In business law, what legal considerations determine an organization's custody and control over sensitive client information stored on third-party servers?
a) Data retention policies
b) Contractual agreements with service providers
c) Employee access protocols
d) Technological security measures