Data processing agreement

1. Parties and scope

This Data Processing Agreement (the “Agreement”) is between:

• the Customer, the company or organisation that holds a FlowAttend account, acting as controller; and
• [FlowAttend legal entity], [registered address], [registration number] (“FlowAttend”), acting as processor.

It applies to all personal data that FlowAttend processes on the Customer’s behalf when providing the FlowAttend service (the “Service”): creating attendance sheets, collecting participants’ and trainers’ signatures, generating PDF sheets and exports. It forms part of FlowAttend’s terms of service and applies for as long as FlowAttend processes such data.

Terms such as personal data, processing, controller, processor, data subject and personal data breach have the meaning given in Regulation (EU) 2016/679 (the “GDPR”). “Data Protection Laws” means the GDPR and the Luxembourg law of 1 August 2018 on the organisation of the National Data Protection Commission and the general data protection framework.

2. Subject matter, purpose and duration

FlowAttend processes personal data only to provide the Service to the Customer: recording attendance at the Customer’s trainings and producing signed attendance sheets, and, where the Customer turns on Luxembourg grants, the information needed for its INFPC co-funding requests.

The nature of the processing is collection through the signing pages, storage, generation of PDF sheets and exports, sending of sheets by email at the Customer’s request, and deletion. Annex 1 lists the data subjects, the categories of data and how long they are kept.

The processing lasts for the term of the Customer’s subscription, plus the time needed to delete the data under section 9.

3. FlowAttend’s obligations

FlowAttend shall:

1. process the personal data only on the Customer’s documented instructions, including with regard to transfers outside the European Economic Area (EEA), unless EU or Member State law requires otherwise, in which case it informs the Customer first unless that law forbids it. The Customer’s instructions are this Agreement and the Customer’s use and settings of the Service;
2. inform the Customer immediately if, in its opinion, an instruction infringes Data Protection Laws;
3. ensure that anyone authorised to process the personal data is bound by confidentiality;
4. take the security measures required by article 32 GDPR, described in section 4 and Annex 2;
5. respect the conditions of section 5 for engaging sub-processors;
6. assist the Customer, taking into account the nature of the processing, in responding to data subjects’ requests (section 7) and in meeting its obligations under articles 32 to 36 GDPR (security, breach notification, impact assessment, prior consultation);
7. delete or return the personal data at the end of the Service (section 9);
8. make available the information needed to demonstrate compliance with article 28 GDPR and allow audits (section 10).

The Customer is responsible for the lawfulness of the processing it instructs. In particular, it informs participants and trainers and obtains any consent it needs. On Luxembourg grants sessions, the Service shows participants and external trainers a data protection notice naming the Customer, which they accept before signing.

4. Security

FlowAttend implements technical and organisational measures appropriate to the risk, taking into account the state of the art, the cost of implementation, and the nature, scope, context and purposes of the processing. Annex 2 describes the measures in place. FlowAttend may update them, provided the overall level of security does not decrease.

5. Sub-processors

The Customer gives FlowAttend a general authorisation to engage sub-processors. Those engaged at the date of this Agreement are listed in Annex 3.

FlowAttend informs the Customer at least 30 days before adding or replacing a sub-processor, by email to the account owner and on this page. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may terminate the affected Service and receive a refund of fees paid in advance for the remaining period.

FlowAttend imposes on each sub-processor, by contract, data protection obligations equivalent to those of this Agreement. It remains fully liable to the Customer for its sub-processors’ performance.

6. Transfers outside the EEA

FlowAttend stores the Customer’s personal data in the European Union (Annex 3), except what the Customer sends to FlowAttend’s support mailbox. Where a sub-processor processes personal data outside the EEA, or may access it from there, FlowAttend ensures the transfer complies with chapter V of the GDPR: an adequacy decision (including the EU–US Data Privacy Framework for certified US providers) or the European Commission’s Standard Contractual Clauses, with supplementary measures where needed.

This section concerns FlowAttend’s own hosting. It does not change what INFPC states about its handling of co-funding requests.

7. Data subjects’ requests

If FlowAttend receives a request from a participant or trainer about data it processes for the Customer (access, rectification, erasure, restriction, portability, objection), it forwards it to the Customer within 5 working days and does not answer it itself, except to say it has been forwarded.

