Skip to main content
Services Privacy Policy

Services Privacy Policy

How Batoi handles personal information while providing contracted services and operating the systems that support them.

Document guide

At a glance

Explains how personal information is handled when Batoi provides contracted services and operates supporting systems.

  • The policy distinguishes customer-controlled service data from operational data used to provide and secure services.
  • It describes instructions, security, incident handling, subprocessors, transfers, audit support, and deletion or return.
  • Website and contracting-contact information remains subject to the general Privacy Policy.

This summary helps you navigate the document. The complete policy text and any controlling agreement remain authoritative.

On this page
Review general privacy policy Legal and Governance Center

How this policy is organized

I

The first section (Services Personal Information Data Processing Terms) describes the privacy and security practices used by the Batoi contracting entity and any authorized affiliate involved in providing Technical Support, Consulting, Cloud, or other contracted services (the “Services”) to Batoi customers (“You” or “Your”) during the term of the applicable order.

Services Personal Information is personal information that is provided by You, resides on Batoi, customer or third-party systems and environments, and is processed by Batoi on Your behalf in order to perform the Services. Services Personal Information may include, depending on the Services: information concerning family, lifestyle and social circumstances; employment details; financial details; online identifiers such as mobile device IDs and IP addresses, and first party online behavior and interest data. Services Personal Information may relate to Your representatives and end users, such as Your employees, job applicants, contractors, collaborators, partners, suppliers, customers and clients.

II

The second section (System Operations Data Processing Terms) describes the privacy and security practices that apply to personal information that may be incidentally contained in Systems Operation Data that is generated by the interaction of (end-)users of our Services (“Users”) with the Batoi systems and networks used to monitor, safeguard and deliver Services to our customer base.

Systems Operations Data may include log files, event files, and other trace and diagnostic files, as well as statistical and aggregated information that relates to the use and operation of our Services, and the systems and networks these Services run on.

III

The third section (Communications and Notifications to Customers and Users) applies to both Services Personal Information and personal information contained in Systems Operations Data, describes how Batoi handles legally required disclosure requests, and explains how to contact the responsible privacy function or file a complaint.

The definitions of Services Personal Information and Systems Operations Data do not include Your or User contact and related information collected from the use of Batoi websites, or Your or User interactions with us during the contracting process. Batoi’s handling of this information is subject to the terms of the General Batoi Privacy Policy

Services Personal Information Data Processing Terms

Services Personal Information Data Processing Terms

Batoi treats all Services Personal Information in accordance with the terms of Sections I and III of this Policy and Your order for Services.

In the event of any conflict between the terms of this Services Privacy Policy and any privacy terms incorporated into Your order for Services, the relevant privacy terms of Your order for Services shall take precedence.

1

Performance of the Services

Batoi may process Services Personal Information for the processing activities necessary to perform the Services, including for testing and applying new product or system versions, patches, updates and upgrades, and resolving bugs and other issues You have reported to Batoi.

2

Customer instructions

Your and Batoi’s roles depend on the processing context. You may act as controller or processor, and Batoi may act as processor or subprocessor, as identified in the applicable order or data-processing terms. Batoi processes Services Personal Information to provide the Services and follow documented instructions, subject to applicable law. Batoi will inform You if, in its reasonable opinion, an instruction infringes applicable data-protection law, unless law prohibits that notice. Assistance outside the agreed Services may require a separate scope or fee.

3

Rights of individuals

You control access to Your Services Personal Information by Your end users, and Your end users should direct any requests related to their Services Personal Information to You. To the extent such access is not available to You, Batoi will provide reasonable assistance with requests from individuals to access, delete or erase, restrict, rectify, receive and transmit, block access to or object to processing of Services Personal Information on Batoi systems.

4

Security and confidentiality

Batoi has implemented and will maintain technical and organizational measures designed to prevent accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Services Personal Information. These measures, which are generally aligned with the ISO/IEC 27001:2022 standard, govern all areas of security applicable to the Services, including physical access, system access, data access, transmission, input, security oversight, and enforcement.

Batoi employees are required to maintain the confidentiality of personal information. Employees' obligations include written confidentiality agreements, regular training on information protection, and compliance with company policies concerning protection of confidential information.

5

Incident Management and data breach notification

Batoi promptly evaluates and responds to incidents that create suspicion of or indicate unauthorized access to or handling of Services Personal Information.

If Batoi becomes aware and determines that an incident involving Services Personal Information qualifies as a breach of security leading to the misappropriation or accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Services Personal Information transmitted, stored or otherwise processed on Batoi systems that compromises the security, confidentiality or integrity of such Services Personal Information, Batoi will report such breach to You without undue delay.

As information regarding the breach is collected or otherwise reasonably becomes available to Batoi and to the extent permitted by law, Batoi will provide You with additional relevant information concerning the breach reasonably known or available to Batoi.

6

Subprocessors

Where Batoi engages a subprocessor to process Services Personal Information, Batoi applies written data-protection and security obligations appropriate to the service, data, risk, and applicable agreement. Responsibility, authorization, objection, and notice rights are those stated in the applicable data-processing terms and law.

Information about affiliates and subprocessors relevant to an applicable Service is available through the customer’s approved service or privacy contact, subject to security and confidentiality limits.

7

Cross-border data transfers

Batoi entities, personnel, and approved providers may process Services Personal Information in more than one country where required to provide the applicable Service. Cross-border transfers use the safeguard required for the transfer and processing relationship, which may include the European Commission’s Standard Contractual Clauses or another lawful mechanism.

