OpalSpan: clarification of customer processing instructions
Version: dpa-instructions-en-2026-10-15-v9. Applicable clarification: dpa-en-2026-10-15-v9.
Prepared successor; not selected for Checkout or existing customers. Use only with an attributable acceptance identifying the underlying DPA and original instruction/profile versions. This clarification supplies no new device access, legal basis, supplier authorisation, telemetry tier or processing purpose.
Your existing instruction
The original authorised customer/case, remote technical-work and hosted-Mech instructions remain limited to their actual purpose, data and targets. Preserve the exact accepted Telemetry/Automation document and profile bindings. Do not use this clarification to silently migrate existing grants or historical orders.
Where you act for another controller, remain within that controller's authority, including onward suppliers, AI processing and international transfers. Before using a free or personal workspace for customer-controlled processing, arrange the applicable DPA with contact@readyit.dk; missing Checkout company fields are not proof of household use.
Context, attachments and external assistants
Hosted Mech can use relevant information across cases/conversations within the authorised workspace. Separate chats are not separate confidentiality boundaries. Select only the necessary screenshots, files, output and diagnostic evidence. Do not submit credentials or unrelated personal information. Additional sensitive categories need a specific lawful instruction and suitable safeguards.
Hosted Mech uses the disclosed OpenAI API route, including selected-file analysis when requested. This does not instruct EU-only or zero-retention processing. Responses storage controls do not remove provider abuse monitoring, caching, container state or image/file safety exceptions.
If you choose your own Claude Code, Codex or other external assistant for Agent CLI, establish its actual provider contract and account settings. That provider may receive material made available to the assistant and keep its own local or cloud transcripts. Ready IT's hosted-Mech arrangement does not automatically apply to your assistant. A supplied assistant under a separate Ready IT engagement requires its own identified processing chain.
Attributed request evidence
The service can record who requested a technical action and its scope. That record is not another person's consent, an independent legal-role declaration, or proof of objective necessity. Applicable employee/device-user notices, lawful basis and upstream-controller instructions remain grounded in the actual facts. Keep the current server-enforced permissions, exact selected tier, profile-specific authority and local opt-out. Removing a veto creates no grant.
Support reports and end-of-processing instructions
Use minimised or synthetic evidence in bug reports where possible. Reports go to private GitHub issues; original attachments are held in private S3. Anyone holding an attachment link can download without login until its fixed expiry. A new report's 90-day bearer window is not a 90-day erasure promise for all report and recovery records. Do not use this route as a general customer-file archive or include another controller's data outside the established agreement.
Send specific return/deletion/restriction instructions to contact@readyit.dk. Identify the affected workspace and controller authority. Stopping payment, closing a case, deleting a schedule or expiring a link is not an instruction that every related system and recovery copy has been erased. The underlying DPA's return/deletion and assistance obligations remain unchanged.