Data Policy

Purpose and relationship to other documents

This draft sets out proposed rules for handling information placed in UnnatiOS by customers, partner agencies and authorised users. It covers operational data as well as personal information. The Privacy Policy addresses individual privacy, while the Terms & Conditions address use of the service.

A signed agreement or data-processing addendum should specify the relevant processing instructions and responsibilities. This general page is not a substitute for that agreement.

Customer content and instructions

Customers retain their rights in content they supply, subject to the rights of the individuals or other parties concerned. Use of UnnatiOS does not transfer ownership of customer records to UnnatiOS.

The proposed permission to handle customer content is limited to providing and supporting the agreed service, following lawful documented instructions and meeting applicable legal obligations. Customer data must not be treated as unrestricted material for unrelated purposes.

Types of business data

• Marketing and sales: enquiry forms, contacts, pipeline records, follow-ups and communication history.
• Operations: tasks, projects, staff records and activities within enabled tools.
• Education: admissions, student information and learning or administrative records within enabled modules.
• Finance: invoices, fees, expenses and transaction records that the customer enters or connects.
• System administration: user permissions, configuration, audit or diagnostic information and integration settings.

The actual data involved depends on the modules, fields and integrations used by each organisation.

Customer and agency responsibilities

Customers are responsible for choosing appropriate purposes, providing notices, obtaining required permissions, maintaining accurate records and limiting collection to what is needed. An agency acting for a client must have the client’s authority and comply with its instructions.

Do not upload confidential information you are not authorised to use. Discuss highly sensitive, regulated or unusually large data sets before uploading them, so that contractual and technical suitability can be assessed.

Users, permissions and support access

Account administrators should assign access according to each user’s role, review access regularly and promptly remove access when a person leaves. Shared credentials should not be used as a substitute for individual authorised accounts.

Partner agencies work within the client assignments and permissions provided to them. Any support access to customer content should be necessary for an authorised support task, limited in scope and managed under the applicable access procedures. Account transfers and deletion requests require appropriate authorisation.

Integrations and communication channels

Connecting WhatsApp, email, SMS, calling, payments or another supported service may send customer data to an external provider. The account administrator must review that provider’s terms, permissions and data practices before enabling the connection.

Customers are responsible for appropriate messaging consent, lawful contact lists and compliance with provider rules. Disabling an integration may stop future transfers without deleting records already held by the external provider.

AI features and automated workflows

AI and automation should be enabled only for suitable, authorised purposes. Review the information that a prompt, workflow or connected agent can access, and minimise confidential or personal data sent to an external model provider.

Provider retention, model-training use and processing locations depend on the actual provider and configuration; these must be confirmed before making commitments to customers. This draft does not promise that every AI provider has zero retention or excludes model training.

Review AI-generated output before relying on it or sending it externally. Use appropriate human oversight for actions affecting admissions, employment, payments or other significant decisions.

Hosting and processing locations

Hosting, infrastructure and other technology providers may process information as part of service delivery. Their identities, locations and contractual safeguards should be documented in the applicable service or data-processing arrangements.

Where information is processed across borders, the applicable transfer restrictions and safeguards must be assessed. This page does not promise that all information remains in a particular country.

Security and incidents

Proposed safeguards include appropriate access management, secure configuration, monitoring, provider controls and incident handling, subject to verification of the actual implementation. No certification, encryption standard, backup frequency or uptime level is represented by this draft.

Report a suspected incident to info@unnatios.com with relevant non-sensitive details. Incident handling should include assessment, containment, investigation and legally required notifications. Applicable statutory deadlines take priority over internal procedures.

Retention and backups

Customers should establish retention requirements for their records and communicate those requirements where platform assistance is needed. The service’s retention schedule must separately address active records, logs, support records, backups and legally required records.

A deletion request may require verification and may be affected by a legal hold or mandatory retention obligation. Backup expiry must be described accurately; this draft does not promise immediate erasure from every backup or external service.

Exports, closure and offboarding

Before requesting deactivation, the authorised customer or agency should identify any records that need to be exported, check available formats and confirm a handover plan with UnnatiOS. Export availability, scope and timing depend on the enabled tools and agreed arrangement; a complete export of every internal system record is not assumed.

Account deactivation, permanent deletion and transfer are different actions. They should be requested explicitly and performed only after checking authority, applicable obligations and the agreed offboarding procedure. Customers should retain their own copies of business records where required.

Requests and contractual confirmation

Send data-handling questions, export requests or proposed processing restrictions to info@unnatios.com. Include the organisation, relevant account and requested action.

Before processing begins, the parties should confirm any required data-processing agreement, provider information and documented instructions. Material changes to the published policy should be communicated as required by the applicable agreement and law.