (Article 17) — delete personal data when no longer necessary, when consent is withdrawn, or where processing is unlawful.
Right to restriction of processing (Article 18) — pause processing while a dispute is investigated.
Right to data portability (Article 20) — receive your personal data in a structured, commonly-used, machine-readable format. Silux Connect exports tenant data as JSON via the documented API or as a one-click export from the admin dashboard.
Right to object (Article 21) — object to legitimate-interest processing or to direct marketing.
Right not to be subject to solely-automated decision-making (Article 22) — no fully-automated decision with legal or similarly-significant effect is taken about a data subject by Silux Connect.
Right to withdraw consent (Article 7(3)) — at any time, with the same ease consent was given.
Right to lodge a complaint with a supervisory authority (Article 77) — see section 12 below.

How to exercise a right: email dpo@silux.io with the request and proof of identity. End-users of a Silux Connect customer should first contact the customer (the controller); we will support the controller in responding.

4. Data we process and why

A non-exhaustive summary; the Privacy Policy is the canonical inventory.

Category	Examples	Purpose	Retention
Account identity	Name, work email, role, tenant	Authentication, authorisation, audit	Account lifetime + 90 days
Authentication	Hashed password (Argon2 / bcrypt), Time-based One-Time Password seed, WebAuthn / passkey credential ID	Login, multi-factor authentication	Account lifetime
Device telemetry	Device ID, operating system, agent version, last-seen timestamp	Endpoint inventory, security alerts	Account lifetime + 90 days
Session metadata	Session ID, technician, target device, start / end timestamps, bytes transferred	Operations, billing, support, audit	Tenant retention policy (default 365 days)
Session recordings	Video frames + audio for sessions where recording is enabled	Customer-controlled audit	Tenant retention policy
Session Monitor events	Process name, kind, runtime duration, local-or-Secure-Shell flag — never keystrokes, file contents, terminal output, or browser URLs	Build / coding-session notifications	Tenant retention policy (default 90 days)
Notifications log	Recipient, category, delivery channel, timestamp	Audit, compliance evidence	12 months minimum (SOC 2)
Support correspondence	Tickets, in-product chat	Customer support	Up to 3 years for evidentiary purposes
Billing	Company name, billing email, payment instrument token (held by our payment processor, not by us)	Invoicing, tax	7 years (legal)
Marketing	Public-form submissions, marketing-opt-in flag	Outbound marketing on consent	Until consent withdrawn

5. International data transfers

Silux Connect is incorporated and headquartered outside the European Economic Area and the United Kingdom. When personal data is transferred outside the European Economic Area or the United Kingdom, we rely on:

European Commission adequacy decisions where applicable (for example, transfers to United Kingdom-based sub-processors continue to benefit from the European Commission adequacy decision for the United Kingdom; transfers to the United States rely on the European Union — United States Data Privacy Framework where the receiving organisation is certified).
Standard Contractual Clauses (Commission Implementing Decision (European Union) 2021/914) appended to every sub-processor agreement, together with the United Kingdom International Data Transfer Addendum where the data exporter is in the United Kingdom.
Transfer Impact Assessments documented per sub-processor in line with the European Data Protection Board's Recommendations 01/2020, with supplementary measures (encryption in transit and at rest, key custody) recorded.

The live, current list of sub-processors and their hosting regions is published at /subprocessors. Customers receive at least 30 days' notice of new sub-processors and may object before the change takes effect.

6. Security of processing (Article 32)

Silux Connect implements appropriate technical and organisational measures including:

Encryption in transit — Transport Layer Security 1.2 or higher for every public endpoint; the Silux Relay session protocol (Silux Connect's first-party SXTL1 wire format) wraps the session payload in an authenticated tunnel.
Encryption at rest — full-disk encryption on database volumes, server-side encryption on object storage.
Access control — role-based access control plus mandatory multi-factor authentication for every Silux Connect employee with production access; principle of least privilege; just-in-time elevation with audit.
Network controls — private virtual private cloud, no public database endpoints, edge proxy with rate-limiting and Web Application Firewall.
Logging and monitoring — append-only audit logs of every privileged action; immutable retention.
Software supply chain — Software Bill of Materials maintained per release; dependency vulnerability scanning at build time.
Backup and recovery — encrypted backups with documented Recovery Point Objective and Recovery Time Objective; restoration tested at least quarterly.
Personnel security — background checks where lawful; annual privacy and security training; written confidentiality undertakings.
Penetration testing — independent third-party penetration test at least annually; remediation tracked in our risk register.