The Service lets the Customer handle most requests directly: it can view a session’s participants and download the PDF, and it can delete a session together with its participants and signatures. For anything the Service doesn’t cover, FlowAttend assists the Customer within a reasonable time.

8. Personal data breaches

FlowAttend notifies the Customer without undue delay, and at the latest 48 hours after becoming aware of a personal data breach affecting the Customer’s data. This leaves the Customer time to notify the CNPD within the 72 hours set by article 33 GDPR.

The notification describes, as far as known at the time:

• the nature of the breach, the categories and approximate number of data subjects and records concerned;
• the likely consequences;
• the measures taken or proposed to address the breach and limit its effects;
• a contact point for more information.

Information not available at first is provided as soon as it is. Notifying a breach is not an admission of fault.

9. Retention, deletion and return

During the Service, participants’ names and signatures are deleted automatically once a session is older than the history included in the Customer’s plan (Annex 1). The Customer can download its PDF sheets and exports at any time before then, and can delete a session earlier.

At the end of the Service, the Customer may download its data for 30 days. FlowAttend then deletes the personal data it processes for the Customer, including copies, within 30 further days, unless EU or Member State law requires it to keep them. Backups held by sub-processors are overwritten in their normal backup cycle. FlowAttend confirms the deletion in writing on request.

10. Audits and information

FlowAttend makes available to the Customer the information needed to demonstrate compliance with this Agreement: this Agreement, Annexes 2 and 3, and written answers to reasonable security questionnaires.

If that is not enough, the Customer, or an independent auditor bound by confidentiality, may audit FlowAttend once a year, on 30 days’ written notice, during business hours and without disrupting the Service. A further audit is possible after a breach or at a supervisory authority’s request. Each party bears its own costs. Audits of sub-processors rely on their own certifications and reports.

11. Liability, term and governing law

• Liability: each party’s liability under this Agreement follows the limits set in FlowAttend’s terms of service, without prejudice to data subjects’ rights under article 82 GDPR.
• Term: this Agreement runs as long as FlowAttend processes personal data for the Customer. Sections 9 and 10 survive until the data is deleted.
• Precedence: if this Agreement conflicts with the terms of service on the protection of personal data, this Agreement prevails.
• Changes: FlowAttend may update this Agreement to follow changes in Data Protection Laws or in the Service, with 30 days’ notice. A change that lowers the protection of personal data requires the Customer’s agreement.
• Governing law: Luxembourg law. The courts of Luxembourg City have jurisdiction.

Annex 1 — Description of the processing

No special categories of data (article 9 GDPR) are processed. A handwritten signature captured as an image is not used for biometric identification.

Participants’ names and signatures are deleted automatically, counted from the training date:

The session itself (training name, date, times) is kept for the account’s history and monthly count.

Annex 2 — Technical and organisational measures

In transit and at rest

• All traffic over HTTPS, with HTTP Strict Transport Security; the site cannot be shown inside another site’s frame.
• Data stored in a managed PostgreSQL database and private file storage in the European Union, encrypted at rest by the provider.
• Saved trainer signatures in a private storage bucket, read only through links that expire after 5 minutes.

Access control

• Users sign in with a password or Google; passwords are handled by the authentication provider, never stored by FlowAttend in clear.
• Every request for a session, its participants or its PDF checks that the user belongs to the account that owns it. On the Team plan, deleting sheets and changing team settings is reserved to the owner.
• Public signing pages receive only what they need: no account identifiers, no other participant’s data, never the trainer’s signing link or signature.
• An external trainer’s signing link works once.

Abuse prevention

• Rate limits on sign-in, signing and exports, keyed by IP address or user, kept for 1 day.
• Size and format checks on signatures; at most 300 participants per session; a second signature from the same browser on the same session is refused.

Data minimisation and deletion

• Participants need no account and give only their name and signature.
• Automatic deletion of names and signatures at the end of the plan’s history (Annex 1); a session can be deleted at any time.

Organisation

• Production access limited to the people who run FlowAttend, with two-factor authentication on the hosting, database and email accounts.
• Confidentiality undertakings for anyone with access; access removed when they leave.
• Dependencies kept up to date; security fixes applied promptly.

Annex 3 — Sub-processors

Users who choose to sign in with Google share their Google account name and email with FlowAttend; Google acts there as an independent controller, not as FlowAttend’s sub-processor. See also our privacy policy.