8

Audit rights

To the extent provided in your order for Services, You may at Your sole expense audit Batoi’s compliance with the terms of this Services Privacy Policy by sending Batoi a written request, including a detailed audit plan, at least six weeks in advance of the proposed audit date. You and Batoi will work cooperatively to agree on a final audit plan.

The audit shall be conducted no more than once during a twelve-month period, during regular business hours, subject to Batoi’s on-site policies and regulations, and may not unreasonably interfere with business activities. If You would like to use a third party to conduct the audit, the third-party auditor shall be mutually agreed to by the parties and the third-party auditor must execute a written confidentiality agreement acceptable to Batoi. Upon completion of the audit, You will provide Batoi with a copy of the audit report, which is classified as confidential information under the terms of Your agreement with Batoi.

Batoi will contribute to such audits by providing You with the information and assistance reasonably necessary to conduct the audit, including relevant records of processing activities applicable to the Services. Where an independent report or certificate exists, is current, is legally shareable, and addresses the requested scope, Batoi may provide that material through a secure channel in lieu of a duplicative review of the same controls. Any use remains subject to the document’s entity, service, period, purpose, confidentiality, and distribution restrictions. Additional audit terms may be included in Your order for Services.

9

Deletion or return of Services Personal Information

Deletion, return, export, transition, backup expiry, and legally required retention follow the applicable order, data-processing terms, service design, and documented retention schedule. When deletion is required, production access is removed and remaining copies are deleted or rendered inaccessible through the applicable backup and disposal cycle, unless law requires continued retention.

Systems Operations Data Processing Terms

Responsibility and purposes for processing personal information

Batoi and its affiliated entities are responsible for processing personal information that may be incidentally contained in Systems Operations Data in accordance with Sections II and III of this Policy. We may collect or generate Systems Operations Data for the following purposes:

  • to help keep our Services secure, including for security monitoring and identity management.
  • to investigate and prevent potential fraud or illegal activities involving our systems and networks, including to prevent cyber-attacks and to detect bots.
  • to administer our back-up disaster recovery plans and policies.
  • to confirm compliance with licensing and other terms of use (license compliance monitoring).
  • for research and development purposes, including to analyze, develop, improve and optimize our Services.
  • to comply with applicable laws and regulations and to operate our business, including to comply with legally mandated reporting, disclosure or other legal process requests, for mergers and acquisitions, finance and accounting, archiving and insurance purposes, legal and business consulting and in the context of dispute resolution.

For personal information contained in Systems Operations Data collected in the EU, our legal basis for processing such information is our legitimate interest in performing, maintaining and securing our products and services and operating our business in an efficient and appropriate manner. Personal information may also be processed based on our legal obligations or legitimate interest to comply with such legal obligations.

Sharing personal information

Personal information contained in Systems Operations Data may be shared throughout Batoi's organization.

We may also share such personal information with the following third parties:

  • third-party service providers (for example IT service providers, lawyers and auditors) in order for those service providers to perform business functions on behalf of Batoi.
  • relevant third parties in the event of a reorganization, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our business, assets or stock (including in connection with any bankruptcy or similar proceedings).
  • as required by law, such as to comply with a subpoena or other legal process, when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to government requests, including public and government authorities outside your country of residence, for national security and/or law enforcement purposes.

When third parties are given access to personal information contained in Systems Operations Data, we will take the appropriate contractual, technical and organizational measures to ensure, for example, that personal information is only processed to the extent that such processing is necessary, consistent with this Privacy Policy and in accordance with applicable law.

Cross-border data transfers

Where Systems Operations Data is transferred across borders, Batoi uses the safeguard required for the relevant transfer and processing relationship, which may include the European Commission’s Standard Contractual Clauses or another lawful mechanism.

Security

Batoi has implemented appropriate technical, physical and organizational measures designed to protect personal information against accidental or unlawful destruction or accidental loss, damage, alteration, unauthorized disclosure or access as well as all other forms of unlawful processing (including, but not limited to, unnecessary collection) or further processing.

User choices

To the extent provided under applicable law, Users may request access, correction, updating, or deletion of personal information contained in Systems Operations Data in appropriate cases, or otherwise exercise available choices through Batoi Contact.

Communications and Notifications to Customers and Users

1

Legal requirements

Batoi may be required to provide access to Services Personal Information and to personal information contained in Systems Operations Data as required by law, such as to comply with a subpoena or other legal process, when we believe in good faith that disclosure is necessary to protect our rights, protect Your or a User’s safety or the safety of others, investigate fraud, or respond to government requests, including public and government authorities outside Your or a User’s country of residence, for national security and/or law enforcement purposes.

Batoi will promptly inform You of requests to provide access to Services Personal Information, unless otherwise required by law.

2

Privacy contact

If You or a User believe that personal information has been used inconsistently with this policy, or have questions, comments, requests, or complaints about Batoi’s handling of personal information, submit the matter through Batoi Contact. Batoi will route it to the responsible privacy function.

3

Dispute resolution or filing a complaint

If You or a User have any complaints regarding our compliance with our privacy and security practices, please contact us first. We will investigate and attempt to resolve any complaints and disputes regarding our privacy practices.

Available escalation, dispute-resolution, arbitration, court, and regulatory-complaint rights depend on the applicable agreement, processing role, jurisdiction, and mandatory law. An individual may contact the competent data-protection authority where applicable.

4

Changes to this Services Privacy Policy

This Services Privacy Policy was first published on April 22, 2022 and was last updated on August 4, 2026. It may change over time to address legal requirements, service changes, or business needs. Material changes may also be communicated through an appropriate contract, service, account, email, or website notice.

Offices & Contacts Open Support