Client Data & Access Policy

01 / Establish authority and scope

Before testing, record the approving owner or authorized representative, merchant authorization where an agency commissions the work, domains, systems, environment, permitted activities, dates and emergency contact. Define the assessed release/version, agreed journeys, test accounts, allowed writes, exclusions and stop conditions in the statement of work. Authorization must cover the actual systems, not just a general request to check a website.

02 / Arrange limited access

Document why each permission is needed, who receives it and when it expires. Use Shopify collaborator access where needed and supported, with only approved permissions, or a named test account. Never request the owner's password, MFA/recovery codes or unrestricted access as a default. Agree a protected credential-sharing method before exchanging secrets; ordinary email and public inquiry links are not credential-upload channels.

Prefer staging/development environments, test payment gateways and synthetic customer records. Real transactions or production changes require separate explicit written approval. If appropriate access cannot be arranged, mark the affected scenario untested rather than bypass restrictions.

03 / Minimize and protect information

Agree the necessary data categories before access. Avoid full customer/order exports, special-category data and payment-card data. If live personal data is unavoidable, establish the legal basis, controller/processor roles, access locations and required data-processing terms first. The client remains responsible for authority to disclose the material; Relisentry must follow documented lawful instructions and raise concerns before proceeding.

Keep findings confidential. Reports should use test identifiers and redacted screenshots; omit unnecessary names, emails, addresses, session cookies, tokens and order details. Review evidence for accidental disclosure before delivery. Restrict project material to the agreed participants and do not publish it without separate permission.

04 / Approve tools and subcontractors

Before any client material leaves approved systems, identify the proposed testing, storage, transfer, AI and collaboration providers, purposes, data categories, processing locations and access recipients. Obtain the client's required approval and put appropriate confidentiality, processing and transfer terms in place. Do not assume that this marketing website's hosting approval covers audit evidence storage.

No unapproved subcontractor or general-purpose AI service may receive client data or credentials. Use synthetic or de-identified examples where possible. Confirm provider retention, deletion and any training/secondary-use settings before approved use, rather than assuming them.

05 / Record storage, transfer and retention

The engagement must specify approved storage locations, access controls, delivery recipients, transfer method, retention period and who handles deletion. Select a method appropriate to the sensitivity and verify its actual configuration before use; no particular certified storage or encryption-at-rest control is implied by this page. Avoid public links and unnecessary duplicate copies.

Share reports and evidence only through the agreed channel. Retain working material only for delivery, the agreed retest window and applicable legal/contractual needs. If no retention schedule is agreed, do not begin collecting confidential client evidence. Business correspondence and legally required records are treated separately under the Privacy Policy.

06 / Return, delete and revoke

At engagement end, deliver or return the agreed evidence, inventory remaining working copies, remove temporary data and credentials under the retention schedule and confirm actions with the client. Ask the owner to revoke collaborator/test access and verify withdrawal where possible. Revoke or rotate temporary credentials through the authorized owner; do not change the owner's credentials independently.

Deletion confirmations must state any legal hold, required retained records and provider backup limitations. Do not promise deletion from all backups immediately if the provider does not support it. Deleted client data must not later be reused for marketing, AI training or another engagement.

07 / Handle unexpected exposure

If credentials or personal data are exposed, stop the affected activity, contact the designated client representative without undue delay, contain the issue within authorization and preserve a minimal incident record. Coordinate credential revocation, impact assessment, recovery and remediation with the client. Do not silently continue testing or delete relevant incident evidence without agreement.

Contractual and statutory notification duties, including any applicable breach deadlines, depend on the roles and law. Agree the notification channel and responsibilities before access; this public policy does not establish a guaranteed response time. Security concerns: teakukic07@gmail.com.

08 / Confirm the engagement terms

The statement of work defines deliverables, test scope and access boundaries. An NDA covers confidentiality where needed. A DPA and appropriate international transfer safeguards must be signed where applicable before personal data is processed on the client's behalf. No signed DPA, NDA or transfer clauses are implied merely by visiting this page.

If a client requirement conflicts with the available tools or these boundaries, resolve it in writing before work or pause the affected activity. These public rules do not expand the published audit scope or replace individual legal obligations. Contact Tea Kukić at teakukic07@gmail.com to arrange the required documents.