Data subject requests
Answered within 30 days
Trust Centre
Data Privacy
Upstream BPO responds to data subject requests within 30 days. Data in transit is protected by TLS 1.2 or later using the AES-256 cipher suite, and data at rest is encrypted with AES-256.
Key information
At-a-glance governance context
These points summarise the public scope of this page and the main contact or review context around it.
Encryption in transit
TLS 1.2 or later, AES-256 cipher suite
Encryption at rest
AES-256
Data protection officer
Cillian Conor, dpo@upstreambpo.com
Section 1
Data subject requests
Upstream BPO responds to data subject requests within 30 days of receipt. That window aligns with Article 12 of the GDPR and with the equivalent response requirement under the Malaysian Personal Data Protection Act.
Send data subject requests to dpo@upstreambpo.com. Our data protection officer, Cillian Conor, owns the response.
Where Upstream BPO acts as a processor, we route requests that belong to the customer as controller to that customer, and we support their response within the same window rather than answering on their behalf.
Section 2
Rights we support
We support the full set of data subject rights established by the GDPR, and the equivalent rights under the other data-protection regimes that apply to an engagement.
- Access: confirmation of whether personal data is processed, and a copy of that data.
- Correction: rectification of inaccurate or incomplete personal data.
- Deletion: erasure of personal data where the grounds for erasure are met.
- Portability: receipt of personal data in a structured, commonly used, machine-readable format.
- Restriction of processing: limitation of processing while a dispute or verification is resolved.
- Objection: objection to processing carried out on legitimate-interest grounds.
Section 3
Encryption
Data in transit is protected by TLS 1.2 or later using the AES-256 cipher suite. Data at rest is encrypted with AES-256.
The control environment that implements these standards, including key handling and the systems they apply to, is described on our information security page.
Section 4
Retention
Retention is governed by the Data Processing Agreement executed with each customer. Retention periods, deletion triggers and end-of-engagement return-or-destroy handling are set in that agreement rather than by a single default period applied across all customers.
We publish no default retention period here because a single figure would misstate what applies to any given engagement.
Section 5
Data residency
Data residency is configured per contract. Our primary processing location is Malaysia. We also operate in Uzbekistan, covering our Syrdarya and Gulistan operations, and we make other regions available on request.
We confirm the residency configuration for an engagement during solution design and record it in the Data Processing Agreement.
Reviewer questions
Questions we are asked in security review
Answers are stated in full here so they are quotable directly into a security questionnaire.
How quickly do you respond to a data subject request?
Within 30 days of receipt. That window aligns with GDPR Article 12 and the equivalent requirement under the Malaysian Personal Data Protection Act.
What encryption do you use?
Data in transit is protected by TLS 1.2 or later using the AES-256 cipher suite. Data at rest is encrypted with AES-256.
What is your data retention period?
Retention is governed by the Data Processing Agreement executed with each customer. We set retention periods, deletion triggers and end-of-engagement handling in that agreement rather than applying one default across all customers.
Where is our data processed?
Data residency is configured per contract. Malaysia is our primary processing location, we operate in Uzbekistan covering the Syrdarya and Gulistan operations, and other regions are available on request.
Who owns data protection at Upstream BPO?
Our data protection officer is Cillian Conor, reachable at dpo@upstreambpo.com.
Related resources
Related governance and service pages
Use the connected pages below for deeper privacy, governance, service or contact context.
Contact & Escalation
Send data subject requests to dpo@upstreambpo.com. Our data protection officer, Cillian Conor, owns the response, and we answer within 30 days.
Next Step
Need a deeper governance review?
Send certificate requests, subprocessor list requests, incident reports and vulnerability disclosures to dpo@upstreambpo.com. We acknowledge security and trust enquiries within 3 business days.