Privacy policy

Who processes your data

Data the organisation records in the application (assets, agendas, names of technicians and responsible persons, partner contacts) is processed by the portal operator as a processor on behalf of the organisation (Art. 28 GDPR) – the organisation is the controller of this data. Registration, subscription and billing data is processed by the portal operator as a controller.

What data and why

• User account – name, e-mail, password (stored only as a hash), role, last sign-in time: sign-in and access control (performance of a contract, Art. 6(1)(b)).
• Names of people in agendas (performed by, responsible person, assignee, disposal committee members) and partner contacts: records of inspections, calibrations and maintenance (legal obligation and legitimate interest of the organisation, (c) and (f)).
• Billing details and the customer's contact person: subscription and pro forma invoices (performance of a contract, accounting law).
• Contact form on the product pages (name, e-mail, company, phone, question): answering your question (pre-contractual steps and legitimate interest, (b) and (f)). The message is sent by e-mail to the operator's support and is not stored in the portal.
• Change history (who changed a record and when) and application error log (user, browser, page address): security, accountability and support (legitimate interest, (f)).

Cookies and browser storage

The application uses no advertising or analytics cookies and does not track visitors. It stores only strictly necessary data in the browser – the sign-in token, the chosen language and – only if you tick “Remember my e-mail” when signing in – your sign-in e-mail (never the password); no consent is required for that.

Recipients and sub-processors

Hosting and database in EU data centres (Microsoft Azure, EU region). Card payments are processed by Stripe (only data needed for the payment; transfers outside the EU under standard contractual clauses). Bank transfers are matched to pro-forma invoices from the operator's bank statement – the payer's name, account and message are used only for matching and are then deleted. System e-mails (the password reset code) are sent through the portal operator's mail service – only the recipient address and the message text. On the first import of a file the portal may send the column names of the file and, from the first 5 rows, only the type and shape of the values (e.g. 99.99.9999) to the operator's AI service to suggest the column mapping – never the values themselves or personal data. We do not sell data or use it for marketing.

How long

For the duration of the contract; change history 3650 days, deleted accounts are anonymised after 30 days, error log 90 days, accounting documents 10 years. When the contract ends, the organisation downloads an export of all its data (ZIP) and the data is permanently deleted within 30 days of being marked for closure (only pro-forma invoices are kept, without contact details).

Security

Encrypted connection (HTTPS), separation of organisations' data in the database itself (Row-Level Security), passwords stored only as hashes, two-factor sign-in, sign-in attempt limits, role-based access, change history, backups. The portal operator notifies the organisation of a security incident without undue delay (Art. 33).

Your rights

You have the right of access, rectification, erasure, restriction, portability and the right to object. You can download your own data in the application (Data protection); other requests are handled by your organisation's administrator or the portal operator at the contact above. You have the right to lodge a complaint with a supervisory authority.

Data processing agreement (Art. 28)

By signing up, the organisation enters into a data processing agreement with the portal operator: the operator processes data only on the organisation's instructions and for running the application, binds persons with access to confidentiality, applies the technical and organisational measures above, uses only the listed sub-processors (announcing changes in advance), assists the organisation with data subject requests (tools in the application), reports security incidents, returns (export) and deletes the data when the contract ends and provides the information needed to demonstrate compliance.

← Back