1. InfoBox's Role: Processor vs. Controller

InfoBox provides the technology platform that allows your organization to distribute targeted content.

The Publisher (Data Controller):

Your organization (our client) is the Publisher. The Publisher determines what content you receive, who has access, and is responsible for governing the overall use of your data. The Publisher is the Data Controller.

InfoBox (Data Processor):

InfoBox acts as a Data Processor or Service Provider, processing information strictly on behalf of, and according to the instructions of, the Publisher.

If you have questions about your organization’s content, access, or how your organization uses your data, please contact your Publisher directly.

2. Information We Process on Behalf of the Publisher

InfoBox collects and processes the minimal amount of information required to provide the secure, auditable Service.

A. Publisher-Provided Identification Information

The Publisher provides us with the following information solely for the purpose of identifying you and controlling your content access:

• Identification Email Address: Your email address, used as a unique identifier to map you to the content specifically targeted for your role or relationship with the Publisher.

Note on Authentication:

InfoBox does not collect, store, or process any authentication credentials, such as passwords or login tokens. User authentication is handled entirely by the Publisher's organization, and the Service relies on external systems for identity verification.

B. Activity and Usage Information (Auditable Logs)

InfoBox is designed as a governance and compliance tool that requires a comprehensive record of content consumption. We collect the following data to provide the Publisher with a mandatory audit trail:

• Content Consumption Metrics: Includes logs of content access, search queries, visits, and clicks on specific documents and articles. This data is critical for the Publisher's compliance and governance obligations and provides a verifiable record of content consumption.
• Technical Data: Information about the device and client you use, such as device type, operating system, IP address, and application version. Used for troubleshooting, compatibility, and security.

3. How We Use the Information

InfoBox uses the information described in Section 2 solely to provide the Service to the Publisher. We do not use this information for advertising, marketing, or profiling, and we do not sell it to third parties. Our purposes are:

• Access Control: To verify your identity and ensure you only receive content precisely targeted to you.
• Service Delivery: To operate the Service and display the content on all InfoBox Apps.
• Auditing and Compliance: To generate the mandatory audit trail for the Publisher to track content distribution and user consumption, supporting their internal governance and regulatory needs.

4. Disclosure and Data Security

A. Disclosure of Information

InfoBox will only disclose the information we process in the following circumstances:

• To the Publisher: All Activity and Usage Information is disclosed to the Publisher as part of the Service, as they own the content and are responsible for governing its use.
• Cloud Hosting Providers: We utilize reputable cloud hosting providers to store and process the data necessary to run the Service. These providers are bound by strict contractual obligations. InfoBox does not share your data with any other third parties.
• Legal Requirements: If required to do so by law, court order, or governmental authority.

B. Data Security

We implement robust technical and organizational measures to protect the information we process on the Publisher's behalf against unauthorized access, disclosure, or alteration.

5. Your Data Subject Rights

As InfoBox is a Data Processor, we do not directly control the personal data you submit. If you wish to exercise any of your data privacy rights (such as the right to access, correct, delete, or restrict the processing of your data), you must contact your Publisher directly. We will work with the Publisher to fulfill your request as required by applicable law.