01
Purpose Limitation
Personal information and customer-controlled data should be used only for defined website, business, service-delivery, security, legal, or customer-directed purposes.
Privacy and Data Governance
Privacy built around controlled data use.
Rege-IT Solutions distinguishes between information used to operate our website and business relationships, and customer-controlled data processed through enterprise QA governance services. This notice explains the categories of information involved, why they may be processed, how responsibilities are divided, and how privacy requests may be submitted.
i
This notice is layered with customer agreements.
This page describes Rege-IT’s general website, business-contact, and service privacy practices. Where Rege-IT processes customer-controlled data on behalf of an enterprise customer, the applicable services agreement, data-processing terms, documented instructions, and deployment configuration govern that processing. Customer organizations remain responsible for determining whether the data they submit is appropriate and lawfully collected.
Privacy Principles
Use data for defined purposes, within documented boundaries.
Privacy controls should align the information collected, the purpose for which it is used, the authority under which it is processed, and the evidence retained to demonstrate responsible handling.
02
Data Minimization
Collection and retention should be limited to the information reasonably necessary to operate, secure, support, and document the relevant process.
03
Customer Direction
Enterprise data submitted through configured integrations should remain governed by customer instructions, permissions, contracts, and approved processing purposes.
04
Transparency and Accountability
Processing roles, external services, retention, rights procedures, AI boundaries, and material changes should be documented and reviewable.
Information We May Handle
Data categories mapped to operating purpose.
The information involved depends on whether an individual visits the website, communicates with Rege-IT, participates in an architecture review, administers an account, or uses a customer-configured service.
Context
Information Categories
Primary Purposes
Website and Contact
Contact and communication details
Name, business email, organization, professional role, message content, meeting preferences, and related correspondence.
Respond and maintain the relationship
Answer inquiries, schedule reviews, provide requested information, maintain correspondence, and protect against misuse.
Architecture and Sales Review
Business and delivery-context information
Current toolchain, operational constraints, delivery objectives, project scope, stakeholder roles, and assessment notes.
Evaluate suitability and define scope
Prepare architecture recommendations, identify governance gaps, define a pilot, estimate implementation needs, and support commercial discussions.
Account and Service Administration
Identity, access, and support data
User or service identifiers, organization affiliation, roles, permissions, authentication events, support requests, and configuration data.
Operate, secure, and support services
Provision access, enforce authorization, troubleshoot issues, administer integrations, maintain service continuity, and document changes.
Customer-Controlled QA Data
Enterprise delivery and validation content
Requirements, acceptance criteria, test cases, automation assets, execution results, pipeline events, exceptions, approvals, and release evidence.
Deliver configured QA-governance functions
Generate or standardize validation assets, map traceability, orchestrate testing, evaluate promotion policies, retain evidence, and produce customer-directed outputs.
Technical and Security Operations
Device, network, event, and diagnostic data
IP address, browser or device information, timestamps, request metadata, application events, security alerts, error details, and audit logs.
Maintain reliability, security, and evidence
Detect abuse, investigate events, measure performance, troubleshoot failures, preserve auditability, and improve service operations.
Processing Responsibility
Privacy responsibility depends on why and for whom data is processed.
Rege-IT may determine the purposes and means of processing for its own website, business, administration, security, and legal operations. For customer-controlled enterprise data, Rege-IT is generally expected to process the information under the customer’s documented instructions and applicable contractual terms.
Rege-IT determines the purpose of its own operations.
This may include website communications, business relationships, account administration, service security, legal compliance, internal operations, and protection of rights.
- Responding to prospects and business contacts
- Maintaining customer and vendor relationships
- Securing accounts, systems, and communications
- Meeting recordkeeping and legal obligations
Enterprise data remains subject to customer direction.
Customer-controlled requirements, validation assets, execution evidence, and release records are processed to provide configured services, support approved integrations, and meet contractual obligations.
- Processing limited to documented service purposes
- Access aligned to approved roles and integrations
- Subprocessors governed by applicable terms
- Return, deletion, or retention handled by agreement
AI Data Boundaries
AI processing remains subordinate to approved service purpose.