See the Trust Center for the full posture mapping.

7. Data breach notification (Articles 33 and 34)

If Silux Connect, as processor, becomes aware of a personal data breach affecting customer personal data, we notify the relevant controller without undue delay and in any event within 24 hours of confirming the incident, providing:

the nature of the breach and the categories and approximate number of data subjects and records concerned;
the likely consequences;
the measures taken or proposed to address the breach and to mitigate adverse effects.

Where Silux Connect is a controller, we notify the competent supervisory authority within 72 hours of becoming aware and the affected data subjects without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

8. Data Protection by Design and by Default (Article 25)

Privacy considerations are part of the product specification, not a post-hoc compliance check. Concrete examples in Silux Connect:

Session Monitor captures only process name, kind, runtime duration, and local/Secure-Shell flag — keystrokes, terminal output, file contents, browser URLs and page contents are never captured. This is enforced in agent/crates/silux-agent-core/src/coding_monitor.rs, not just policy.
AI assistant output is advisory only; the model backing it is configurable per deployment by an administrator.
Self-host parity — every feature available on the hosted edition is available on the self-host edition, so a customer that cannot lawfully use a cloud processor can keep all personal data on-premises.
Multi-tenancy isolation — tenant identifiers are part of every row's primary key path and every query predicate is automatically tenant-scoped at the database layer.

9. Records of processing (Article 30)

Silux Connect maintains:

a Record of Processing Activities as controller covering marketing, billing, hiring, and corporate-relationship processing;
a Record of Processing Activities as processor per customer, derived from the executed Data Processing Agreement and the live sub-processor list.

Both are reviewed at least annually and made available to supervisory authorities upon lawful request.

10. Data Protection Impact Assessments (Article 35)

Silux Connect conducts a Data Protection Impact Assessment when a new feature is likely to result in a high risk to data subjects (for example: large-scale processing of special-category data, systematic monitoring of a publicly-accessible area, or innovative use of artificial intelligence). Customers requiring our input for their own Data Protection Impact Assessment can request the relevant Silux Connect documentation via dpo@silux.io.

11. Data Protection Officer

Silux Connect has appointed a Data Protection Officer who can be reached at:

Email: dpo@silux.io
Post: Data Protection Officer, Silux Connect, c/o the registered office set out in the Trust Center.

The Data Protection Officer reports directly to senior management and is independent in their function (Articles 38 and 39).

12. Supervisory authorities

Data subjects may lodge a complaint with the supervisory authority of the European Union Member State of their habitual residence, place of work, or place of the alleged infringement (Article 77). Examples:

United Kingdom — Information Commissioner's Office (ICO), https://ico.org.uk/
Ireland — Data Protection Commission (DPC), https://www.dataprotection.ie/
Germany — the competent Landesdatenschutzbeauftragter for the relevant Land
France — Commission nationale de l'informatique et des libertés (CNIL), https://www.cnil.fr/
Netherlands — Autoriteit Persoonsgegevens (AP), https://www.autoriteitpersoonsgegevens.nl/

The full register of European Economic Area supervisory authorities is maintained by the European Data Protection Board at https://edpb.europa.eu/.

We always prefer that a data subject reach us first via dpo@silux.io so we can attempt to resolve the issue directly; this in no way affects the right to lodge a complaint.

13. Changes to this policy

We may amend this General Data Protection Regulation Policy from time to time. Material changes will be:

announced at least 30 days in advance to the primary contact on each customer tenant; and
summarised in the Changelog with the effective date and a link to the prior version.

The current version always lives at this URL.

14. Contact

Topic	Contact
Data Protection Officer / General Data Protection Regulation requests	dpo@silux.io
Data Processing Agreement signature	legal@silux.io
Security incident report	security@silux.io
All other enquiries	hello@siluxconnect.com

_This General Data Protection Regulation Policy is provided in plain English. A Data Processing Agreement signed between you and Silux Connect is the legally controlling instrument for the processing of personal data on your behalf._

General Data Protection Regulation Policy