Yes. Users can restore their own data from the PRO Client desktop or from a web page.

No. Users cannot see or restore data from any other user account.

Yes, unless the user has specified a private password or a private encryption key that the administrator does not know about. The administrator can lock users out of that option, however.

Yes. If you enable a special private password, no administrator can restore data without that private password. The private password is never stored on the PRO Server.