OpalSpan: supplementary customer communications privacy notice
Version: privacy-en-2026-11-01-v11. Related processing supplement: dpa-en-2026-11-01-v11. Related feature instruction: dpa-instructions-en-2026-11-01-v11.
This is a purpose-specific supplement to the recorded underlying privacy notice. It describes the prospective optional feature, not a customer's acceptance or a currently authorised live message. Existing signed copies and other purposes retain their scope.
Ready IT ApS, CVR 38769383, Denmark; contact@readyit.dk.
Purpose and roles
When a workspace separately enables customer case communications on its applicable instructions, Ready IT processes the selected recipient and message information for optional case-specific service updates: work started, meaningful progress and work finished with a short explanation, plus a customer-safe case projection and case-specific notification preference.
The recipient is an explicitly selected device owner, case customer or responsible contact, not automatically the technician's account. No workspace login is required for the scoped case link. This is not a marketing campaign, a message on every internal event or Ready IT undertaking the company's IT service. Cases remain optional for device work overall.
Ready IT is processor for instructed customer-controlled data, or an authorised subprocessor where the workspace's customer acts for another controller. Its own account, billing, security and necessary incident purposes remain separate controller processing. The instructing organisation establishes the actual service recipient, lawful basis, transparency and upstream authority. A business purchasing label, account or agent request does not establish those facts.
Information used
The feature uses the selected person's name/address and responsibility; case/message identifiers; deliberately shared title and plain-text update; company/signature and verified reply information; exact document/review versions; and minimum preparation, submission, link, preference and recovery metadata.
It does not grant full internal case descriptions, conversations, prompts, commands/logs, credentials, arbitrary attachments, unrelated customer files or other recipients' messages to the customer view. Additional sensitive information remains outside a general feature instruction and requires its separately applicable lawful safeguards.
Human-private previews show the actual sender, chosen recipient, frozen rendered email and deliberately shared customer view. Model-facing Mech/CLI summaries contain only bounded permitted text, IDs/digests and state: no raw capability tokens or full rendered HTML. Generic logs record safe metadata, not outgoing bodies, credentials or bearer links.
Recipients and international handling
| Recipient | Information and purpose |
|---|---|
| Amazon Web Services / Amazon Simple Email Service (SES API v2) | The exact addressed customer/device-owner service message, recipient name/address, company/signature and verified reply information, minimum submission metadata and any usable case/preference links. Existing AWS account 270208331408, verified opalspan.com sending identity, Stockholm/eu-north-1 API region. One fixed authorised platform From identity; no Exchange mailbox, new receiving service, mailbox-read permission or automatic bounce observation is introduced. |
| Selected recipient and its chosen mail service | The communication addressed to that person, including any usable links. The recipient's service is not automatically a provider Ready IT selects for the wider technical-work service. |
| Existing OpalSpan hosting and authorised workspace processing | The protected frozen message, deliberately shared projection and minimum instruction, receipt, link/preference and recovery records under existing hosting/security/processing arrangements. No new hosting or AI provider is selected by this supplement. |
For the expressly instructed on-behalf SES purpose, the applicable AWS agreement, GDPR Data Processing Addendum, supplementary addendum and applicable SCC/alternative transfer arrangements govern the supplier chain. The ordinary Danish-account contracting route is Amazon Web Services EMEA SARL, with the DPA's identified parties. Selecting the Stockholm API region is not an EU-only-access, EU-only-recipient-mail, end-to-end mail-encryption or zero-retention promise. AWS support/onward handling and the recipient's chosen mail service retain their distinct applicable processing arrangements. Supplier/transfer details remain available through contact@readyit.dk and the base DPA process.
The actual From identity is a fixed authorised OpalSpan SES platform sender, not the workspace company or a newly created receiving mailbox. The feature's fixed platform From is OpalSpan updates@opalspan.com, used only with actual runtime sending authority. This notice creates neither receiving capability nor IAM/sender permission. Company branding appears in the body/signature and replies use its verified selected member address. SES feedback forwarding and provider-level bounce/complaint controls do not show that OpalSpan automatically observes those events. A human-reported actual return is distinct from authentication, throttle, content or service rejection. Provider acceptance is not inbox-delivery proof.
Existing Microsoft member/billing/contact mail and Auth0 login mail remain unchanged; authentication-only no-reply credentials/purpose are not repurposed. No open/click tracking, customer data in SES tags, paid add-on, new account, AWS pricing-plan change, wider IAM/credential/sender authority or receiving service is introduced by publishing this notice.
Provider references: https://aws.amazon.com/service-terms/, https://d1.awsstatic.com/legal/aws-gdpr/AWS_GDPR_DPA.pdf, https://aws.amazon.com/compliance/sub-processors/ and https://docs.aws.amazon.com/ses/latest/dg/data-protection.html.
Customer links and preferences
A customer link is read-only and grants only the deliberately shared fields for its reviewed case/audience, without workspace membership. Audience scoping is a content restriction, not authentication of the intended individual. Anyone holding or forwarded a live bearer link can read that allowed projection until expiry or revocation. The mail provider, recipient's mail service or another forwarded recipient can consequently obtain the capability.
Links default to seven days and have a bounded one-to-thirty-day lifetime. Invalid, expired and revoked links share a safe unavailable response. They never expose another recipient's messages or the full internal case/technical history.
A separate preference capability exposes no case content and only stops optional updates for its own workspace/case/normalised recipient. Merely fetching or previewing a URL does not change the preference. Recipient opt-out is not silently reversed by an administrator. Provider authentication, throttle or service rejection does not mean that a valid recipient opted out or bounced.
Retention, access control and rights
The protected message, case records and delivery/recovery evidence follow the applicable case/workspace retention and return/deletion/restriction instruction. This supplement adds no general automatic record-expiry period. Existing recovery-copy generations and separately reviewed manual copies retain their distinct handling.
SES submission creates no Exchange Sent Items copy or receiving mailbox. That is not a promise that AWS queues, delivery/security/operational records, recipient mail or backups are absent. No account-specific SES provider-erasure interval has been verified or newly introduced. Expiring/revoking a link ends later access, not retention of already received email or material already obtained. A durable claim/receipt prevents repeating an uncertain send; minimum no-replay metadata requires a recorded applicable obligation or instruction.
For customer-controlled information, contact the organisation working on the case through its disclosed company reply address or use the existing controller/processor rights route. Ready IT assists through contact@readyit.dk for the affected scope and verified requesting authority. Applicable access, rectification, erasure, restriction, portability, objection, complaint and other statutory rights remain governed by the underlying notice and law; this supplement waives none. Complaints concerning Ready IT's relevant processing may be made to the competent authority, including Denmark's Datatilsynet at https://www.datatilsynet.dk/.
Prospective activation and unchanged service
The new customer purpose is selected only through the reserved operator processing/publication decision and the workspace's attributable optional feature instruction over the exact document copies/hashes and existing agreement binding. Each message still has its own current human send decision. Publication, installation, purchase, continued use or a configured private draft does not show that customer delivery is enabled or that email was sent.
The existing signup/Checkout journey, customer prices/plans, device permissions, telemetry, other mail purposes and signed documents remain unchanged. Only the disclosed prospective customer-purpose use of existing AWS SES is added. Publication changes no AWS pricing plan, fee, account, IAM/credential/sender permission, DNS/receiving service or mailbox-read access, and introduces no new buyer-kind/controller questionnaire. One reserved decision selects/publishes the exact SES copies and specifies the prospective operator purpose/provider configuration; routine verified implementation of that decision is not another activation approval. A specific live test/customer send retains its own scope.