GDPR compliance

UltiSuite integrates operational mechanisms of the General Data Protection Regulation (GDPR): transparency, individual rights, consents, portability, erasure, processing restriction, activity register and request tracking (DSAR).

The suite is designed for sovereign deployment: your data stays on infrastructure you control. Software components (Authentik, Nextcloud, database, storage, etc.) are not external subprocessors — they are part of your instance.

Only third-party services actually enabled on your instance (AI providers, OAuth, payments, etc.) may receive data outside this perimeter. They are listed dynamically on the subprocessors page.

Right of access (Art. 15) — obtain an overview of your data and processed categories via the summary in your account, or a full export.

Right to rectification (Art. 16) — edit your profile, contacts and content directly in the relevant applications.

Right to erasure (Art. 17) — request deletion of your account and associated data, orchestrated across all enabled services.

Right to restriction (Art. 18) — enable processing restriction to block AI enrichment, outbound webhooks and external LLM calls.

Right to portability (Art. 20) — download a structured export (ZIP) of your personal data.

Right to object (Art. 21) — withdraw consents (e.g. AI contact enrichment) or limit certain processing.

Right not to be subject to automated decision-making — AI suggestions remain aids; you keep control of sends and actions.

Sign in and open Settings → My account (`/settings/informations`) to manage consents, export your data, restrict processing or request account erasure.

You can clear data stored locally in your browser (cache, preferences, offline queue) from the same page.

If your account is managed by an organization, some requests may be handled by your instance administrator. Contact them or the privacy contact listed below.

Full privacy policy: purposes, legal bases, retention, cookies and local storage.

List of external subprocessors enabled on this instance, generated dynamically according to your integrations.

Data Processing Agreement (DPA) template for B2B clients and multi-organization deployments.

Public API `GET /api/v1/privacy/disclosure` to integrate the subprocessors list into your own processes.

Retention periods configurable by the administrator (audit logs, webhooks, transcriptions, Drive trash, deleted mail) and applied by automatic workers.

Orchestrated erasure: on deletion request, UltiSuite purges data on PostgreSQL, Authentik, Nextcloud, object storage and enabled modules (Immich, etc.).

Encrypted mail credentials, zero-trust option for end-to-end message encryption, secure OIDC sessions.

Usage analytics via self-hosted Matomo in cookieless mode when enabled — no analytics cookie banner in this configuration.

Export of the processing activity register (ROPA) in JSON format from the admin console.

DSAR request tracking (export, erasure, restriction) with automatic closure when processing completes.

User data export by an administrator to respond to access requests.

Compliance documentation (DPIA, incident response) available for high-risk deployments.

"100% GDPR compliant" means the suite provides the technical and organizational features needed for operational compliance. Overall legal compliance of your deployment remains the responsibility of the data controller (your organization or the instance operator).

DPA templates and legal texts must be reviewed by your legal counsel before contractual use.

Backups and technical logs may temporarily retain data after erasure, according to configured purge cycles — see the privacy policy.

Privacy contact: see your UltiSuite instance administrator.

You may also lodge a complaint with the CNIL or the data protection authority in your country.