Our role
For direct website, prospect and business-contact interactions, Enfinity generally acts as the controller. For personal data a customer places in an Enfinity tenant, the customer normally determines the purposes and means of processing and acts as controller; Enfinity acts as processor under documented instructions and the applicable agreement.
The applicable legal entity, customer agreement and mandatory local law determine the final allocation of responsibilities. This page does not replace a data-processing agreement or legal advice.
Personal data and purposes
Enfinity may process business contact, account, identity, employment, payroll, customer, support, security, audit and diagnostic information where configured by a customer or needed to operate the service. Purposes include responding to enquiries, providing and securing services, administering accounts, supporting customers, meeting legal obligations and improving aggregate service reliability.
Customers remain responsible for choosing appropriate data, giving required notices, identifying lawful bases, configuring access and retention, and ensuring that special-category data is processed lawfully.
Data-subject rights
Depending on the applicable law and role, individuals may request access, correction, deletion, restriction, portability or objection, and may withdraw consent where processing relies on consent. Requests concerning records held in a customer tenant should normally be made to that customer first; Enfinity supports the customer’s documented instructions and the applicable agreement.
We may verify identity and authority before acting. We keep a proportionate record of requests and responses, and we may retain information where required for legal claims, security, audit, statutory retention or another lawful exception.
Security, incidents and accountability
Enfinity provides tenant isolation, authorization, audit trails, consent records, data-subject request workflows, retention-policy controls and a security-incident register. These are operational safeguards; no system can guarantee complete security.
A security incident is assessed by the responsible organization and recorded through the incident workflow. The customer remains responsible for controller-side notification decisions; Enfinity will follow the applicable customer agreement and incident-response obligations when acting as processor.
Retention and deletion
Information is retained only for the applicable purpose, agreement, customer instruction, legal obligation or documented retention policy. Enfinity supports data-subject erasure and product-level providers, but deletion may be subject to lawful retention exceptions and the documented handling of backups, audit records, integrations and other derived copies.
Retention periods must be confirmed for the relevant jurisdiction and business record. Enfinity’s data-residency and region-pinning work is explicitly outside this closure program and is not represented as complete by this page.
Processors and international transfers
Enfinity may use infrastructure, communications, payment, support, identity, AI and other service providers listed in the customer-facing or administrative sub-processor records where applicable. Customers should review the current registry and applicable agreement before enabling a service.
Cross-border processing requires the transfer assessment and safeguards applicable to the relevant controller, processor, jurisdiction and agreement. This page does not claim that a particular transfer mechanism or sub-processor agreement exists until it has been confirmed and recorded.
AI and special-category data
AI features are subject to platform policy, metering and audit controls. Consent gating is enforced for supported identified-data features, while rollout across every personal-data AI feature remains an implementation responsibility and must not be assumed from this page alone.
Customers must not enable special-category or high-risk processing without completing the required lawful-basis, necessity, proportionality, access-control and DPIA review. The HCM biometric and health-data DPIA remains an owner-reviewed document, not a completed legal assessment.
Contact and complaints
For a privacy question or data-subject request, contact Enfinity through the Contact page and identify the service, organization and relationship involved. Requests relating to a customer tenant may be referred to the relevant customer controller.
Where applicable law gives you a right to complain, you may contact the supervisory authority competent for your situation. The correct authority depends on the controller, establishment, residence and processing circumstances; Enfinity does not select an authority on an individual’s behalf.
Updates
We will update this page when the website, services, documented controls or applicable requirements change. The current Privacy Notice and customer agreement remain the controlling documents for their respective scopes.