Where processing services are provided on behalf of a third party, the personal data may not be applied or used for a purpose other than that in the contract or agreement, nor transferred to other persons, not even for storage; once the contracted service is performed the personal data processed are erased, unless the principal expressly authorises their retention because further engagements are reasonably foreseeable, in which case they may be kept under due security conditions for the period the Reglamento sets (Reglamento articles 30 to 33 add the content of the processing contract, the processor's duties and subcontracting only with the owner's authorisation and under the same obligations).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.