QA SpecLogic AI is positioned to assist requirements interpretation and test-asset generation. The use of customer-controlled content, external AI services, generated outputs, retention, and provider terms should be documented for the applicable deployment before production use.
Use only data categories authorized for the workflow.
Customers should identify permitted sources, classifications, fields, and exclusions before requirements or test content is submitted for AI-assisted processing.
External processing conditions remain reviewable.
Applicable service terms should document hosting, retention, training or improvement use, access, regional processing, deletion, and subprocessor conditions for any external AI provider.
Generated assets remain subject to human and policy review.
AI-generated test assets should be reviewed, versioned, traceably linked, and approved under the customer’s quality and release-governance process.
AI does not independently authorize production release.
Release-gate decisions remain governed by configured, versioned policies and customer-approved exception or escalation procedures.
Data Lifecycle and Retention
Retention follows purpose, contract, security, and legal need.
Different information categories may require different retention periods. Relevant schedules should consider service delivery, customer instructions, evidence needs, support history, dispute preservation, security logs, backup cycles, and legal obligations.
Obtain for a defined purpose
Collect directly, through configured systems, or from authorized business sources.
Process within the approved boundary
Use for communications, services, security, legal duties, or documented customer instructions.
Preserve only while reasonably needed
Apply category-specific schedules and contractual or legal retention requirements.
Act on agreement, request, or expiry
Return, delete, de-identify, or restrict data when the governing purpose or term ends.
Retain evidence of the disposition
Preserve appropriate records of requests, exceptions, legal holds, and deletion outcomes.
Exact retention periods should be documented in the applicable retention schedule, services agreement, data-processing terms, or deployment documentation. Residual copies may remain temporarily in protected backups until the ordinary backup lifecycle expires.
Individual Privacy Rights
Rights depend on location, relationship, and applicable law.
Subject to applicable law, verification, exemptions, and Rege-IT’s processing role, an individual may have some or all of the rights described below. When Rege-IT acts only on behalf of a customer, the request may need to be directed to that customer.
Access or Know
Request information about categories, sources, purposes, recipients, and specific personal information, where applicable.
Correct
Ask that inaccurate personal information be corrected, subject to verification and applicable exceptions.
Delete
Request deletion of qualifying personal information, subject to legal, security, contractual, and operational exceptions.
Portability
Request qualifying information in a portable format where required and technically feasible.
Restrict or Object
Ask to restrict certain processing or object to processing based on particular legal grounds, where the right applies.
Withdraw Consent
Withdraw consent for future processing when consent is the applicable basis, without affecting earlier lawful processing.
Opt Out
Opt out of qualifying sale, sharing, targeted advertising, or certain profiling where applicable law provides that right.
Appeal or Complain
Appeal certain request decisions or submit a complaint to an applicable supervisory or regulatory authority, where available.
ID
Requests may require reasonable verification.
Rege-IT may request information necessary to confirm identity, authority, applicable jurisdiction, and the relevant processing relationship. Authorized agents may be required to provide proof of authority. Rege-IT does not discriminate against individuals for exercising applicable privacy rights.
Additional Privacy Information
Other circumstances affecting this notice.
Business Services and Children
Rege-IT’s website and enterprise services are directed to organizations and professional users, not children. Rege-IT does not knowingly seek personal information from children through the website or enterprise services. A parent or guardian who believes a child has provided information may contact Rege-IT for review.
Automated Decisions About Individuals
Rege-IT’s release-gate functions evaluate software delivery artifacts, testing outcomes, and deployment conditions. They are not designed to make employment, credit, housing, insurance, health, education, or similarly significant decisions about individuals.
Changes to This Notice
Rege-IT may revise this notice to reflect changes in services, technology, law, or processing practices. The updated page will identify the effective or last-updated date. Material changes should be communicated through an appropriate additional notice when required.
Privacy Requests and Questions
Contact Rege-IT about your information.
Submit a request concerning access, correction, deletion, processing, retention, consent, or another privacy matter. The contact workflow adapts to privacy requests and does not require unrelated enterprise qualification information. Include enough information to identify the relevant relationship or communication, but do not submit passwords, access tokens, sensitive credentials, regulated records, or unrelated confidential information through the form.
Identify the request type
Provide the relevant business context
Await verification or follow-up