Data processing and exit
Follow the responsibilities around your data.

1. Roles and applicable agreement

The customer normally determines the purposes and lawful instructions for its workforce and business records. Skylinx Global Solutions acts as processor or subprocessor for those instructed activities. Separate billing, security or statutory purposes are assessed according to their actual role.

The accepted Data Processing Addendum and processing schedule identify parties, modules, data categories, individuals, purposes, duration, authorised users and applicable security or regional requirements. This public summary does not execute a DPA or replace those particulars.

2. Purpose limits, sensitive data and AI

Processing is restricted to documented lawful instructions and applicable duties. Instructions do not authorise unlawful collection, unrestricted disclosures or an unrelated new purpose. A material purpose change requires the appropriate agreement, notice and legal ground.

Independent general-purpose model training on customer content is prohibited. Customer-specific tuning and approved external AI access require a separate purpose and an identified provider chain, permitted inputs, locations, retention, training restrictions and human permissions.

Payroll bank details, health or biometric data, authentication secrets and other restricted fields require their relevant safeguards. Credentials and prohibited authentication data must not be placed in ordinary documents, chat or support messages.

3. Providers, locations and transfers

Primary Emplinx product hosting is Oracle Cloud Infrastructure, India South (Hyderabad), ap-hyderabad-1. The actual processing register identifies provider legal entities, deployed services, backup and recovery locations, support access and AI or communication recipients.

Engaged subprocessors require suitable contractual restrictions and security obligations. Material changes follow the accepted notice and objection process. Skylinx remains responsible for its contracted provider duties; an infrastructure supplier’s involvement is not an automatic exemption.

An overseas transfer requires the applicable lawful mechanism and safeguards. An India primary region does not alone establish exclusive India processing, and a general regional addendum does not replace a required completed transfer instrument.

4. Rights assistance and security incidents

The standard accepted DPA provides acknowledgement and forwarding of customer-controlled rights requests within one business day and available substantive assistance within five business days, sooner where required to meet the legal deadline. Urgent matters are escalated immediately. Internal routing does not restart a statutory clock.

The standard incident clause requires an immediate preliminary alert, no later than one elapsed hour after first awareness or receipt of a credible security event that may compromise customer-data confidentiality, integrity or availability, materially disrupt the covered service, or require an incident report. A final confirmed breach classification is not needed to trigger that alert.

Known facts, uncertainty, protective steps, contacts and staged updates are communicated through the accepted primary and fallback routes. Ordinary support hours do not postpone incident duties, and earlier independent statutory obligations remain applicable.

5. Security, evidence and audit

The accepted security schedule defines safeguards appropriate to the data and service, including attributable access, permission boundaries, confidential handling and relevant recovery measures. Scope-specific evidence identifies the service, date, limitations and remediation.

Ordinary assurance requests receive available relevant evidence or a reasoned secure-access arrangement within ten business days under the standard framework. Urgent legal or incident needs take priority. Confidentiality arrangements protect secrets without defeating lawful audit or regulator access.

A security policy, hosting location or provider certification does not by itself establish tested tenant isolation, application certification or universal compliance.

6. One exit date and clear outer deadlines

Day 0 is the effective end of the affected processing service. Ordinary processing stops then. The customer chooses lawful return, deletion or an agreed combination; absent a different lawful instruction, the standard accepted DPA follows export then deletion.

Agreed return or export is due by day 30, ordinary active-content deletion by day 90 and scheduled backup expiry by day 180, all measured from day 0. These are outer deadlines rather than successive extra retention periods. Earlier lawful instructions and mandatory regional duties take priority.

Relevant replicas, caches, derived records, embeddings and engaged-provider copies follow the instruction. Precise statutory retention or legal holds have an owner, restricted purpose, review and expiry. Restrictions and deletion instructions must be reapplied before a restored backup returns to ordinary use.

7. Included export and completion statements

Ordinary included export comprises the customer’s agreed module records in CSV or JSON, original attachments, necessary identifiers, relationships, timestamps, relevant audit and configuration records, and a schema or data dictionary. It is delivered through an authorised secure route and checked against the agreed inventory.

Source code, general model weights, another tenant’s records and lawfully restricted third-party material are excluded without obstructing mandatory portability or switching rights. Basic export and deletion assistance are included; optional bespoke migration or transformation requires an accepted reasonable quote.

Within ten business days after active deletion completes, the standard framework provides a qualified completion statement. A final backup confirmation or accurate exception record follows within ten business days of backup expiry completion. Statements identify actual scope and lawful residual copies; they do not certify an independent recipient beyond Skylinx’s authority.

Where EU Data Act switching applies, its transition, post-transition retrieval, erasure and charge rules override inconsistent ordinary exit terms. Optional migration charges cannot obstruct a statutory individual right or required switching.

8. Processing questions and applicable addenda

Contact privacy@skylinxglobal.com for the applicable DPA, processing schedule, rights assistance and location or recipient information; legal@skylinxglobal.com handles contract particulars and security@skylinxglobal.com handles incident concerns.

International privacy, regulated healthcare and other special services require the instruments applicable to the actual use case. A general workforce subscription or policy acknowledgement does not automatically execute a transfer agreement or healthcare addendum.