01. ROLES & INTERNATIONAL TRANSFERS

In client engagements, the Client acts as the Data Controller, and Ulakto LTD acts as the Data Processor. Processing of customer personal data (transcripts, CRM entries, phone numbers) is executed strictly under client instructions. International data transfers are safeguarded under the UK ICO International Data Transfer Addendum to EU Standard Contractual Clauses (SCCs).

02. SECURITY CONTROLS & BREACH NOTIFICATION

Ulakto LTD maintains TLS 1.3 encryption in transit, AES-256 encryption at rest, environment isolation for API credentials, and strict RBAC controls. In the event of a confirmed security incident, Ulakto LTD shall notify the Data Controller without undue delay and no later than 36 hours post-confirmation.