Privacy and compliance controls in Backoffice
Backoffice keeps its privacy and legal controls in two sidebar groups: Privacy & Legal and Web Analytics & Privacy. Use this page as a map. It names each page, says who can open it, what it records and which docs page explains it. A security or privacy owner or a Backoffice administrator uses it to plan a review.
These pages record decisions and settings. They do not give legal advice, and a recorded setting does not make your use of Noxtica lawful. Your counsel decides that. The public legal pages are the sole source for legal terms: Terms, Privacy Policy, DPA, Subprocessors, Cookies, Acceptable Use, Disclaimer and Legal notice.
What it is
Availability: depends on your plan, role and the modules enabled for your organisation.
The sidebar shows both groups to administrators. A signed-in user with a lower role does not see the entries, and several pages also check a permission on the server. Changes to retention, raw IP storage, legal bases and per-domain consent ask for a fresh multi-factor check (step-up) before they save.
Privacy & Legal
| Page | What it records or shows | Who can use it | Explained in |
|---|---|---|---|
| Data Retention | Days that browser intelligence data is kept, the check interval, a read-only retention schedule, a manual “Run retention now” action and the Raw IP storage opt-in. | Administrators. Saving needs step-up. | Retention, raw IP and locations |
| Data Locations | Read-only table of where five kinds of your data are stored. | Administrators see the sidebar entry. The data is read-only. | Retention, raw IP and locations |
| Compliance | Placeholder rows for compliance documents with disabled Download buttons, and an EU AI Act Article 50 transparency policy for verified AI agents when enabled for your organisation. | Administrators. | DPA, sub-processors and assurance |
| Legal Basis Register | Versioned records of the legal basis your organisation asserts as controller for each gated feature, plus the per-domain Replay legal basis. | Administrators. Recording needs step-up. | Legal basis register |
| Data Subject Scope | Read-only explanation of the decisions that belong to your visitors. Its links lead to controls that switch collection off or withdraw an assertion, never to a control that switches something on. | Administrators. | Requests and deletion |
| Sub-processors | Whether your organisation accepted the AI assistant as a sub-processor for write actions. | Administrators. | DPA, sub-processors and assurance |
| Platform Assurances | Read-only statements of what Noxtica remains responsible for. Nothing to switch. | Administrators see it in the sidebar. | DPA, sub-processors and assurance |
Web Analytics & Privacy
| Page | What it records or shows | Who can use it | Explained in |
|---|---|---|---|
| Consent & Privacy | Per domain: the legal basis for real-user monitoring, whether visitors must consent, and the Do Not Track (DNT) and Global Privacy Control (GPC) policy. | Administrators. Saving needs step-up. | Legal basis register and Cookies and storage |
| RUM Collection | Workspace switch for real-user monitoring and a sample rate per domain. | Administrators. | Real user monitoring |
| Tracking Allowlists | Per domain: which custom events and properties are accepted and which origins may be traced. | Administrators. | Custom events and tracing |
| Capture Policies | Per domain: replay sampling, masking and retention, and console-log capture. | Administrators. | Session replay and Errors and console logs |
| RUM Data Lifecycle | What real-user monitoring data you hold, the error-detail retention per domain, and a permanent purge per data lane. | Administrators. | Retention, raw IP and locations |
| Uptime Checks | Scheduled HTTPS checks of endpoints you prove you own. | Administrators. | Uptime checks and status |
Related pages outside these two groups
| Page | Where | What it is for | Explained in |
|---|---|---|---|
| Data Operations | Backoffice → Administration → Data Operations | Soft-delete end-user data, run retention now, remove admin accounts, read the operations history. | Requests and deletion |
| KYC Verifications and KYC Erasure Requests | Backoffice → Identity Verification → KYC Verifications and KYC Erasure | The two Backoffice routes that delete identity verification data: administrators delete verifications directly, and erasure requests are approved by a second administrator. | Requests and deletion and Verification data |
| Legal basis for hosted verification | Backoffice → Identity Verification → KYC Invitations → Settings | Records the legal basis that hosted verification needs. | Invitations and hosted settings |
| CSP & storage tab | Backoffice → Integrations & API → Script & Consent → CSP & storage | The cookie and storage table to copy into your cookie policy. | Cookies and storage |
| Privacy & cookies | Backoffice → Settings | Your own choice, as a signed-in user, whether Noxtica’s consent-gated extensions run on the Backoffice console. | Cookies and storage |
Identity verification data follows a separate rule. Noxtica does not remove verification details or evidence by itself and sets no retention date for them. They stay until a tenant administrator deletes them. The Data Retention page applies to browser intelligence data and never touches verification records.
