11. Data Protection and Privacy Management
11.1 Data Classification
Information handled by OpenRemote is classified according to its sensitivity and importance to the organisation. Classification in three categories helps determine appropriate protection measures for each type of information: internal documentation, customer data, and publicly available information.
Internal documentation and customer data are assigned an owner and shared on a need to know basis with the team as indicated in Tools, Systems and Evidence Repositories. Publicly available information is listed in the same overview.
11.2 Retention Policy
OpenRemote retains operational and organisational records for an unlimited period unless legal, operational, or contractual requirements require a limited retention period.
When required, data is securely deleted or archived.
11.3 Data Subject Rights Handling
This is work in progress and not fully implemented yet, as OpenRemote, we are working on this subject and will publish an update soon.
When personal data is processed, OpenRemote supports the rights of individuals as defined by GDPR, including requests for access, correction, or deletion of personal data.
Requests are handled through defined procedures and documented accordingly.