Data processing

The organization is the controller of the personal data it puts into wrkflow, and the operator is its processor. The operator is the controller only of the account, billing and technical data described in the privacy page.

• Purpose: to provide wrkflow: building surveys, sending invitations, collecting and analysing responses, follow-ups, dashboards and exports, and the account and security controls around them.
• People: the organization’s members, its contacts and participants, and the respondents who answer its surveys.
• Data: names, email addresses and phone numbers, contact attributes the organization defines (department, location and so on), survey answers, response times, language, device type, files respondents upload, and the audit log. The organization decides what to ask; it is responsible for asking only what it has a lawful basis for.

The operator processes the data only on the organization’s documented instructions, which are what the organization does in wrkflow and what it agrees in writing, and tells the organization if it believes an instruction breaks the law. People with access to the data are bound to confidentiality.

Organization and role based access with row level security in the database, two-factor authentication, single sign-on and provisioning on the plans that include them, session and network policies an organization can set, an audit log, rate limiting on public pages, encryption in transit, encryption of uploaded files and backups at rest in the file store, and encryption of answers to questions marked sensitive where the deployment has its encryption key set. The full description is on the security page.

The organization agrees to the use of the subprocessors listed on the security page, which describes what each does and receives. The list is kept in step with how this deployment is set up; a change that adds a subprocessor is announced to organizations before it starts, and an organization that objects may end its use of wrkflow.

Data is stored in India (Mumbai, AWS region ap-south-1). Services that receive part of it, such as the email, payment or AI providers on the subprocessor list, process what they receive in their own locations. Moving the stored data elsewhere is announced to organizations beforehand.

Administrators can look up everything held about a person, export it and erase or anonymize it from within wrkflow, and each action is recorded. The operator passes on any request it receives directly from a person to the organization concerned and helps the organization answer within the time the law gives.

The operator tells the organization without undue delay after becoming aware of a breach affecting its data, with what is known, what has been done and what the organization may need to do.

During the subscription the organization can export its data and set how long responses are kept. When an organization is deleted, or the agreement ends, its data is deleted; the nightly database backup is deleted after 30 days and earlier versions of deleted files after 30 days. Data the law requires the operator to keep is kept only for that purpose.

The operator gives the organization the information needed to show compliance with these terms, including the security documentation on request, and allows reasonable audits by the organization or an auditor it names, with notice and without harm to other organizations’ data.