The Customer is the controller and AUTRADY EOOD (“Telmetra”) is the processor for customer-managed endpoint and remote-session data processed through the Service. Telmetra remains an independent controller for its account, billing, security, and partner-program activities.
Telmetra processes Customer Personal Data to provide remote support, endpoint monitoring, alerting, audit functions, file-transfer functions, security, automatic analysis of event logs and monitoring data (Telmetra Insights), and related support, according to the Customer’s documented instructions, including Service configuration.
Telmetra Insights produces findings and client reports with fixed rules and does not use an AI model. It is off for an organization until an administrator of that organization turns it on in Profile. The choice is recorded with who made it and when, and in an audit entry. While it is off, no computer of the organization is analysed and no findings are created or shown.
The Customer is responsible for determining the lawful basis, notices, authority, and safeguards required for its monitoring and remote-access activities. This includes enabling recording only where the Customer has satisfied applicable workplace, privacy, and other legal requirements.
Session recording is customer organization-enabled, not a default guarantee. When enabled, it may include screen recordings and selected input and audit data associated with a remote session. Telmetra retains these recording materials for 30 days after the session, subject to documented legal holds, customer-retention requirements, and other lawful exceptions.
Windows Event Logs are retained for 7 days. Many other operational records are subject to a 30-day operational retention period where the applicable cleanup applies. Telmetra Insights keeps findings and their evidence summaries for 30 days, per-day counts of event types for 35 days, and finding history (without event data) for one year after the finding was last seen. Computer inventory and history records, the audit log of remote sessions, and the list of blocked addresses have no age-based deletion at present; records tied to a computer are deleted with it, which happens 30 days after the computer is deactivated. No automatic deletion commitment is made here for account, billing, partner, or other records whose final retention schedule has not yet been established.
Telmetra applies technical and organizational measures appropriate to the risks of processing, including access controls, authentication, logging, and transport protections used by the Service. Access is limited to authorized personnel and contractors with a need to know. Remote-session content is relayed through Telmetra servers over TLS between each hop and is not end-to-end encrypted. This DPA does not make a representation about encryption at rest, immutable records, or any security certification unless separately documented in a signed agreement or verified service documentation.
Taking account of the nature of processing and information available to Telmetra, Telmetra will reasonably assist the Customer with data-subject requests, security obligations, and breach information relevant to Customer Personal Data. The Customer remains responsible for its controller obligations, including any regulatory notifications.
The Customer gives general authorization for Telmetra to use subprocessors that process Customer Personal Data in providing the Service, subject to applicable law and any signed agreement. The current public register distinguishes customer-data subprocessors from Telmetra controller-side providers and customer-selected integrations: Sub-processors and Service Providers.
Processing locations and any transfer safeguards depend on the provider, service, customer configuration, and deployment. Telmetra will use an applicable transfer mechanism where required by law, but does not state EU-only processing, a particular region, or a particular safeguard on this page without verified current evidence.
At the end of processing, Telmetra will handle Customer Personal Data in accordance with the Customer’s documented instructions, applicable law, and the Service’s available capabilities. Deletion, return, and certification requests are assessed case by case; this DPA does not promise an unimplemented automated account or record-deletion workflow.
Privacy and DPA enquiries: [email protected].
Data Protection Officer: The Article 37 DPO assessment is ongoing and periodically reviewed. Until an appointment is published, use the contact above.