Four separate legal-basis records
Backoffice keeps four kinds of recorded basis. A record of one kind never covers another.
| Record | Scope | Where you record it | What it gates |
|---|---|---|---|
| Register entry | Your workspace, one entry per gated feature | Privacy & Legal → Legal Basis Register | The gated feature named by the entry |
| Replay legal basis | One domain | Privacy & Legal → Legal Basis Register, section Replay legal basis | Turning on session replay for that domain |
| Consent & privacy decision | One domain | Web Analytics & Privacy → Consent & Privacy | Real-user monitoring, error-detail and console-log capture on that domain |
| Hosted verification legal basis | Your workspace | Identity Verification → KYC Invitations → Settings | Minting and submitting hosted verification sessions |
Prerequisites
- A Backoffice account with the administrator role for your workspace. See Roles and permissions.
- A multi-factor method enrolled on your account, because saving most of these pages asks for a fresh check. See Sign-in and access.
- At least one domain added to the workspace for the per-domain pages. See Domains.
- Identity verification pages appear when the module is enabled for your organisation.
Steps
1. Open the groups
Sign in at https://backoffice.noxtica.com. In the sidebar open Privacy & Legal and then Web Analytics & Privacy. If an entry is missing, your role is below administrator.
2. Set retention and raw IP storage
Open Privacy & Legal → Data Retention. Review the retention schedule and the Raw IP storage setting. Details are in Retention, raw IP and locations.
3. Record legal bases for the features you use
Open Privacy & Legal → Legal Basis Register. Record a basis for each gated feature you turn on, and record the Replay legal basis before you enable replay on a domain. Details are in Legal basis register.
4. Resolve per-domain consent decisions
Open Web Analytics & Privacy → Consent & Privacy. Decide the legal basis, the consent requirement and the DNT and GPC policy for each domain that collects real-user monitoring data.
5. Set capture policies
Open Web Analytics & Privacy → Capture Policies. Choose replay sampling, masking and retention and the console-log setting for each domain.
6. Publish your cookie disclosure
Open Integrations & API → Script & Consent → CSP & storage. Copy the storage table into your cookie policy. See Cookies and storage.
7. Know your deletion and assurance routes
Read Requests and deletion and DPA, sub-processors and assurance before a request or a procurement review arrives.
Verify it works
- Consent & Privacy shows an “All resolved” badge and the line “No domain has an unresolved consent or privacy decision.”
- Legal Basis Register shows the status “Asserted” and a receipt line for each basis you recorded.
- Data Retention lists the retention schedule with a Source badge for each row: “Your override”, “Plan default” or “Default”.
- Raw IP storage shows the badge “Disabled” or “Enabled” and the time of the last change.
- Every save above appears in the audit log. See Audit log and data export.
Troubleshooting
| Symptom | Cause | Fix |
|---|---|---|
| The Privacy & Legal group is missing from the sidebar. | The sidebar hides these entries from roles below administrator. | Ask an administrator of your workspace, or ask for the administrator role. |
| Legal Basis Register shows an error instead of the gates. | The register needs the permission to record legal bases, which is administrator level. | Sign in as an administrator. |
| A save asks you to verify again. | Retention, raw IP, legal basis and consent decisions need a fresh multi-factor check. | Complete the prompt. Cancelling changes nothing. |
| The Compliance page has Download buttons you cannot press. | The rows are placeholders. The tooltip says compliance documents will be provided through the customer success portal. | Ask your account team. Do not treat the rows as evidence that a report exists. |
| The EU AI Act card is missing from Compliance. | The card shows when the policy is enabled for your organisation. | Ask your account team whether it applies to you. |
| No identity verification retention note appears on Data Retention. | The note appears when the identity verification module is enabled for your organisation. | Enable the module through your account team. |
Related
- Legal basis register and receipts: record, change and withdraw a legal basis.
- Data retention, raw IP storage and data locations: retention controls and where data lives.
- Data subject scope, erasure requests and account deletion: deletion routes.
- Cookies, storage and consent categories: what the SDK writes in a visitor’s browser.
- DPA, sub-processors, DPIA pointers and assurance: public documents and assurance pointers.
- Security and trust evidence: what Noxtica publishes about its security posture.