Lawfulness, fairness and transparency
A data protection principle whose concrete implementation and legal basis must be assessed in the relevant context.
BLUETRIX Trust
Privacy begins with purpose and responsibility.
Product principles and possible controls support context-specific data protection decisions without replacing legal assessment.
GDPR principles
Seven official principles as guidance.
Their inclusion does not establish BLUETRIX compliance.
Official EU guidancePurpose limitation
A data protection principle whose concrete implementation and legal basis must be assessed in the relevant context.
Data minimisation
A data protection principle whose concrete implementation and legal basis must be assessed in the relevant context.
Accuracy
A data protection principle whose concrete implementation and legal basis must be assessed in the relevant context.
Storage limitation
A data protection principle whose concrete implementation and legal basis must be assessed in the relevant context.
Integrity and confidentiality
A data protection principle whose concrete implementation and legal basis must be assessed in the relevant context.
Accountability
A data protection principle whose concrete implementation and legal basis must be assessed in the relevant context.
Roles
Responsibilities depend on the use.
Customer organisation
Typically determines the purposes and essential means.
BLUETRIX operator
Processes data according to the agreed operating and contractual model.
Subprocessors
May be engaged contractually for defined services.
Data subjects
Have statutory data protection rights depending on the context.
The precise allocation of roles is determined by the contract, use case and actual processing.
Data categories
Depending on configuration, not always complete.
- Contact data
- Organisation and role information
- Communication content
- Interaction and activity data
- Form submissions
- Appointment and task data
- Opportunity and service information
- Technical log and usage data
- Derived signals and AI outputs
- Integration and channel references
Sources and controls
Document data provenance and controls.
- Direct input, communication and forms
- Connected systems and imports
- Approved public sources
- Technical usage or process information
- Roles and permissions
- Retention, export and rectification
- Deletion or anonymisation
- Audit, tracking and integrations
Data subject rights & retention
Specific handling by the responsible organisation.
No universal retention period is stated.
- Information and access
- Rectification and deletion
- Restriction and objection
- Data portability
- Withdrawal of consent
- Complaint to a supervisory authority
- Purpose, contract and legal obligations
- Deletion, anonymisation or archiving
AI and personal data
Access depends on purpose and role.
AI agents do not automatically receive access to all information in a workspace.
- Purpose and required data
- Permitted data sources
- Model and provider
- Possible data transfer
- Retention
- Human review
- Transparency
- Effects
Forms and tracking
Configuration requires an accountable decision.
Depending on configuration, embedded forms may capture opening, step changes, submission or closing.
- Which events are required
- Whether consent is required
- When tracking is enabled
- Which information is shared
- How long data is stored
- Which privacy notices appear
Legal notice
Product principles are not legal advice.
This page explains product principles and possible privacy controls. It does not replace an individual privacy notice, legal advice or contractual agreement. A legally binding notice must identify the operator, contact details, purposes, legal bases, recipients, transfers and retention periods and must undergo legal review.