FuseBase GDPR and Data Protection Information

1 About this page

This page explains how FuseBase, addresses data-protection responsibilities across its SaaS platform, apps, AI features, managed hosting and agreed implementation services. Read it with our Privacy Policy, Data Processing Agreement ("DPA") and Third-Party Services disclosures.

The Privacy Policy provides the detailed notice of our processing activities. The DPA governs processing we perform on customers' behalf and retains its contractual precedence. This page does not replace either document, amend a signed agreement or certify that every customer implementation complies with the GDPR.

The EU GDPR's application depends on the activity and territorial scope, including relevant EU establishments and certain offers to or monitoring of people in the EU. It is not determined simply by someone's citizenship. UK and other applicable data-protection laws may impose additional or different requirements.

2 Who is responsible for personal data

A controller decides why and how personal data is processed. A processor handles it for a controller under instructions. Our role depends on the particular processing activity.

For account administration, billing, our own business communications and other independently determined purposes described in the Privacy Policy, FuseBase acts as a controller to the extent it determines those purposes and means.

For personal data within customer content that we process on a customer's behalf, FuseBase acts as a processor under the applicable DPA. Examples may include information stored in a workspace, portal, customer application or hosted workflow.

A customer may itself process data for another organization. In that case, FuseBase may be a further processor, and the actual roles, authorizations and instruction chain must be reflected in the applicable agreements. The DPA distinguishes controller-to-processor and authorized processor-to-further-processor arrangements. Applicable agreements and transfer records must identify the actual role and instruction chain; this overview does not supply missing upstream authorization.

Providing infrastructure or maintenance does not alone determine the role for every data flow. Likewise, a software publisher is not necessarily a recipient of personal data merely because its application is installed.

3 Customer responsibilities and FuseBase responsibilities

Customers determine the purposes of their own processing, the information they submit, permitted users and connected services. They are responsible for an appropriate lawful basis, notices, permissions and configurations for those activities, including customer-facing apps and portals.

FuseBase remains responsible for the services and processing it controls under its agreements and applicable law. Where we act as a processor, the DPA addresses instructions, confidentiality, security, assistance, subprocessors and return or deletion of data.

The Privacy Policy explains the purposes and legal bases for processing where FuseBase acts as a controller. Use of the service is not blanket consent to optional tracking or every form of processing. Where consent is required, the relevant activity requires an appropriate consent mechanism.

4 Your rights and how to contact us

Depending on the applicable law and circumstances, you may have rights to:

• receive information about processing and access your personal data;
• correct inaccurate or incomplete information;
• request erasure or restrict processing;
• receive certain data in a portable format;
• object to processing on applicable grounds, including an unconditional objection to processing for direct marketing;
• withdraw consent where processing relies on it, without affecting prior lawful processing; and
• receive applicable safeguards for decisions based solely on automated processing that have legal or similarly significant effects.

These rights have conditions and exceptions. An access request concerns your personal data and required information about its processing; it does not automatically entitle you to other people's data, all organizational records or proprietary software.

For information FuseBase processes as a controller, contact legal@thefusebase.com. For information controlled by an organization using FuseBase, contact that organization or its workspace administrator. If you contact us about that information, we will assist with routing the request and support the responsible customer under the DPA and applicable law.

We may request proportionate information to verify identity where necessary. For EU GDPR requests addressed to us as controller, we respond without undue delay and within one month; a necessary extension of up to two further months requires notice and reasons within the first month. Requests are normally free. Any fee or refusal must have a lawful basis, such as a demonstrably manifestly unfounded or excessive request. Existing more favorable applicable commitments remain unaffected.

You may complain directly to a competent supervisory authority and seek available judicial remedies. You do not have to contact FuseBase first. If we decline a request, we will explain the reason and available complaint rights as required by law.

5 Hosting locations transfers and service providers

FuseBase's primary infrastructure provider is Microsoft Azure. Secondary AWS use and other service-specific providers are described in our Third-Party Services disclosures. Actual processing locations depend on the agreed service, configuration and connected providers; this page does not promise EU-only storage.

International transfers must meet applicable requirements. Depending on the transfer, this may involve an adequacy decision or appropriate safeguards such as contractual clauses, together with any required assessment and additional measures. The applicable DPA and transfer arrangements govern customer processing. Contact us for information about safeguards relevant to your service.

Providers engaged to process customer personal data on our behalf are subject to the applicable DPA's subprocessor requirements, including relevant notice and objection provisions. Customer-connected providers may involve separate arrangements. The provider's actual role and data access must be considered for each connection.

6 AI and customer applications

Our AI Supplemental Terms and Privacy Policy describe managed AI and customer-connected provider arrangements. Customers should review their chosen application's purpose, data, provider settings and required agreements. FuseBase remains responsible for its own processing and providers under the applicable agreements.

An app, agent or workflow does not become GDPR-compliant simply because it was created or hosted with FuseBase. Customer notices, permissions, access controls, retention and any required risk assessment depend on the actual implementation. AI availability does not authorize unrestricted sensitive-data processing or automated decisions.

Health and other restricted data remain subject to the DPA's limitations and any expressly agreed exception. A BAA where required, or permission to store health information, does not automatically approve AI or external integrations for that information.

7 Security retention and deletion

Security obligations follow the applicable agreement and service scope. Information available through the FuseBase Trust Center should be read with its stated scope and supporting materials. This page does not extend an assurance report or agreement to every hosted application or customer configuration.

Retention, data return and deletion follow the Privacy Policy, applicable DPA and agreed service arrangements. Cancelling a subscription, deleting one hosted application and closing an account may have different consequences. We do not use this overview to replace contractual deletion periods or promise that all data can be erased immediately in every circumstance.

8 DPA and further information

Customers may request DPA information or a signed copy at legal@thefusebase.com. Requesting a signature does not mean an otherwise applicable DPA takes effect only when separately requested.

For the governing EU framework, see the GDPR. Our Privacy Policy contains further details about data categories, purposes, recipients, retention and individual rights. Contact us to clarify the processing arrangements relevant to your service.